Rule Definition
For portability reasons, in Web applications, 'java.lang.System.getenv()' should not be used since it means using Operating System variables and therefore being dependent on the environment where the application is deployed.

Remediation
Prefer using property files.

Violation Code Sample

package com.logicbig.example.system;  import java.util.Map;  public class GetenvExample {      public static void main(String... args) {         Map<String, String> map = System.getenv();         map.entrySet().forEach(System.out::println);     } }  -----------------------------------------------------------  public class SystemSample {     public static void main(String[] args) throws Exception {        // gets the value of the specified environment variable "PATH"       System.out.println("System.getenv("PATH") = ");       System.out.println(System.getenv("PATH"));        // gets the value of the specified environment variable "TEMP"       System.out.print("System.getenv("TEMP") = ");       System.out.println(System.getenv("TEMP"));        // gets the value of the specified environment variable "USERNAME"       System.out.print("System.getenv("USERNAME") = ");       System.out.println(System.getenv("USERNAME"));    } }

https://www.tutorialspoint.com/java/lang/system_getenv_string.htm https://wiki.sei.cmu.edu/confluence/display/java/ENV02-J.+Do+not+trust+the+values+of+environment+variables