# Add Security Hotspot for Java system properties

**URL:** <https://community.sonarsource.com/t/add-security-hotspot-for-java-system-properties/21682>\
**Category:** New rules / language support\
**Tags:** security, java\
**Created:** [March 16, 2020, 4:54pm UTC](https://community.sonarsource.com/t/add-security-hotspot-for-java-system-properties/21682 "2020-03-16T16:54:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![reitzmichnicht](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/reitzmichnicht/32/288_2.png) [@reitzmichnicht](https://community.sonarsource.com/u/reitzmichnicht)\
**Post date:** [March 16, 2020, 4:54pm UTC](https://community.sonarsource.com/t/add-security-hotspot-for-java-system-properties/21682/1 "2020-03-16T16:54:48Z")

</div>

Actually there is only a Security Hotspot when using System.getEnv()  
The same rule should be present when using System.getProperty to access a property that could be changed by the user.

---

<div class="post-metadata">

**Author:** ![eric.therond](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/eric.therond/32/10661_2.png) [@eric.therond](https://community.sonarsource.com/u/eric.therond)\
**Post date:** [March 17, 2020, 10:00am UTC](https://community.sonarsource.com/t/add-security-hotspot-for-java-system-properties/21682/2 "2020-03-17T10:00:00Z")

</div>

Hello again @reitzmichnicht and thanks for this suggestion

You are right but [rule S5304](https://rules.sonarsource.com/java/RSPEC-5304) will be deprecated in a near future.

Environment variables could be controlled by users and thus considered as “_sources_” by our [taint analyzer engine](https://www.sonarqube.org/features/security/). It is likely the goal to add _System.getEnv()_, _System.getProperty()_ and similar as “_sources_” however it will impact all injection flaws/rules like XSS, SQLI (available starting SonarQube DE or SonarCloud) thus it’s not a little change and needs discussion/time.

Eric