[BUG]: Vulnerability reported by Veracode Static Scan

[fforgoso]

Describe the bug
Hi all.
We got the following vulnerability issue when we ran Veracode Static Scan.
Could you take a look and share your thoughts about it?
Thanks in advance!

To Reproduce
Run Veracode Static Scan against microsoft-spark jar files.

Found in v2.0.0.
microsoft-spark-2-4_2.11-2.0.0.jar - org/apache/spark/deploy/dotnet/DotnetRunner.scala:136
microsoft-spark-3-0_2.12-2.0.0.jar - org/apache/spark/deploy/dotnet/DotnetRunner.scala:135
microsoft-spark-3-1_2.12-2.0.0.jar - org/apache/spark/deploy/dotnet/DotnetRunner.scala:135

Veracode Issue CWE ID 78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
https://cwe.mitre.org/data/definitions/78.html

Attack Vector: java.lang.ProcessBuilder.start
Number of Modules Affected: 1

Description: This call to java.lang.ProcessBuilder.start() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. start() was called on the builder object, which contains tainted data. The tainted data originated from earlier calls to org.apache.spark.deploy.dotnet.DotnetRunner$.main, and org.apache.spark.deploy.dotnet.DotnetRunner.main.

Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection.

Expected behavior
Veracode Static Scan does not report the issue anymore.

[suhsteve]

@fforgoso the DotnetRunner is the main driver application when submitting a job to spark. The DotnetRunner accepts a list of arguments, where the argument list is expected to be the .NET for Spark C# application with accompanying arguments that it should be launched with. This in turn is used in ProcessBuilder to start the C# app.

Currently no validation is being done on these arguments. If this is a cause for concern, we are open to any feedback/PRs from the community that will help address.

[fforgoso]

Thank you for your answer @suhsteve!
As you may guess, I'm a .Net developer with null knowledge of Scala. I'm wondering if there is any chance that one of you guys, maintainers of this project, could add the logic needed to sanitize these arguments ...
Please, let me know your thoughts.