add IAST code injection tests for java

manifests/java.yml

@@ -307,9 +307,19 @@ manifest:
   tests/appsec/api_security_testing/test_normalized_route.py::Test_NormalizedRoute: missing_feature
   tests/appsec/api_security_testing/test_normalized_route.py::Test_NormalizedRouteMultiParamsInSegment: missing_feature
   tests/appsec/api_security_testing/test_normalized_route.py::Test_NormalizedRouteOptionalParams: missing_feature
-  tests/appsec/iast/sink/test_code_injection.py::TestCodeInjection: missing_feature
+  tests/appsec/iast/sink/test_code_injection.py::TestCodeInjection:
+    - weblog_declaration:
+        "*": v1.66.0-SNAPSHOT
+        play: incomplete_test_app (endpoint not implemented)
+        ratpack: incomplete_test_app (endpoint not implemented)
+        spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
   tests/appsec/iast/sink/test_code_injection.py::TestCodeInjection_ExtendedLocation: missing_feature
-  tests/appsec/iast/sink/test_code_injection.py::TestCodeInjection_StackTrace: missing_feature
+  tests/appsec/iast/sink/test_code_injection.py::TestCodeInjection_StackTrace:
+    - weblog_declaration:
+        "*": v1.66.0-SNAPSHOT
+        play: incomplete_test_app (endpoint not implemented)
+        ratpack: incomplete_test_app (endpoint not implemented)
+        spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
   tests/appsec/iast/sink/test_command_injection.py::TestCommandInjection:
     - weblog_declaration:
         "*": v1.1.0

utils/build/docker/java/akka-http/pom.xml

@@ -102,6 +102,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>3.17.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>javax.mail</groupId>
             <artifactId>javax.mail-api</artifactId>

utils/build/docker/java/akka-http/src/main/scala/com/datadoghq/akka_http/IastRoutes.scala

@@ -12,6 +12,7 @@ object IastRoutes {
 
   private val superSecretAccessKey = "insecure"
   private val cmd = new CmdExamples()
+  private val codeInjection = new CodeInjectionExamples()
   private val crypto = new CryptoExamples()
   private val ldap = new LDAPExamples(ldapContext)
   private val path_ = new PathExamples()
@@ -79,6 +80,18 @@ object IastRoutes {
           }
         }
       } ~
+      path("code_injection" / "test_insecure") {
+        post {
+          paramOrFormField("code") { code =>
+            complete(codeInjection.insecureCodeInjection(code))
+          }
+        }
+      } ~
+      path("code_injection" / "test_secure") {
+        post {
+          complete(codeInjection.secureCodeInjection())
+        }
+      } ~
       pathPrefix("xpathi") {
               post {
                 path("test_insecure") {

utils/build/docker/java/iast-common/pom.xml

@@ -58,6 +58,12 @@
             <version>1.6.2</version>
             <optional>true</optional>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+            <optional>true</optional>
+        </dependency>
     </dependencies>
 
     <build>

utils/build/docker/java/iast-common/src/main/java/com/datadoghq/system_tests/iast/utils/CodeInjectionExamples.java

@@ -0,0 +1,26 @@
+package com.datadoghq.system_tests.iast.utils;
+
+import bsh.EvalError;
+import bsh.Interpreter;
+import java.lang.reflect.UndeclaredThrowableException;
+
+public class CodeInjectionExamples {
+
+    public String insecureCodeInjection(final String code) {
+        try {
+            new Interpreter().eval(code);
+            return "Code injection insecure";
+        } catch (EvalError e) {
+            throw new UndeclaredThrowableException(e);
+        }
+    }
+
+    public String secureCodeInjection() {
+        try {
+            new Interpreter().eval("1+2");
+            return "Code injection secure";
+        } catch (EvalError e) {
+            throw new UndeclaredThrowableException(e);
+        }
+    }
+}

utils/build/docker/java/jersey-grizzly2/pom.xml

@@ -98,6 +98,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>3.17.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>javax.mail</groupId>
             <artifactId>javax.mail-api</artifactId>

utils/build/docker/java/jersey-grizzly2/src/main/java/com/datadoghq/jersey/IastSinkResource.java

@@ -20,6 +20,7 @@ public class IastSinkResource {
     private final SqlExamples sql = new SqlExamples(DATA_SOURCE) ;
     private final LDAPExamples ldap = new LDAPExamples(LDAP_CONTEXT);
     private final CmdExamples cmd = new CmdExamples();
+    private final CodeInjectionExamples codeInjection = new CodeInjectionExamples();
     private final PathExamples path = new PathExamples();
     private final SsrfExamples ssrf = new SsrfExamples();
     private final WeakRandomnessExamples weakRandomness = new WeakRandomnessExamples();
@@ -81,6 +82,18 @@ public String insecureCmd(@FormParam("cmd") final String cmd) {
         return this.cmd.insecureCmd(cmd);
     }
 
+    @POST
+    @Path("/code_injection/test_insecure")
+    public String insecureCodeInjection(@FormParam("code") final String code) {
+        return this.codeInjection.insecureCodeInjection(code);
+    }
+
+    @POST
+    @Path("/code_injection/test_secure")
+    public String secureCodeInjection() {
+        return this.codeInjection.secureCodeInjection();
+    }
+
     @POST
     @Path("/ldapi/test_insecure")
     public String insecureLDAP(@FormParam("username") final String username, @FormParam("password") final String password) {

utils/build/docker/java/play/pom.xml

@@ -87,6 +87,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>3.17.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>javax.mail</groupId>
             <artifactId>javax.mail-api</artifactId>

utils/build/docker/java/ratpack/pom.xml

@@ -71,6 +71,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>3.17.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>javax.mail</groupId>
             <artifactId>javax.mail-api</artifactId>

utils/build/docker/java/resteasy-netty3/pom.xml

@@ -96,6 +96,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>3.17.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>javax.mail</groupId>
             <artifactId>javax.mail-api</artifactId>

utils/build/docker/java/resteasy-netty3/src/main/java/com/datadoghq/resteasy/IastSinkResource.java

@@ -23,6 +23,7 @@ public class IastSinkResource {
     private final SqlExamples sql = new SqlExamples(DATA_SOURCE) ;
     private final LDAPExamples ldap = new LDAPExamples(LDAP_CONTEXT);
     private final CmdExamples cmd = new CmdExamples();
+    private final CodeInjectionExamples codeInjection = new CodeInjectionExamples();
     private final PathExamples path = new PathExamples();
     private final SsrfExamples ssrf = new SsrfExamples();
     private final WeakRandomnessExamples weakRandomness = new WeakRandomnessExamples();
@@ -84,6 +85,18 @@ public String insecureCmd(@FormParam("cmd") final String cmd) {
         return this.cmd.insecureCmd(cmd);
     }
 
+    @POST
+    @Path("/code_injection/test_insecure")
+    public String insecureCodeInjection(@FormParam("code") final String code) {
+        return this.codeInjection.insecureCodeInjection(code);
+    }
+
+    @POST
+    @Path("/code_injection/test_secure")
+    public String secureCodeInjection() {
+        return this.codeInjection.secureCodeInjection();
+    }
+
     @POST
     @Path("/ldapi/test_insecure")
     public String insecureLDAP(@FormParam("username") final String username, @FormParam("password") final String password) {

utils/build/docker/java/spring-boot/pom.xml

@@ -223,6 +223,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>3.17.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>javax.mail</groupId>
             <artifactId>javax.mail-api</artifactId>

utils/build/docker/java/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/AppSecIast.java

@@ -45,6 +45,7 @@ public class AppSecIast {
     private final ReflectionExamples reflectionExamples;
     private final DeserializationExamples deserializationExamples;
     private final EmailExamples emailExamples;
+    private final CodeInjectionExamples codeInjectionExamples;
 
 
     public AppSecIast(final DataSource dataSource) {
@@ -60,6 +61,7 @@ public AppSecIast(final DataSource dataSource) {
         this.reflectionExamples = new ReflectionExamples();
         this.deserializationExamples = new DeserializationExamples();
         this.emailExamples = new EmailExamples();
+        this.codeInjectionExamples = new CodeInjectionExamples();
     }
 
     @RequestMapping("/hardcoded_secrets/test_insecure")
@@ -257,6 +259,17 @@ String secureXPath(final ServletRequest request) {
         return "XPath secure";
     }
 
+    @PostMapping("/code_injection/test_insecure")
+    String insecureCodeInjection(final ServletRequest request) {
+        final String code = request.getParameter("code");
+        return codeInjectionExamples.insecureCodeInjection(code);
+    }
+
+    @PostMapping("/code_injection/test_secure")
+    String secureCodeInjection(final ServletRequest request) {
+        return codeInjectionExamples.secureCodeInjection();
+    }
+
     @GetMapping("/trust-boundary-violation/test_insecure")
     public String trustBoundaryViolationInSecureSpringBoot(final HttpServletRequest request) {
       String paramValue = request.getParameter("username");

utils/build/docker/java/vertx3/pom.xml

@@ -80,6 +80,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>3.17.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>javax.mail</groupId>
             <artifactId>javax.mail-api</artifactId>

utils/build/docker/java/vertx3/src/main/java/com/datadoghq/vertx3/iast/routes/IastSinkRouteProvider.java

@@ -24,6 +24,7 @@ public IastSinkRouteProvider(final DataSource dataSource, final InitialDirContex
     public void accept(final Router router) {
         final String superSecretAccessKey = "insecure";
         final CmdExamples cmd = new CmdExamples();
+        final CodeInjectionExamples codeInjection = new CodeInjectionExamples();
         final CryptoExamples crypto = new CryptoExamples();
         final LDAPExamples ldap = new LDAPExamples(ldapContext);
         final PathExamples path = new PathExamples();
@@ -77,6 +78,14 @@ public void accept(final Router router) {
             final String cmdParam = request.getParam("cmd");
             ctx.response().end(cmd.insecureCmd(cmdParam));
         });
+        router.post("/iast/code_injection/test_insecure").handler(ctx -> {
+            final HttpServerRequest request = ctx.request();
+            final String codeParam = request.getParam("code");
+            ctx.response().end(codeInjection.insecureCodeInjection(codeParam));
+        });
+        router.post("/iast/code_injection/test_secure").handler(ctx ->
+                ctx.response().end(codeInjection.secureCodeInjection())
+        );
         router.post("/iast/path_traversal/test_insecure").handler(ctx -> {
             final HttpServerRequest request = ctx.request();
             final String pathParam = request.getParam("path");

utils/build/docker/java/vertx4/pom.xml

@@ -80,6 +80,11 @@
             <artifactId>commons-lang3</artifactId>
             <version>3.17.0</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>javax.mail</groupId>
             <artifactId>javax.mail-api</artifactId>

utils/build/docker/java/vertx4/src/main/java/com/datadoghq/vertx4/iast/routes/IastSinkRouteProvider.java

@@ -24,6 +24,7 @@ public IastSinkRouteProvider(final DataSource dataSource, final InitialDirContex
     public void accept(final Router router) {
         final String superSecretAccessKey = "insecure";
         final CmdExamples cmd = new CmdExamples();
+        final CodeInjectionExamples codeInjection = new CodeInjectionExamples();
         final CryptoExamples crypto = new CryptoExamples();
         final LDAPExamples ldap = new LDAPExamples(ldapContext);
         final PathExamples path = new PathExamples();
@@ -76,6 +77,14 @@ public void accept(final Router router) {
             final String cmdParam = request.getParam("cmd");
             ctx.response().end(cmd.insecureCmd(cmdParam));
         });
+        router.post("/iast/code_injection/test_insecure").handler(ctx -> {
+            final HttpServerRequest request = ctx.request();
+            final String codeParam = request.getParam("code");
+            ctx.response().end(codeInjection.insecureCodeInjection(codeParam));
+        });
+        router.post("/iast/code_injection/test_secure").handler(ctx ->
+                ctx.response().end(codeInjection.secureCodeInjection())
+        );
         router.post("/iast/path_traversal/test_insecure").handler(ctx -> {
             final HttpServerRequest request = ctx.request();
             final String pathParam = request.getParam("path");

utils/build/docker/java_otel/spring-boot/pom.xml

@@ -14,6 +14,11 @@
     </parent>
     <packaging>${packaging.type}</packaging>
     <dependencies>
+        <dependency>
+            <groupId>org.apache-extras.beanshell</groupId>
+            <artifactId>bsh</artifactId>
+            <version>2.0b6</version>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-json</artifactId>