Changes from code review

rapid7 · Oct 15, 2024 · 26d0aa3 · 26d0aa3
1 parent 26eddbb
commit 26d0aa3
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/...er/stdapi/src/main/java/com/metasploit/meterpreter/stdapi/stdapi_sys_process_execute.java b/...er/stdapi/src/main/java/com/metasploit/meterpreter/stdapi/stdapi_sys_process_execute.java
@@ -68,8 +68,12 @@ public int execute(Meterpreter meterpreter, TLVPacket request, TLVPacket respons
     // On Windows, Java quote-escapes _some_ arguments (like those with spaces), but doesn't deal correctly with some
     // edge cases; e.g. empty strings, strings that already have quotes.
     protected String escapeArg(String arg) {
-        if (System.getProperty("os.name").toLowerCase().contains("windows")) {
-            if (arg == "") {
+        if (arg == null) {
+            return null;
+        }
+        String osName = System.getProperty("os.name");
+        if (osName != null && osName.toLowerCase().contains("windows")) {
+            if (arg.equals("")) {
                 return "\"\"";
             } else {
                 StringBuilder sb = new StringBuilder();