From 5ce3b25d6362356821742a6d0702ee546d32cb85 Mon Sep 17 00:00:00 2001
From: snow <snow@snows-MacBook-Pro-2.local>
Date: Sun, 9 Aug 2026 17:56:37 -0700
Subject: [PATCH] Validate command injection level 1 IP input

Signed-off-by: snow <snow@snows-MacBook-Pro-2.local>
---
 .../vulnerability/commandInjection/CommandInjection.java    | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java b/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
index b74752f24..d72aac0c9 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/commandInjection/CommandInjection.java
@@ -67,7 +67,11 @@ StringBuilder getResponseFromPingCommand(String ipAddress, boolean isValid) thro
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_1, htmlTemplate = "LEVEL_1/CI_Level1")
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
             @RequestParam(IP_ADDRESS) String ipAddress) throws IOException {
-        Supplier<Boolean> validator = () -> StringUtils.isNotBlank(ipAddress);
+        Supplier<Boolean> validator =
+                () ->
+                        StringUtils.isNotBlank(ipAddress)
+                                && (IP_ADDRESS_PATTERN.matcher(ipAddress).matches()
+                                        || ipAddress.contentEquals("localhost"));
         return new ResponseEntity<GenericVulnerabilityResponseBean<String>>(
                 new GenericVulnerabilityResponseBean<String>(
                         this.getResponseFromPingCommand(ipAddress, validator.get()).toString(),