CVE-2022-24816 (Java, published 2022-04-13T21:15Z)
Description: value: JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/geosolutions-it/jai-ext
Files changed:
jt-jiffle/jt-jiffle-language/src/main/java/it/geosolutions/jaiext/jiffle/Jiffle.java
jt-jiffle/jt-jiffle-language/src/main/java/it/geosolutions/jaiext/jiffle/parser/node/Script.java
jt-jiffle/jt-jiffle-language/src/test/java/it/geosolutions/jaiext/jiffle/runtime/JiffleRuntimeTest.java
jt-jiffle/jt-jiffle-language/src/test/java/it/geosolutions/jaiext/jiffle/runtime/ScriptTest.java
Commit message: Validate Jiffle input variable names according to grammar, escape javadocs when including Jiffle sources in output


Vulnerable code:
    private static Pattern BLOCK_COMMENT_STRIPPER = Pattern.compile("(?:/\\*(?:[^*]|(?:\\*+[^*/]))*\\*+/)");
    
        return createRuntimeInstance(model, getRuntimeBaseClass(model), false);
        return (T) createRuntimeInstance(model, baseClass, false);
            throw new it.geosolutions.jaiext.jiffle.JiffleException("Runtime source error for source: " + runtimeSource, ex);
    private String createRuntimeSource(RuntimeModel model, String baseClassName, boolean scriptInDocs) {
            throw new RuntimeException("Do no know how to clean the block comments yet");

        SourceWriter writer = new SourceWriter(model);
        writer.setScript(stripComments(theScript));
    private String stripComments(String theScript) {
        return BLOCK_COMMENT_STRIPPER.matcher(theScript).replaceAll("");
    }

import java.util.List;
            w.line(" *<code>");
                w.append(" * ").append(line).newLine();
            w.line(" *</code>");

Fixed code:
    boolean includeScript;

    /**
     * Returns true if the script is to be included in the output
     *
     * @return
     */
    public boolean isIncludeScript() {
        return includeScript;
    }

    public void setIncludeScript(boolean includeScript) {
        this.includeScript = includeScript;
    }

        return createRuntimeInstance(model, getRuntimeBaseClass(model), includeScript);
        return (T) createRuntimeInstance(model, baseClass, includeScript);
            // do not display the source code in indirect runtime exception messages
            if (model == RuntimeModel.INDIRECT) {
                if (LOGGER.isLoggable(Level.FINE)) {
                    LOGGER.fine("Runtime source error for source: " + runtimeSource);
                }
                throw new JiffleException("Runtime source error", ex);
            }
            throw new JiffleException("Runtime source error for source: " + runtimeSource, ex);
    private String createRuntimeSource(RuntimeModel model, String baseClassName,
                                       boolean scriptInDocs) {
        SourceWriter writer = new SourceWriter(model);
            writer.setScript(theScript);
     *
import java.util.regex.Pattern;

    /** <pre>ID      : (Letter) (Letter | UNDERSCORE | Digit | Dot)*</pre> */
    private static final Pattern VALID_IDENTIFIER = Pattern.compile("^[a-zA-Z][_a-zA-Z0-9\\.]*$");

        validate();
    }

    private void validate() {
        for (String name : sourceImages) {
            if (!VALID_IDENTIFIER.matcher(name).matches()) {
                throw new JiffleParserException("Invalid source image name: " + name);
            }
        }
        for (String name : destImages) {
            if (!VALID_IDENTIFIER.matcher(name).matches()) {
                throw new JiffleParserException("Invalid dest image name: " + name);
            }
        }
            w.line(" *<pre>");
                // In case the script itself includes comments, they best to be escaped
                String escaped = line.replace("*/", "*&#47;").replace("/*", "&#47;*");
                w.append(" * ").append(escaped).newLine();
            w.line(" *</pre>");
/* JAI-Ext - OpenSource Java Advanced Image Extensions Library
 *    http://www.geo-solutions.it/
 *    Copyright 2018 GeoSolutions
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package it.geosolutions.jaiext.jiffle.runtime;

import it.geosolutions.jaiext.jiffle.Jiffle;
import it.geosolutions.jaiext.jiffle.JiffleException;
import org.junit.Test;

import java.util.HashMap;
import java.util.Map;

import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;

public class JiffleRuntimeTest {

    @Test
    public void testSkipSource() throws Exception {
        Jiffle jiffle = getJiffleWithComment();
        String source = jiffle.getRuntimeSource(false);

        // by default, it does not contain the source
        assertFalse(source.contains("This is a comment"));
    }

    @Test
    public void testEscapeSource() throws Exception {
        Jiffle jiffle = getJiffleWithComment();
        String source = jiffle.getRuntimeSource(true);

        // source is in the javadocs, and properly escaped
        assertTrue(source.contains("* &#47;* This is a comment *&#47;"));
        assertTrue(source.contains("* dest=10;"));
    }

    private Jiffle getJiffleWithComment() throws JiffleException {
        String script = "/* This is a comment */\ndest=10;";
        Jiffle jiffle = new Jiffle();
        jiffle.setScript(script);
        Map<String, Jiffle.ImageRole> params = new HashMap<>();
        params.put("dest", Jiffle.ImageRole.DEST);
        jiffle.setImageParams(params);

        jiffle.compile();
        return jiffle;
    }
}
/* JAI-Ext - OpenSource Java Advanced Image Extensions Library
 *    http://www.geo-solutions.it/
 *    Copyright 2018 GeoSolutions
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package it.geosolutions.jaiext.jiffle.runtime;

import it.geosolutions.jaiext.jiffle.Jiffle;
import it.geosolutions.jaiext.jiffle.JiffleException;
import it.geosolutions.jaiext.jiffle.parser.JiffleParserException;
import org.junit.Assert;
import org.junit.Test;

import java.util.HashMap;
import java.util.Map;

import static org.junit.Assert.assertEquals;

public class ScriptTest {

    @Test
    public void testValidateSourceImages() throws Exception {
        checkInvalidSourceName("a b");
        checkInvalidSourceName("99a");
        checkInvalidSourceName("#abc");
        checkInvalidSourceName("/abc");
        checkInvalidSourceName("{abc");
    }

    @Test
    public void testValidateDestinationImages() throws Exception {
        checkInvalidDestinationName("a b");
        checkInvalidDestinationName("99a");
        checkInvalidDestinationName("#abc");
        checkInvalidDestinationName("/abc");
        checkInvalidDestinationName("{abc");
    }

    private void checkInvalidSourceName(String name) throws JiffleException {
        Jiffle jiffle = new Jiffle();
        jiffle.setScript("dst=0;");
        Map<String, Jiffle.ImageRole> params = new HashMap<>();
        params.put(name, Jiffle.ImageRole.SOURCE);
        jiffle.setImageParams(params);

        JiffleParserException exception =
                Assert.assertThrows(JiffleParserException.class, () -> jiffle.compile());
        assertEquals("Invalid source image name: " + name, exception.getMessage());
    }

    private void checkInvalidDestinationName(String name) throws JiffleException {
        Jiffle jiffle = new Jiffle();
        jiffle.setScript("dst=0;");
        Map<String, Jiffle.ImageRole> params = new HashMap<>();
        params.put(name, Jiffle.ImageRole.DEST);
        jiffle.setImageParams(params);

        JiffleParserException exception =
                Assert.assertThrows(JiffleParserException.class, () -> jiffle.compile());
        assertEquals("Invalid dest image name: " + name, exception.getMessage());
    }
}