Hello @astola-studio, sorry for the delay to answer, I'm having a crazy month xD

I'm still working in a good documentation of SecurityGuard to be added in the main documentation of BeanShell, but here is some examples and explanation of what you can do with SecurityGuard to deal with this malicious code.

Principles

The SecurityGuard is just a interface that you can implement and add in the interpreter, here is a basic example of that:

import bsh.Interpreter;
import bsh.SecurityGuard;

class MySecurityGuard implements SecurityGuard {}

public class Main {

    public static void main(String[] args) {
        Interpreter.mainSecurityGuard.add(new MySecurityGuard());
        Interpreter bsh = new Interpreter();
        bsh.eval(" your code... ");
    }

}

Blocking the construction of an `DexClassLoader`

The main idea of SecurityGuard is to you implement your own methods to make validations of the code at runtime, one of those validations that you can do is when you are constructing an object, so we can validate what's the type of object being constructed and block if the type is insecure:

class MySecurityGuard implements SecurityGuard {

    @Override
    public boolean canConstruct(Class<?> _class, Object[] args) {
        if (DexClassLoader.class.isAssignableFrom(_class))
            return false; // Can't create the object if it's going to be an instance of DexClassLoader

        return true; // Otherwise can create ;D
    }

}

Blocking the dynamic load of class

Supose that some times you need an instance of DexClassLoader, so you can't block the construction of that but you need prevent the dynamic load of classes, so you can block just the method loadClass:

class MySecurityGuard implements SecurityGuard {

    @Override
    public boolean canInvokeMethod(Object thisArg, String methodName, Object[] args) {
        if (thisArg instanceof DexClassLoader && "loadClass".equals(methodName))
            return false; // Can't invoke 'loadMethod' of an DexClassLoader

        return true; // Can invoke anything else :P
    }

}

Important informations

Those are really basic examples, the main idea of SecurityGuard is be an API, you can do any validation that you need to do, and of course there are more methods to make validations than just canInvokeMethod and canConstruct ( you can see all available methods here ). It's important to remember that everything being used is available on each method, e.g., in the canInvokeMethod you know what is the object where you're calling the method ( it's the thisArg ), you also have the name of the method ( it's the methodName) and you also have all arguments being used to call the method ( it's the args ), so you can do any kind of validation that you need to.

SecurityGuard is "Reflection proof", with that I mean that executing a normal code and a reflection code will both be validated by SecurityGuard, e.g.:

import java.lang.reflect.Method;

// This will be validated by 'canInvokeMethod'
Class<?> loadedClass = classLoader.loadClass("package.Malicious");

// This will also be validated by 'canInvokeMethod'
Method loadClassMethod = classLoader.getClass().getMethod("loadClass", String.class);
loadClassMethod.invoke(classLoader, "package.Malicious");

Principles

Blocking the construction of an DexClassLoader

Blocking the dynamic load of class

Important informations

Blocking the construction of an `DexClassLoader`

SecurityGuard: documentation #770

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions