Page History

Code injection is caused as a result of untrusted input being injected into dynamically constructed code. The javax.script package provides utilities to use various scripting engines from Java code. If misused, Misuse of these utilities permits an attacker can to execute arbitrary code on the target system. These kinds of Such errors are dangerous because any violations of secure coding practices in dynamically generated code cannot be statically determineddetected in advance through static analysis.

Noncompliant Code Example

This noncompliant code example incorporates untrusted user input in a javascript statement , that is responsible for printing the input. An attacker may can enter specially crafted arguments in an attempt to inject malicious javascript. The firstName string contains javascript code that can create or overwrite an existing file on the system running the vulnerable Java code.

...

The best defense against code injection vulnerabilities is to avoid including executable user input in code. If some When dynamic code requires certain user input, the that input should must be sanitized. For example, a top-level method should could ensure that the string firstName contains only valid, white-listed characters. Refer to the guideline IDS01-J. Sanitize before processing or storing user input for more details. If special characters are allowed in the name, they must be escaped before comparing with their equivalent forms.

In addition, a complementary policy is to create a secure sandbox using a security manager. (See guideline ENV02-J. Create a secure sandbox using a Security Manager.) This approach is akin to the one discussed in the first compliant solution of guideline IDS10-J. Prevent XML external entity attacks. The application should not allow the script to execute arbitrary commands such asincluding, for example, querying the local file system. The two-argument form of doPrivileged() can be used to lower privileges when the application must operate with higher privileges but the scripting engine must not. The RestrictedAccessControlContext strips the permissions granted in the default policy file by not granting reducing the same permissions granted to the newly created protection domain. The effective permissions are the intersection of the permissions of the newly created protection domain and the system wide security policy. Refer to the guideline SEC00-J. Avoid granting excess privileges for more details on the two-argument form.

// First sanitize firstName (modify if the name may include special characters)

if(!firstName.matches("[\\w]*")) { // String does not match white-listed characters
  throw new IllegalArgumentException();
} 

// Restrict permission using the two-argument form of doPrivileged()
try {
  AccessController.doPrivileged(new PrivilegedExceptionAction() {
    public Object run() throws ScriptException {
      engine.eval("print('"+ firstName + "')");		
      return null;
    }    	
  }, RestrictedAccessControlContext.INSTANCE);
} catch(PrivilegedActionException pae) {    	
  // Handle
}       

Risk Assessment

Failing Failure to prevent code injection can result in the execution of arbitrary code.

Automated Detection

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

...