Tooling Intermediate

Runtime.exec(String) to ProcessBuilder arguments

Launch processes with an explicit argument list and ProcessBuilder configuration.

Tooling Security

Code Comparison

✕ Command string

Process process = Runtime.getRuntime()
        .exec("git show " + revision);

✓ ProcessBuilder

Process process = new ProcessBuilder(
        "git", "show", revision)
        .redirectErrorStream(true)
        .start();

See a problem with this code? Let us know.

Why the modern way wins

🎯

Exact arguments

Each process argument remains a distinct value without command-string tokenization.

🎛

Explicit configuration

Environment, directory, redirects, and error handling are configured together.

🛡

Safer boundaries

Avoids constructing a shell-like command string from dynamic values.

Old Approach

Runtime.exec(String)

Modern Approach

ProcessBuilder

Since JDK

Difficulty

Intermediate

JDK Support

Runtime.exec(String) to ProcessBuilder arguments

Available

Widely available since JDK 5 (September 2004)

How it works

Runtime.exec(String) applies Java's command-string tokenization, which is easy to misunderstand when arguments contain spaces or quoting. ProcessBuilder accepts program arguments as distinct values and exposes the working directory, environment, input/output redirects, and error-stream policy explicitly. It does not invoke a shell unless the application deliberately launches one.

Runtime.exec(String) to ProcessBuilder arguments

Exact arguments

Explicit configuration

Safer boundaries

Modern Process API

InputStream.transferTo()

SecurityManager checks to explicit authorization