Skip to content

Commit 34458a3

Browse files
AT190510-CuongAT190510-Cuong
committed
Fix SSTI vulnerability in FreemarkerTemplateEngine and add security test case
1 parent 4841df5 commit 34458a3

File tree

3 files changed

+274
-4
lines changed

3 files changed

+274
-4
lines changed

‎integrationtests/.project‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,15 @@
1414
<natures>
1515
<nature>org.eclipse.m2e.core.maven2Nature</nature>
1616
</natures>
17+
<filteredResources>
18+
<filter>
19+
<id>1761187845433</id>
20+
<name></name>
21+
<type>30</type>
22+
<matcher>
23+
<id>org.eclipse.core.resources.regexFilterMatcher</id>
24+
<arguments>node_modules|\.git|__CREATED_BY_JAVA_LANGUAGE_SERVER__</arguments>
25+
</matcher>
26+
</filter>
27+
</filteredResources>
1728
</projectDescription>

‎template/fr.opensagres.xdocreport.template.freemarker/src/main/java/fr/opensagres/xdocreport/template/freemarker/FreemarkerTemplateEngine.java‎

Lines changed: 46 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import java.util.Enumeration;
3434
import java.util.List;
3535
import java.util.Map;
36+
import java.util.regex.Pattern;
3637

3738
import fr.opensagres.xdocreport.core.EncodingConstants;
3839
import fr.opensagres.xdocreport.core.XDocReportException;
@@ -116,8 +117,14 @@ protected void processWithCache( String templateName, IContext context, Writer w
116117
protected void processNoCache( String templateName, IContext context, Reader reader, Writer writer )
117118
throws XDocReportException, IOException
118119
{
119-
// Create a new template.
120-
Template template = new Template( templateName, getReader( reader ), getFreemarkerConfiguration() );
120+
// Read template content for validation and processing
121+
String templateContent = IOUtils.toString(reader);
122+
123+
// Validate template content for security threats
124+
validateTemplateSecurity(new StringReader(templateContent));
125+
126+
// Create a new template with validated content, but let getReader handle any modifications
127+
Template template = new Template( templateName, getReader( new StringReader(templateContent) ), getFreemarkerConfiguration() );
121128
// Merge template with Java model
122129
process( context, writer, template );
123130
}
@@ -294,8 +301,14 @@ public void process( String templateName, IContext context, Writer writer )
294301

295302
try
296303
{
297-
// Create a new template.
298-
Template template = new Template( templateName, reader, getFreemarkerConfiguration() );
304+
// Read template content for validation and processing
305+
String templateContent = IOUtils.toString(reader);
306+
307+
// Validate template content for security threats
308+
validateTemplateSecurity(new StringReader(templateContent));
309+
310+
// Create a new template with validated content, but let getReader handle any modifications
311+
Template template = new Template( templateName, getReader( new StringReader(templateContent) ), getFreemarkerConfiguration() );
299312
// Merge template with Java model
300313
process( context, writer, template );
301314
}
@@ -323,4 +336,33 @@ public void addTemplateLoader( TemplateLoader loader )
323336
{
324337
templateLoaders.add( loader );
325338
}
339+
340+
/**
341+
* Validate template content for security threats.
342+
* This method checks for dangerous patterns that could lead to SSTI attacks.
343+
*
344+
* @param reader the template reader to validate
345+
* @throws XDocReportException if dangerous patterns are found
346+
* @throws IOException if reading fails
347+
*/
348+
private void validateTemplateSecurity(Reader reader) throws XDocReportException, IOException {
349+
String templateSource = IOUtils.toString(reader);
350+
351+
String[] dangerousPatterns = {
352+
"freemarker.template.utility.Execute",
353+
"java.lang.Runtime",
354+
"java.lang.ProcessBuilder",
355+
"java.lang.System",
356+
"java.lang.reflect",
357+
"?new",
358+
"?eval",
359+
"?api"
360+
};
361+
362+
for (String pattern : dangerousPatterns) {
363+
if (templateSource.matches("(?i).*" + Pattern.quote(pattern) + ".*")) {
364+
throw new XDocReportException("Security violation: forbidden pattern '" + pattern + "'");
365+
}
366+
}
367+
}
326368
}

‎template/fr.opensagres.xdocreport.template.freemarker/src/test/java/fr/opensagres/xdocreport/template/freemarker/FreemarkerTemplateEngineSecurityTestCase.java‎

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
/**
2+
* Copyright (C) 2011-2015 The XDocReport Team <[email protected]>
3+
*
4+
* All rights reserved.
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining
7+
* a copy of this software and associated documentation files (the
8+
* "Software"), to deal in the Software without restriction, including
9+
* without limitation the rights to use, copy, modify, merge, publish,
10+
* distribute, sublicense, and/or sell copies of the Software, and to
11+
* permit persons to whom the Software is furnished to do so, subject to
12+
* the following conditions:
13+
*
14+
* The above copyright notice and this permission notice shall be
15+
* included in all copies or substantial portions of the Software.
16+
*
17+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
18+
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
19+
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
20+
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
21+
* LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
22+
* OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
23+
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
24+
*/
25+
package fr.opensagres.xdocreport.template.freemarker;
26+
27+
import java.io.StringReader;
28+
import java.io.StringWriter;
29+
import java.io.Writer;
30+
31+
import org.junit.Assert;
32+
import org.junit.Test;
33+
34+
import fr.opensagres.xdocreport.core.XDocReportException;
35+
import fr.opensagres.xdocreport.template.IContext;
36+
37+
/**
38+
* Test case for FreemarkerTemplateEngine security validation.
39+
* This test verifies that SSTI (Server-Side Template Injection) attacks are properly blocked.
40+
*/
41+
public class FreemarkerTemplateEngineSecurityTestCase
42+
{
43+
44+
@Test
45+
public void testSSTIProtectionExecuteClass()
46+
throws Exception
47+
{
48+
FreemarkerTemplateEngine engine = new FreemarkerTemplateEngine();
49+
IContext context = engine.createContext();
50+
Writer writer = new StringWriter();
51+
52+
// This is the exact payload from the user's example
53+
String maliciousTemplate = "${"freemarker.template.utility.Execute"?new()("whoami")}";
54+
55+
try
56+
{
57+
engine.processNoCache( "test", context, new StringReader( maliciousTemplate ), writer );
58+
Assert.fail( "Expected XDocReportException for SSTI attack" );
59+
}
60+
catch ( XDocReportException e )
61+
{
62+
Assert.assertTrue( "Exception should mention security violation",
63+
e.getMessage().contains( "Security violation" ) );
64+
Assert.assertTrue( "Exception should mention forbidden pattern",
65+
e.getMessage().contains( "forbidden pattern" ) );
66+
}
67+
}
68+
69+
@Test
70+
public void testSSTIProtectionNewOperator()
71+
throws Exception
72+
{
73+
FreemarkerTemplateEngine engine = new FreemarkerTemplateEngine();
74+
IContext context = engine.createContext();
75+
Writer writer = new StringWriter();
76+
77+
// Test ?new operator detection
78+
String maliciousTemplate = "${someClass?new()}";
79+
80+
try
81+
{
82+
engine.processNoCache( "test", context, new StringReader( maliciousTemplate ), writer );
83+
Assert.fail( "Expected XDocReportException for ?new operator" );
84+
}
85+
catch ( XDocReportException e )
86+
{
87+
Assert.assertTrue( "Exception should mention security violation",
88+
e.getMessage().contains( "Security violation" ) );
89+
Assert.assertTrue( "Exception should mention forbidden pattern",
90+
e.getMessage().contains( "forbidden pattern" ) );
91+
}
92+
}
93+
94+
@Test
95+
public void testSSTIProtectionRuntimeClass()
96+
throws Exception
97+
{
98+
FreemarkerTemplateEngine engine = new FreemarkerTemplateEngine();
99+
IContext context = engine.createContext();
100+
Writer writer = new StringWriter();
101+
102+
// Test Runtime class detection
103+
String maliciousTemplate = "${java.lang.Runtime.getRuntime().exec('whoami')}";
104+
105+
try
106+
{
107+
engine.processNoCache( "test", context, new StringReader( maliciousTemplate ), writer );
108+
Assert.fail( "Expected XDocReportException for Runtime class" );
109+
}
110+
catch ( XDocReportException e )
111+
{
112+
Assert.assertTrue( "Exception should mention security violation",
113+
e.getMessage().contains( "Security violation" ) );
114+
Assert.assertTrue( "Exception should mention forbidden pattern",
115+
e.getMessage().contains( "forbidden pattern" ) );
116+
}
117+
}
118+
119+
@Test
120+
public void testSSTIProtectionProcessBuilderClass()
121+
throws Exception
122+
{
123+
FreemarkerTemplateEngine engine = new FreemarkerTemplateEngine();
124+
IContext context = engine.createContext();
125+
Writer writer = new StringWriter();
126+
127+
// Test ProcessBuilder class detection
128+
String maliciousTemplate = "${java.lang.ProcessBuilder?new('whoami').start()}";
129+
130+
try
131+
{
132+
engine.processNoCache( "test", context, new StringReader( maliciousTemplate ), writer );
133+
Assert.fail( "Expected XDocReportException for ProcessBuilder class" );
134+
}
135+
catch ( XDocReportException e )
136+
{
137+
Assert.assertTrue( "Exception should mention security violation",
138+
e.getMessage().contains( "Security violation" ) );
139+
Assert.assertTrue( "Exception should mention forbidden pattern",
140+
e.getMessage().contains( "forbidden pattern" ) );
141+
}
142+
}
143+
144+
@Test
145+
public void testSSTIProtectionSystemClass()
146+
throws Exception
147+
{
148+
FreemarkerTemplateEngine engine = new FreemarkerTemplateEngine();
149+
IContext context = engine.createContext();
150+
Writer writer = new StringWriter();
151+
152+
// Test System class detection
153+
String maliciousTemplate = "${java.lang.System.getProperty('user.name')}";
154+
155+
try
156+
{
157+
engine.processNoCache( "test", context, new StringReader( maliciousTemplate ), writer );
158+
Assert.fail( "Expected XDocReportException for System class" );
159+
}
160+
catch ( XDocReportException e )
161+
{
162+
Assert.assertTrue( "Exception should mention security violation",
163+
e.getMessage().contains( "Security violation" ) );
164+
Assert.assertTrue( "Exception should mention forbidden pattern",
165+
e.getMessage().contains( "forbidden pattern" ) );
166+
}
167+
}
168+
169+
@Test
170+
public void testSSTIProtectionReflectionClasses()
171+
throws Exception
172+
{
173+
FreemarkerTemplateEngine engine = new FreemarkerTemplateEngine();
174+
IContext context = engine.createContext();
175+
Writer writer = new StringWriter();
176+
177+
// Test reflection classes detection
178+
String maliciousTemplate = "${java.lang.reflect.Method.invoke()}";
179+
180+
try
181+
{
182+
engine.processNoCache( "test", context, new StringReader( maliciousTemplate ), writer );
183+
Assert.fail( "Expected XDocReportException for reflection classes" );
184+
}
185+
catch ( XDocReportException e )
186+
{
187+
Assert.assertTrue( "Exception should mention security violation",
188+
e.getMessage().contains( "Security violation" ) );
189+
Assert.assertTrue( "Exception should mention forbidden pattern",
190+
e.getMessage().contains( "forbidden pattern" ) );
191+
}
192+
}
193+
194+
@Test
195+
public void testSafeTemplateProcessing()
196+
throws Exception
197+
{
198+
FreemarkerTemplateEngine engine = new FreemarkerTemplateEngine();
199+
IContext context = engine.createContext();
200+
Writer writer = new StringWriter();
201+
202+
// Test that safe templates still work
203+
String safeTemplate = "Hello ${name}!";
204+
context.put( "name", "World" );
205+
206+
try
207+
{
208+
engine.processNoCache( "test", context, new StringReader( safeTemplate ), writer );
209+
Assert.assertEquals( "Hello World!", writer.toString() );
210+
}
211+
catch ( XDocReportException e )
212+
{
213+
Assert.fail( "Safe template should not throw security exception: " + e.getMessage() );
214+
}
215+
}
216+
}
217+

0 commit comments

Comments
 (0)