fix: remove unsafe exec() in page controller App.java (#3471)

* fix: V-002 security vulnerability

Automated security fix generated by Orbis Security AI

* adding cross-platform support

* fixing sonarqube hotspots

* fixing the formating for java windows

* fix: address PR review comments - Windows title bug, Unix paths, and consistency

- Add empty string title arg to cmd /c start to fix paths-with-spaces bug
- Revert Unix commands to bare names (open, xdg-open) with NOSONAR since
  xdg-open location varies by distro; absolute paths broke portability
- Apply same ProcessBuilder fix to page-object/src App.java for consistency

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: resolve Windows path via SystemRoot env var instead of hardcoding

C:\Windows\System32\cmd.exe fails when Windows is installed on a
non-C drive. Use System.getenv("SystemRoot") with a C:\Windows
fallback to locate cmd.exe portably in both App.java files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

page-object/sample-application/src/main/java/com/iluwatar/pageobject/App.java

@@ -27,6 +27,7 @@ package com.iluwatar.pageobject;
 import java.awt.Desktop;
 import java.io.File;
 import java.io.IOException;
+import java.util.Locale;
 import lombok.extern.slf4j.Slf4j;
 
 /**
@@ -77,8 +78,28 @@ public final class App {
         Desktop.getDesktop().open(applicationFile);
 
       } else {
-        // java Desktop not supported - above unlikely to work for Windows so try instead...
+        // java Desktop not supported - use ProcessBuilder for cross-platform support
-        Runtime.getRuntime().exec("cmd.exe start " + applicationFile);
+        var os = System.getProperty("os.name").toLowerCase(Locale.ROOT);
+        ProcessBuilder pb;
+        if (os.contains("win")) {
+          // Empty string title arg prevents cmd start treating a quoted path as the window title
+          var systemRoot = System.getenv("SystemRoot");
+          if (systemRoot == null) {
+            systemRoot = "C:\\Windows";
+          }
+          pb =
+              new ProcessBuilder(
+                  systemRoot + "\\System32\\cmd.exe",
+                  "/c",
+                  "start",
+                  "",
+                  applicationFile.getAbsolutePath());
+        } else if (os.contains("mac")) {
+          pb = new ProcessBuilder("open", applicationFile.getAbsolutePath()); // NOSONAR
+        } else {
+          pb = new ProcessBuilder("xdg-open", applicationFile.getAbsolutePath()); // NOSONAR
+        }
+        pb.start();
       }
 
     } catch (IOException ex) {

page-object/src/main/java/com/iluwatar/pageobject/App.java

@@ -27,6 +27,7 @@ package com.iluwatar.pageobject;
 import java.awt.Desktop;
 import java.io.File;
 import java.io.IOException;
+import java.util.Locale;
 
 /**
  * Page Object pattern wraps an UI component with an application specific API allowing you to
@@ -75,9 +76,28 @@ public final class App {
         Desktop.getDesktop().open(applicationFile);
 
       } else {
-        // Java Desktop not supported - above unlikely to work for Windows so try the
+        // java Desktop not supported - use ProcessBuilder for cross-platform support
-        // following instead...
+        var os = System.getProperty("os.name").toLowerCase(Locale.ROOT);
-        new ProcessBuilder("cmd.exe", "/c", "start", "", applicationFile.getAbsolutePath()).start();
+        ProcessBuilder pb;
+        if (os.contains("win")) {
+          // Empty string title arg prevents cmd start treating a quoted path as the window title
+          var systemRoot = System.getenv("SystemRoot");
+          if (systemRoot == null) {
+            systemRoot = "C:\\Windows";
+          }
+          pb =
+              new ProcessBuilder(
+                  systemRoot + "\\System32\\cmd.exe",
+                  "/c",
+                  "start",
+                  "",
+                  applicationFile.getAbsolutePath());
+        } else if (os.contains("mac")) {
+          pb = new ProcessBuilder("open", applicationFile.getAbsolutePath()); // NOSONAR
+        } else {
+          pb = new ProcessBuilder("xdg-open", applicationFile.getAbsolutePath()); // NOSONAR
+        }
+        pb.start();
       }
 
     } catch (IOException ex) {