Skip to main content

Inappropriate coding practices - Eval function

Need​

Secure input validation and sanitization

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for building Java web applications with Servlets
  • Usage of javax.script-api for executing scripts in Java applications

Description​

Non compliant code​

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import javax.script.ScriptEngine;
import javax.script.ScriptEngineManager;
import javax.script.ScriptException;

public class EvalServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String script = request.getParameter("script");
        ScriptEngineManager manager = new ScriptEngineManager();
        ScriptEngine engine = manager.getEngineByName("JavaScript");
        try {
            engine.eval(script);
        } catch (ScriptException e) {
            e.printStackTrace();
        }
    }
}

This code represents a Servlet that receives HTTP GET requests. The Servlet extracts a parameter named "script" from the request and passes it to the JavaScript engine for execution.

The vulnerability lies in the use of the eval function which is used to execute JavaScript code. The eval function takes a string as input and executes it as JavaScript code. In this case, the input is taken directly from the HTTP request without any validation or sanitization. This means that an attacker can send a request with malicious JavaScript code in the "script" parameter which will then be executed on the server.

This can lead to a variety of attacks, depending on the capabilities of the JavaScript engine and the permissions of the user running the server. For example, an attacker could execute commands to read or write files, make network requests, or perform other actions that the server user has permission to do.

The use of eval in this way is considered highly risky and is generally discouraged. The best way to mitigate this issue is to avoid using eval altogether. If dynamic script execution is necessary, it should be done in a safe and controlled manner, with proper input validation and sanitization.

Steps​

  • Avoid using the eval function with user input as it can execute arbitrary code.
  • Validate and sanitize user input before using it in any script evaluation.
  • Use a whitelist approach to only allow specific safe operations or functions.
  • Implement input validation and filtering techniques to prevent injection attacks.
  • Consider using a safer alternative to eval, such as a parser or interpreter that provides more control over the execution environment.
  • Regularly update and patch the scripting engine or library used to mitigate any known vulnerabilities.

Compliant code​

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.regex.Pattern;

public class EvalServlet extends HttpServlet {
    private static final Pattern SAFE_PATTERN = Pattern.compile("[a-zA-Z0-9]*");

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String script = request.getParameter("script");

        if (isSafe(script)) {
            // Process the script if it's safe
            // Consider using a safer alternative to eval here
        } else {
            throw new ServletException("Unsafe script detected");
        }
    }

    private boolean isSafe(String script) {
        return SAFE_PATTERN.matcher(script).matches();
    }
}

The original code was vulnerable because it used the eval function with user input, which can execute arbitrary code. This is a common security vulnerability known as code injection.

The revised code avoids using the eval function with user input. Instead, it checks if the input script is safe by using a whitelist approach. The isSafe method checks if the script matches a regular expression that only allows alphanumeric characters. This is a simple example and in a real-world application, the safe pattern should be carefully designed to only allow specific safe operations or functions.

If the script is safe, it is processed further (the actual processing is not shown in this example). If the script is not safe, a ServletException is thrown.

This approach helps to prevent injection attacks by validating and sanitizing user input before using it in any script evaluation. It also provides more control over the execution environment than the eval function.

Remember to regularly update and patch the scripting engine or library used to mitigate any known vulnerabilities.

References​

Last updated on