CVE-2022-24881 (Java, published 2022-04-26T16:15Z)
Description: value: Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ballcat-projects/ballcat-codegen
Files changed:
ballcat-codegen-backend/src/main/java/com/hccake/ballcat/codegen/engine/FreemarkerTemplateEngine.java
ballcat-codegen-backend/src/main/java/com/hccake/ballcat/codegen/engine/TemplateEngine.java
ballcat-codegen-backend/src/main/java/com/hccake/ballcat/codegen/engine/TemplateEngineDelegator.java
ballcat-codegen-backend/src/main/java/com/hccake/ballcat/codegen/engine/VelocityTemplateEngine.java
ballcat-codegen-backend/src/main/java/com/hccake/ballcat/codegen/exception/TemplateRenderException.java
ballcat-codegen-backend/src/main/java/com/hccake/ballcat/codegen/service/impl/GeneratorServiceImpl.java
Commit message: :lock: 修改模板引擎的默认安全策略，以防止RCE


Vulnerable code:
	String render(String templateContent, Map<String, Object> context);
 * 
	public String render(TemplateEngineTypeEnum engineType, String templateContent, Map<String, Object> context) {
	public String render(String templateContent, Map<String, Object> context) {
public class TemplateRenderException extends RuntimeException {
			String filename = StrUtil.format(templateFile.getFilename(), context);
				fileEntry.setFilePath(GenUtils.concatFilePath(parentFilePath, filename));
				String content = templateEngineDelegator.render(engineTypeEnum, templateFile.getContent(), context);
				fileEntry.setContent(content);
				String currentPath = GenUtils.evaluateRealPath(templateFile.getFilename(), context);

Fixed code:
import freemarker.core.TemplateClassResolver;

		// 安全处理 https://ackcent.com/blog/in-depth-freemarker-template-injection/
		configuration.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
import com.hccake.ballcat.codegen.exception.TemplateRenderException;

	String render(String templateContent, Map<String, Object> context) throws TemplateRenderException;
import com.hccake.ballcat.codegen.exception.TemplateRenderException;
 *
	public String render(TemplateEngineTypeEnum engineType, String templateContent, Map<String, Object> context)
			throws TemplateRenderException {
import org.apache.velocity.util.introspection.SecureUberspector;
		// 安全处理
		prop.put("runtime.introspector.uberspect", SecureUberspector.class.getName());
	public String render(String templateContent, Map<String, Object> context) throws TemplateRenderException {
public class TemplateRenderException extends Exception {
import com.hccake.ballcat.codegen.exception.TemplateRenderException;
import com.hccake.ballcat.common.core.exception.BusinessException;
import com.hccake.ballcat.common.model.result.SystemResultCode;
			String templateFilename = templateFile.getFilename();
			String filename = StrUtil.format(templateFilename, context);
				String filePath = GenUtils.concatFilePath(parentFilePath, filename);
				fileEntry.setFilePath(filePath);

				try {
					String content = templateEngineDelegator.render(engineTypeEnum, templateFile.getContent(), context);
					fileEntry.setContent(content);
				}
				catch (TemplateRenderException ex) {
					String errorMessage = StrUtil.format("模板渲染异常，模板文件名：【{}】，错误详情：{}", templateFilename,
							ex.getMessage());
					throw new BusinessException(SystemResultCode.SERVER_ERROR.getCode(), errorMessage);
				}
				String currentPath = GenUtils.evaluateRealPath(templateFilename, context);