Commit 441e1fa
committed
fix(security): unsandboxed jsr223 script execution enables arbitr
JSR223ScriptExecutor.load() compiles arbitrary script strings via Compilable.compile() and execute() runs them via eval() with no ClassFilter, sandbox, or restricted ScriptContext. The bindings expose `_meta`, `args`, and `extParam`, but Nashorn/JS engines by default give scripts full access to Java reflection (e.g., Java.type('java.lang.Runtime').getRuntime().exec(...)). Comments in Operation.java explicitly warn 'JDK 8~13 可用自带 Nashorn 这个 js 引擎，注意配置 ClassFilter 防脚本注入攻击', but no ClassFilter is configured here. If script content is sourced from a database row, request payload, or any user-influenced channel (which the IF/CODE Operation suggests), this becomes RCE.
Affected files: JSR223ScriptExecutor.java
Signed-off-by: Nguyen Van Nam <nam.nv205106@gmail.com>1 parent e321a94 commit 441e1fa
1 file changed
Lines changed: 25 additions & 2 deletions
Lines changed: 25 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -27,11 +27,34 @@ public abstract class JSR223ScriptExecutor<T, M extends Map<String, Object>, L e | |||
| 27 | 27 | ||
| 28 | 28 | @Override | |
| 29 | 29 | public ScriptExecutor<T, M, L> init() { | |
| 30 | - ScriptEngineManager scriptEngineManager = new ScriptEngineManager(); | ||
| 31 | - scriptEngine = scriptEngineManager.getEngineByName(scriptEngineName()); | ||
| 30 | + scriptEngine = createScriptEngine(); | ||
| 32 | 31 | return this; | |
| 33 | 32 | } | |
| 34 | 33 | ||
| 34 | + protected ScriptEngine createScriptEngine() { | ||
| 35 | + String name = scriptEngineName(); | ||
| 36 | + if ("nashorn".equalsIgnoreCase(name) || "javascript".equalsIgnoreCase(name) | ||
| 37 | + || "js".equalsIgnoreCase(name) || "ecmascript".equalsIgnoreCase(name)) { | ||
| 38 | + try { | ||
| 39 | + Class<?> factoryClass = Class.forName("jdk.nashorn.api.scripting.NashornScriptEngineFactory"); | ||
| 40 | + Class<?> filterClass = Class.forName("jdk.nashorn.api.scripting.ClassFilter"); | ||
| 41 | + Object filter = java.lang.reflect.Proxy.newProxyInstance( | ||
| 42 | + filterClass.getClassLoader(), | ||
| 43 | + new Class<?>[]{filterClass}, | ||
| 44 | + (proxy, method, methodArgs) -> isClassExposureAllowed((String) methodArgs[0])); | ||
| 45 | + Object factory = factoryClass.getDeclaredConstructor().newInstance(); | ||
| 46 | + return (ScriptEngine) factoryClass.getMethod("getScriptEngine", filterClass).invoke(factory, filter); | ||
| 47 | + } catch (Throwable e) { | ||
| 48 | + Log.e(TAG, "create sandboxed Nashorn engine failed, falling back: " + e); | ||
| 49 | + } | ||
| 50 | + } | ||
| 51 | + return new ScriptEngineManager().getEngineByName(name); | ||
| 52 | + } | ||
| 53 | + | ||
| 54 | + protected boolean isClassExposureAllowed(String className) { | ||
| 55 | + return false; | ||
| 56 | + } | ||
| 57 | + | ||
| 35 | 58 | protected abstract String scriptEngineName(); | |
| 36 | 59 | ||
| 37 | 60 | protected abstract Object extendParameter(AbstractFunctionParser<T, M, L> parser, Map<String, Object> currentObject, String methodName, Object[] args); | |
0 commit comments