Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

janino-compiler/janino

              master @ 4db1b81
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Sandbox Escape: 2 prior fixes. Scrutinize any change in this area.

commons-compiler/Sandbox.java: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Inadequate enforcement of security boundaries allowed compiled code to escape the sandbox. The confinement mechanism had to be refactored from custom SecurityManager checks to explicit AccessController.doPrivileged calls with restricted contexts.

Sandbox Escape: Running compilation and execution without runtime wrapper boundaries allowed sandbox escapes, requiring compilation steps to defer strict containment to execution-time via dedicated Sandbox wrappers.

Denial of Service: A stack overflow vulnerability (CVE-2023-33546) exists in the expression parser's guessing logic, allowing untrusted input to exhaust the thread stack and crash the JVM.