CVE-2022-24816 (published 2022-04-13T21:15Z)

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/geosolutions-it/jai-ext
commit_details: repo_url: https://github.com/geosolutions-it/jai-ext
author: Andrea Aime
author_date: 2022-04-05 12:45:06+02:00
msg: Validate Jiffle input variable names according to grammar, escape javadocs when including Jiffle sources in output
repository: repo_url: https://github.com/geosolutions-it/jai-ext
repo_name: geosolutions-it/jai-ext
description: Java Advanced Imaging Open Source Replacement Wannabe
repo_language: Java
owner: geosolutions-it
file_changes: filename: Jiffle.java
change_type: ModificationType.MODIFY
diff: @@ -128,7 +128,7 @@ public class Jiffle {
     
     public static final Logger LOGGER = Logger.getLogger(Jiffle.class.getName());
     
-    private static Pattern BLOCK_COMMENT_STRIPPER = Pattern.compile("(?:/\\*(?:[^*]|(?:\\*+[^*/]))*\\*+/)");
+    boolean includeScript;
 
     /** 
      * Constants for runtime model. Jiffle supports two runtime models:
@@ -272,7 +272,20 @@ public class Jiffle {
         setImageParams(params);
         compile();
     }
-    
+
+    /**
+     * Returns true if the script is to be included in the output
+     *
+     * @return
+     */
+    public boolean isIncludeScript() {
+        return includeScript;
+    }
+
+    public void setIncludeScript(boolean includeScript) {
+        this.includeScript = includeScript;
+    }
+
     /**
      * Sets the script. Calling this method will clear any previous script
      * and runtime objects.
@@ -481,7 +494,7 @@ public class Jiffle {
      */
     public JiffleRuntime getRuntimeInstance(Jiffle.RuntimeModel model) throws
             it.geosolutions.jaiext.jiffle.JiffleException {
-        return createRuntimeInstance(model, getRuntimeBaseClass(model), false);
+        return createRuntimeInstance(model, getRuntimeBaseClass(model), includeScript);
     }
 
     /**
@@ -512,7 +525,7 @@ public class Jiffle {
                     " does not implement a required Jiffle runtime interface");
         }
 
-        return (T) createRuntimeInstance(model, baseClass, false);
+        return (T) createRuntimeInstance(model, baseClass, includeScript);
     }
 
     private JiffleRuntime createRuntimeInstance(RuntimeModel model, Class<? extends JiffleRuntime> runtimeClass, boolean scriptInDocs) throws
@@ -558,7 +571,14 @@ public class Jiffle {
             return runtime;
 
         } catch (Exception ex) {
-            throw new it.geosolutions.jaiext.jiffle.JiffleException("Runtime source error for source: " + runtimeSource, ex);
+            // do not display the source code in indirect runtime exception messages
+            if (model == RuntimeModel.INDIRECT) {
+                if (LOGGER.isLoggable(Level.FINE)) {
+                    LOGGER.fine("Runtime source error for source: " + runtimeSource);
+                }
+                throw new JiffleException("Runtime source error", ex);
+            }
+            throw new JiffleException("Runtime source error for source: " + runtimeSource, ex);
         }
     }
 
@@ -613,22 +633,17 @@ public class Jiffle {
         return baseClass;
     }
 
-    private String createRuntimeSource(RuntimeModel model, String baseClassName, boolean scriptInDocs) {
+    private String createRuntimeSource(RuntimeModel model, String baseClassName,
+                                       boolean scriptInDocs) {
+        SourceWriter writer = new SourceWriter(model);
         if (scriptInDocs) {
-            throw new RuntimeException("Do no know how to clean the block comments yet");
+            writer.setScript(theScript);
         }
-
-        SourceWriter writer = new SourceWriter(model);
-        writer.setScript(stripComments(theScript));
         writer.setBaseClassName(baseClassName);
         scriptModel.write(writer);
         return writer.getSource();
     }
 
-    private String stripComments(String theScript) {
-        return BLOCK_COMMENT_STRIPPER.matcher(theScript).replaceAll("");
-    }
-
     /**
      * Initializes this object's name and runtime base class.
      */
@@ -648,6 +663,7 @@ public class Jiffle {
     
     /**
      * Builds the parse tree from the script.
+     *
      * @param script
      */
     private static Jiffle.Result<ParseTree> parseScript(String script) {

programming_language: Java
filename: Script.java
change_type: ModificationType.MODIFY
diff: @@ -52,13 +52,17 @@ import it.geosolutions.jaiext.jiffle.parser.RepeatedReadOptimizer;
 import it.geosolutions.jaiext.jiffle.parser.UndefinedOptionException;
 
 import java.util.Collections;
-import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.regex.Pattern;
 
 /** @author michael */
 public class Script implements Node {
+
+    /** <pre>ID      : (Letter) (Letter | UNDERSCORE | Digit | Dot)*</pre> */
+    private static final Pattern VALID_IDENTIFIER = Pattern.compile("^[a-zA-Z][_a-zA-Z0-9\\.]*$");
+
     private final StatementList stmts;
     private final RepeatedReadOptimizer readOptimizer;
     private Map<String, String> options;
@@ -79,6 +83,20 @@ public class Script implements Node {
         this.globals = globals;
         this.stmts = stmts;
         this.readOptimizer = readOptimizer;
+        validate();
+    }
+
+    private void validate() {
+        for (String name : sourceImages) {
+            if (!VALID_IDENTIFIER.matcher(name).matches()) {
+                throw new JiffleParserException("Invalid source image name: " + name);
+            }
+        }
+        for (String name : destImages) {
+            if (!VALID_IDENTIFIER.matcher(name).matches()) {
+                throw new JiffleParserException("Invalid dest image name: " + name);
+            }
+        }
     }
 
     public void write(SourceWriter w) {
@@ -97,11 +115,13 @@ public class Script implements Node {
             String[] lines = script.split("\n");
             w.line("/**");
             w.line(" * Java runtime class generated from the following Jiffle script: ");
-            w.line(" *<code>");
+            w.line(" *<pre>");
             for (String line : lines) {
-                w.append(" * ").append(line).newLine();
+                // In case the script itself includes comments, they best to be escaped
+                String escaped = line.replace("*/", "*&#47;").replace("/*", "&#47;*");
+                w.append(" * ").append(escaped).newLine();
             }
-            w.line(" *</code>");
+            w.line(" *</pre>");
             w.line(" */");
         }
 

programming_language: Java
filename: JiffleRuntimeTest.java
change_type: ModificationType.ADD
diff: @@ -0,0 +1,61 @@
+/* JAI-Ext - OpenSource Java Advanced Image Extensions Library
+ *    http://www.geo-solutions.it/
+ *    Copyright 2018 GeoSolutions
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.geosolutions.jaiext.jiffle.runtime;
+
+import it.geosolutions.jaiext.jiffle.Jiffle;
+import it.geosolutions.jaiext.jiffle.JiffleException;
+import org.junit.Test;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class JiffleRuntimeTest {
+
+    @Test
+    public void testSkipSource() throws Exception {
+        Jiffle jiffle = getJiffleWithComment();
+        String source = jiffle.getRuntimeSource(false);
+
+        // by default, it does not contain the source
+        assertFalse(source.contains("This is a comment"));
+    }
+
+    @Test
+    public void testEscapeSource() throws Exception {
+        Jiffle jiffle = getJiffleWithComment();
+        String source = jiffle.getRuntimeSource(true);
+
+        // source is in the javadocs, and properly escaped
+        assertTrue(source.contains("* &#47;* This is a comment *&#47;"));
+        assertTrue(source.contains("* dest=10;"));
+    }
+
+    private Jiffle getJiffleWithComment() throws JiffleException {
+        String script = "/* This is a comment */\ndest=10;";
+        Jiffle jiffle = new Jiffle();
+        jiffle.setScript(script);
+        Map<String, Jiffle.ImageRole> params = new HashMap<>();
+        params.put("dest", Jiffle.ImageRole.DEST);
+        jiffle.setImageParams(params);
+
+        jiffle.compile();
+        return jiffle;
+    }
+}

programming_language: Java
filename: ScriptTest.java
change_type: ModificationType.ADD
diff: @@ -0,0 +1,73 @@
+/* JAI-Ext - OpenSource Java Advanced Image Extensions Library
+ *    http://www.geo-solutions.it/
+ *    Copyright 2018 GeoSolutions
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.geosolutions.jaiext.jiffle.runtime;
+
+import it.geosolutions.jaiext.jiffle.Jiffle;
+import it.geosolutions.jaiext.jiffle.JiffleException;
+import it.geosolutions.jaiext.jiffle.parser.JiffleParserException;
+import org.junit.Assert;
+import org.junit.Test;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.junit.Assert.assertEquals;
+
+public class ScriptTest {
+
+    @Test
+    public void testValidateSourceImages() throws Exception {
+        checkInvalidSourceName("a b");
+        checkInvalidSourceName("99a");
+        checkInvalidSourceName("#abc");
+        checkInvalidSourceName("/abc");
+        checkInvalidSourceName("{abc");
+    }
+
+    @Test
+    public void testValidateDestinationImages() throws Exception {
+        checkInvalidDestinationName("a b");
+        checkInvalidDestinationName("99a");
+        checkInvalidDestinationName("#abc");
+        checkInvalidDestinationName("/abc");
+        checkInvalidDestinationName("{abc");
+    }
+
+    private void checkInvalidSourceName(String name) throws JiffleException {
+        Jiffle jiffle = new Jiffle();
+        jiffle.setScript("dst=0;");
+        Map<String, Jiffle.ImageRole> params = new HashMap<>();
+        params.put(name, Jiffle.ImageRole.SOURCE);
+        jiffle.setImageParams(params);
+
+        JiffleParserException exception =
+                Assert.assertThrows(JiffleParserException.class, () -> jiffle.compile());
+        assertEquals("Invalid source image name: " + name, exception.getMessage());
+    }
+
+    private void checkInvalidDestinationName(String name) throws JiffleException {
+        Jiffle jiffle = new Jiffle();
+        jiffle.setScript("dst=0;");
+        Map<String, Jiffle.ImageRole> params = new HashMap<>();
+        params.put(name, Jiffle.ImageRole.DEST);
+        jiffle.setImageParams(params);
+
+        JiffleParserException exception =
+                Assert.assertThrows(JiffleParserException.class, () -> jiffle.compile());
+        assertEquals("Invalid dest image name: " + name, exception.getMessage());
+    }
+}

programming_language: Java