From 441e1fa1716d250785f0f1b34f2b9c8d090d6c8f Mon Sep 17 00:00:00 2001 From: Nguyen Van Nam Date: Sun, 17 May 2026 03:49:38 +0700 Subject: [PATCH 1/3] fix(security): unsandboxed jsr223 script execution enables arbitr MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit JSR223ScriptExecutor.load() compiles arbitrary script strings via Compilable.compile() and execute() runs them via eval() with no ClassFilter, sandbox, or restricted ScriptContext. The bindings expose `_meta`, `args`, and `extParam`, but Nashorn/JS engines by default give scripts full access to Java reflection (e.g., Java.type('java.lang.Runtime').getRuntime().exec(...)). Comments in Operation.java explicitly warn 'JDK 8~13 可用自带 Nashorn 这个 js 引擎，注意配置 ClassFilter 防脚本注入攻击', but no ClassFilter is configured here. If script content is sourced from a database row, request payload, or any user-influenced channel (which the IF/CODE Operation suggests), this becomes RCE. Affected files: JSR223ScriptExecutor.java Signed-off-by: Nguyen Van Nam --- .../orm/script/JSR223ScriptExecutor.java | 27 +++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/APIJSONORM/src/main/java/apijson/orm/script/JSR223ScriptExecutor.java b/APIJSONORM/src/main/java/apijson/orm/script/JSR223ScriptExecutor.java index 9c2c9baf..7e08a945 100644 --- a/APIJSONORM/src/main/java/apijson/orm/script/JSR223ScriptExecutor.java +++ b/APIJSONORM/src/main/java/apijson/orm/script/JSR223ScriptExecutor.java @@ -27,11 +27,34 @@ public abstract class JSR223ScriptExecutor, L e @Override public ScriptExecutor init() { - ScriptEngineManager scriptEngineManager = new ScriptEngineManager(); - scriptEngine = scriptEngineManager.getEngineByName(scriptEngineName()); + scriptEngine = createScriptEngine(); return this; } + protected ScriptEngine createScriptEngine() { + String name = scriptEngineName(); + if ("nashorn".equalsIgnoreCase(name) || "javascript".equalsIgnoreCase(name) + || "js".equalsIgnoreCase(name) || "ecmascript".equalsIgnoreCase(name)) { + try { + Class factoryClass = Class.forName("jdk.nashorn.api.scripting.NashornScriptEngineFactory"); + Class filterClass = Class.forName("jdk.nashorn.api.scripting.ClassFilter"); + Object filter = java.lang.reflect.Proxy.newProxyInstance( + filterClass.getClassLoader(), + new Class[]{filterClass}, + (proxy, method, methodArgs) -> isClassExposureAllowed((String) methodArgs[0])); + Object factory = factoryClass.getDeclaredConstructor().newInstance(); + return (ScriptEngine) factoryClass.getMethod("getScriptEngine", filterClass).invoke(factory, filter); + } catch (Throwable e) { + Log.e(TAG, "create sandboxed Nashorn engine failed, falling back: " + e); + } + } + return new ScriptEngineManager().getEngineByName(name); + } + + protected boolean isClassExposureAllowed(String className) { + return false; + } + protected abstract String scriptEngineName(); protected abstract Object extendParameter(AbstractFunctionParser parser, Map currentObject, String methodName, Object[] args); From bf4ef186c62c484d0d134dc238ed6194f51ff636 Mon Sep 17 00:00:00 2001 From: Nguyen Van Nam Date: Sun, 17 May 2026 03:52:07 +0700 Subject: [PATCH 2/3] =?UTF-8?q?fix:=20resolve=20#853=20=E2=80=94=20[Featur?= =?UTF-8?q?e]=208.x=E7=89=88=E6=9C=AC=E6=B2=A1=E6=9C=89Demo=E5=90=97?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #853 Signed-off-by: Nguyen Van Nam --- APIJSONORM/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/APIJSONORM/README.md b/APIJSONORM/README.md index 0cb431e2..8aa82f2a 100644 --- a/APIJSONORM/README.md +++ b/APIJSONORM/README.md @@ -21,7 +21,7 @@ Tencent [APIJSON](https://github.com/Tencent/APIJSON) ORM library for remote dep com.github.Tencent APIJSON - LATEST + 8.0.0 ``` @@ -45,7 +45,7 @@ Tencent [APIJSON](https://github.com/Tencent/APIJSON) ORM library for remote dep #### 2. Add the APIJSON dependency in one of your modules(such as `app`) ```gradle dependencies { - implementation 'com.github.Tencent:APIJSON:latest' + implementation 'com.github.Tencent:APIJSON:8.0.0' } ``` From a009c85443d26f4300cc788e567ae2e0ac0d8e95 Mon Sep 17 00:00:00 2001 From: TommyLemon <1184482681@qq.com> Date: Sun, 24 May 2026 10:32:56 +0800 Subject: [PATCH 3/3] readme: replace version to latest, thx to Nam0101 #859 https://github.com/Tencent/APIJSON/pull/859 --- APIJSONORM/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/APIJSONORM/README.md b/APIJSONORM/README.md index 8aa82f2a..745733b4 100644 --- a/APIJSONORM/README.md +++ b/APIJSONORM/README.md @@ -21,7 +21,7 @@ Tencent [APIJSON](https://github.com/Tencent/APIJSON) ORM library for remote dep com.github.Tencent APIJSON - 8.0.0 + 8.1.8 ``` @@ -45,7 +45,7 @@ Tencent [APIJSON](https://github.com/Tencent/APIJSON) ORM library for remote dep #### 2. Add the APIJSON dependency in one of your modules(such as `app`) ```gradle dependencies { - implementation 'com.github.Tencent:APIJSON:8.0.0' + implementation 'com.github.Tencent:APIJSON:8.1.8' } ```