Dynamic Code Execution (ARCH4131)

Key java.security.dynamic-code-execution · Severity critical · Category security · CWE CWE-95

Running a string from user input through a script engine (ScriptEngine) leads directly to remote code execution (RCE). Use a safe construct that interprets data, not code.

Incorrect

ScriptEngine engine = new ScriptEngineManager().getEngineByName("nashorn");
Object result = engine.eval(request.getParameter("expr")); // executes user code

Correct

// Do not run user input as code; use a constrained expression evaluator
Expression expr = new SpelExpressionParser().parseExpression(allowedFormula);
Object result = expr.getValue(new StandardEvaluationContext(safeRoot));

Fix

Never evaluate user input as code; use a constrained rule/expression evaluator or allowlisted operations.