OS Command Injection Vulnerability in Java Spring

report.java

@RestController 
public class ReportController {

  @PostMapping("/report")
  public ResponseEntity<String> generateReport(@RequestParam String report_name) {
    String cmd = "bash -c \"generate_report.sh " + report_name + "\"";
    try {
      Process proc = Runtime.getRuntime().exec(cmd);
      int exitValue = proc.waitFor();
      if (exitValue == 0) {
        return new ResponseEntity<>("Report generated successfully", HttpStatus.OK);
      } else {
        return new ResponseEntity<>("Error generating report", HttpStatus.INTERNAL_SERVER_ERROR);
      }
    } catch (Exception e) {
      // Log exception
      return new ResponseEntity<>("Error generating report", HttpStatus.INTERNAL_SERVER_ERROR);
    }
  }
}