rspec/rules/S5334/java/how-to-fix-it/commons-compiler.adoc

=== How to fix it in Commons Compiler

The following code is vulnerable to arbitrary code execution because it compiles
and runs HTTP data.

==== Noncompliant code example

[source,java,diff-id=1,diff-type=noncompliant]
----
import org.codehaus.janino.ScriptEvaluator;

@Controller
public class ExampleController
{
    @GetMapping(value = "/")
    public void exec(@RequestParam("message") String message) throws IOException, InvocationTargetException {
        ScriptEvaluator se = new ScriptEvaluator();
        se.cook("System.out.println(\" + message \");");
        se.evaluate(null);
    }
}
----

==== Compliant solution

[source,java,diff-id=1,diff-type=compliant]
----
import org.codehaus.janino.ScriptEvaluator;

@Controller
public class ExampleController
{
    @GetMapping(value = "/")
    public void exec(@RequestParam("message") String message) throws IOException, InvocationTargetException {
        ScriptEvaluator se = new ScriptEvaluator();
        se.setParameters(new String[] { "input" }, new Class[] { String.class });
        se.cook("System.out.println(input);");
        se.evaluate(new Object[] { message });
    }
}
----

=== How does this work?

include::../../common/fix/introduction.adoc[]