Code injection can occur when untrusted input is injected into dynamically constructed code. The One obvious source of potential vulnerabilities is the use of JavaScript from Java code. The javax.script package both provides an API of interfaces and classes that define Java Scripting Engines and also defines a framework for the use of those interfaces and classes in Java code. An obvious example is the use of JavaScript from Java code. Misuse of Misuse of the javax.script API permits an attacker to execute arbitrary code on the target system. Such errors are dangerous because violations of secure coding practices in dynamically generated code cannot be detected in advance through automated static analysis.
This guideline is a specific instance of IDS00-J. Sanitize untrusted data passed across a trust boundary.
...
The best defense against code injection vulnerabilities is to avoid including prevent inclusion of executable user input in code. When dynamic code requires user input, that input must be sanitized. For example, a top-level method could ensure that the string firstName contains only valid, whitelisted characters. Refer to IDS00-J. Sanitize untrusted data passed across a trust boundary for more details. If special characters are allowed must be permitted in the name, they must be escaped and normalized before comparing comparison with their equivalent forms for the purpose of input validation. This compliant solution uses whitelisting to prevent unsanitized input from being interpreted by the scripting engine.
...
An alternative approach is to create a secure sandbox using a security manager. (See SEC60-JG. Create a secure sandbox using a Security Manager.) The application should not allow prevent the script to execute from executing arbitrary commands including, for example, querying the local file system. The two-argument form of doPrivileged() can be used to lower privileges when the application must operate with higher privileges but the scripting engine must not. The RestrictedAccessControlContext strips the permissions granted in the default policy file by reducing the permissions granted to those of the newly created protection domain. The effective permissions are the intersection of the permissions of the newly created protection domain and the systemwide security policy. Refer to SEC50-JG. Avoid granting excess privileges for more details on the two-argument form.
...