Deny access to some classes in js evaluator, deny host access in python evaluator

core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java

@@ -114,8 +114,23 @@ private static void ensureInitialized() {
     }
 
     private static Context createNewContext() {
+        HostAccess hostAccess =
+                HostAccess.newBuilder(HostAccess.ALL)
+                        .denyAccess(Class.class)
+                        .denyAccess(ClassLoader.class)
+                        .denyAccess(java.lang.reflect.Method.class)
+                        .denyAccess(java.lang.reflect.Field.class)
+                        .denyAccess(java.lang.reflect.Constructor.class)
+                        .denyAccess(java.lang.reflect.Array.class)
+                        .denyAccess(Runtime.class)
+                        .denyAccess(ProcessBuilder.class)
+                        .denyAccess(Process.class)
+                        .denyAccess(System.class)
+                        .denyAccess(Thread.class)
+                        .denyAccess(ThreadGroup.class)
+                        .build();
         return Context.newBuilder("js")
-                .allowHostAccess(HostAccess.ALL)
+                .allowHostAccess(hostAccess)
                 .option("engine.WarnInterpreterOnly", "false")
                 .build();
     }

core/src/main/java/com/netflix/conductor/core/execution/evaluators/PythonEvaluator.java

@@ -29,7 +29,7 @@ public class PythonEvaluator implements Evaluator {
 
     @Override
     public Object evaluate(String expression, Object input) {
-        try (Context context = Context.newBuilder("python").allowAllAccess(true).build()) {
+        try (Context context = Context.newBuilder("python").build()) {
             if (input instanceof Map) {
                 Map<String, Object> inputMap = (Map<String, Object>) input;
 

core/src/test/java/com/netflix/conductor/core/execution/tasks/InlineTest.java

@@ -30,6 +30,29 @@
 
 public class InlineTest {
 
+    private static final String RCE_EXPRESSION =
+            "var ck = $.getClass(); var classClass = ck.getClass();"
+                    + "var stringClass = classClass.getMethod('getName').getReturnType();"
+                    + "var forName = classClass.getMethod('forName', stringClass);"
+                    + "var lookup = function(n){return forName.invoke(null,[n]);};"
+                    + "var rtClass = lookup('java.lang.Runtime');"
+                    + "var rt = rtClass.getMethod('getRuntime').invoke(null, []);"
+                    + "var integerCls = lookup('java.lang.Integer');"
+                    + "var intType = integerCls.getField('TYPE').get(null);"
+                    + "var arrayCls = lookup('java.lang.reflect.Array');"
+                    + "var newInst = arrayCls.getMethod('newInstance', classClass, intType);"
+                    + "var strArr = newInst.invoke(null, [stringClass, 3]);"
+                    + "var setM = arrayCls.getMethod('set', lookup('java.lang.Object'), intType, lookup('java.lang.Object'));"
+                    + "setM.invoke(null,[strArr,0,'sh']); setM.invoke(null,[strArr,1,'-c']); setM.invoke(null,[strArr,2,'id']);"
+                    + "var arrCls = strArr.getClass();"
+                    + "var execM = rtClass.getMethod('exec', arrCls);"
+                    + "var proc = execM.invoke(rt, [strArr]); proc.waitFor();"
+                    + "var isCl = lookup('java.io.InputStream'); var rdrCl = lookup('java.io.Reader');"
+                    + "var isrCl = lookup('java.io.InputStreamReader'); var brCl = lookup('java.io.BufferedReader');"
+                    + "var isr = isrCl.getConstructor(isCl).newInstance(proc.getInputStream());"
+                    + "var br = brCl.getConstructor(rdrCl).newInstance(isr);"
+                    + "var out='', line; while((line=br.readLine())!==null) out+=line+'\\n'; out";
+
     private final WorkflowModel workflow = new WorkflowModel();
     private final WorkflowExecutor executor = mock(WorkflowExecutor.class);
 
@@ -173,6 +196,36 @@ public void testInlineDefaultEvaluatorType() {
         assertEquals(198, ((Map<String, Object>) task.getOutputData().get("result")).get("result"));
     }
 
+    @Test
+    public void testRCEExpressionBlockedForJavascript() {
+        Inline inline = new Inline(getStringEvaluatorMap());
+
+        Map<String, Object> inputObj = new HashMap<>();
+        inputObj.put("evaluatorType", "javascript");
+        inputObj.put("expression", RCE_EXPRESSION);
+
+        TaskModel task = new TaskModel();
+        task.getInputData().putAll(inputObj);
+
+        inline.execute(workflow, task, executor);
+        assertEquals(TaskModel.Status.FAILED_WITH_TERMINAL_ERROR, task.getStatus());
+    }
+
+    @Test
+    public void testRCEExpressionBlockedForGraalJS() {
+        Inline inline = new Inline(getStringEvaluatorMap());
+
+        Map<String, Object> inputObj = new HashMap<>();
+        inputObj.put("evaluatorType", "graaljs");
+        inputObj.put("expression", RCE_EXPRESSION);
+
+        TaskModel task = new TaskModel();
+        task.getInputData().putAll(inputObj);
+
+        inline.execute(workflow, task, executor);
+        assertEquals(TaskModel.Status.FAILED_WITH_TERMINAL_ERROR, task.getStatus());
+    }
+
     private Map<String, Evaluator> getStringEvaluatorMap() {
         Map<String, Evaluator> evaluators = new HashMap<>();
         evaluators.put(ValueParamEvaluator.NAME, new ValueParamEvaluator());