MvelScriptExecutor implements ScriptExecutor { @Override public Object execute(String script, Map<String, Object> context) { final ClassLoader tccl = Thread.currentThread().getContextClassLoader(); try { if (!mvelExpressions.containsKey(script)) { if (expressionFilterFactory.getExpressionFilter("mvel").filter(script) == null) { mvelExpressions.put(script, INVALID_SCRIPT_MARKER); } else { Thread.currentThread().setContextClassLoader(secureFilteringClassLoader); ParserConfiguration parserConfiguration = new ParserConfiguration(); parserConfiguration.setClassLoader(secureFilteringClassLoader); ParserContext parserContext = new ParserContext(parserConfiguration); parserContext.addImport("Runtime", String.class); parserContext.addImport("System", String.class); parserContext.addImport("ProcessBuilder", String.class); parserContext.addImport("Class", String.class); parserContext.addImport("ClassLoader", String.class); parserContext.addImport("Thread", String.class); parserContext.addImport("Compiler", String.class); parserContext.addImport("ThreadLocal", String.class); parserContext.addImport("SecurityManager", String.class); mvelExpressions.put(script, MVEL.compileExpression(script, parserContext)); } } if (mvelExpressions.containsKey(script) && mvelExpressions.get(script) != INVALID_SCRIPT_MARKER) { return MVEL.executeExpression(mvelExpressions.get(script), context); } else { return script; } } finally { Thread.currentThread().setContextClassLoader(tccl); } }  void setExpressionFilterFactory(ExpressionFilterFactory expressionFilterFactory); @Override Object execute(String script, Map<String, Object> context);  }
@Test public void testMVELSecurity() throws IOException { Map<String, Object> ctx = new HashMap<>(); Event mockEvent = generateMockEvent(); ctx.put("event", mockEvent); ctx.put("session", mockEvent.getSession()); ctx.put("profile", mockEvent.getProfile()); File vulnFile = new File("target/vuln-file.txt"); if (vulnFile.exists()) { vulnFile.delete(); } Object result = null; try { result = scriptExecutor.execute("java.io.PrintWriter writer = new java.io.PrintWriter(new java.io.BufferedWriter(new java.io.FileWriter(\"" + vulnFile.getCanonicalPath() + "\", true)));\nwriter.println(\"test\");\nwriter.close();", ctx); } catch (Throwable t) { System.out.println("Expected error : " + t.getMessage()); } System.out.println("result=" + result); try { result = scriptExecutor.execute("import java.util.*;\nimport java.io.*;\nPrintWriter writer = new PrintWriter(new BufferedWriter(new FileWriter(\"" + vulnFile.getCanonicalPath() + "\", true)));\nwriter.println(\"test\");\nwriter.close();", ctx); } catch (Throwable t) { System.out.println("Expected error : " + t.getMessage()); } System.out.println("result=" + result); try { result = scriptExecutor.execute("import java.util.*;\nimport java.io.*;\nnew Scanner(new File(\"" + vulnFile.getCanonicalPath() + "\")).useDelimiter(\"\\\\Z\").next();", ctx); } catch (Throwable t) { System.out.println("Expected error : " + t.getMessage()); } System.out.println("result=" + result); try { result = scriptExecutor.execute("Runtime r = Runtime.getRuntime(); r.exec(\"touch "+vulnFile.getCanonicalPath()+"\");", ctx); } catch (Throwable t) { System.out.println("Expected error : " + t.getMessage()); } System.out.println("result=" + result); try { result = scriptExecutor.execute("Runtime r = Runtime.getClass().forName(\"java.lang.Runtime\").getDeclaredMethod(\"getRuntime\", null ).invoke(null, null); r.exec(\"touch "+vulnFile.getCanonicalPath()+"\");", ctx); } catch (Throwable t) { System.out.println("Expected error : " + t.getMessage()); } System.out.println("result=" + result); try { ctx.put("goalId", "d; " + "Runtime r = Runtime.getClass().forName(\"java.lang.Runtime\").getDeclaredMethod(\"getRuntime\", null ).invoke(null, null); r.exec(\"touch " + vulnFile.getCanonicalPath() + "\")" + " ; "); result = scriptExecutor.execute("'systemProperties\\.goals\\.'+goalId+'TargetReached'", ctx); } catch (Throwable t) { System.out.println("Expected error : " + t.getMessage()); } System.out.println("result=" + result); assertFalse("Vulnerability successfully executed ! File created at " + vulnFile.getCanonicalPath(), vulnFile.exists()); }