[Fix] add black key for switch task

[caishunfeng]

Purpose of the pull request

• add some black keys for switch task

Brief change log

• SwitchTaskUtils

Verify this pull request

• Added UT to verify the change.

[zhongjiajie]

can we get the final exec command in user input? such as we can convert below code

var a = Java.type("ja" + "va.lang.Runtime");
var b = a.getRuntime();
b.exec(${cmd})

to

var a = Java.type("ja" + "va.lang.Runtime");
var b = a.getRuntime();
Java.type("ja" + "va.lang.Runtime").getRuntime().exec(${cmd})

If we can do it, I think that would be easier to check

[caishunfeng]

It's hard to convert because the code are executed in js engine.

[zhongjiajie]

Is it hard to cover all types inject via block list, I think

[caishunfeng]

Is it hard to cover all types inject via block list, I think

You mean whitelist?

[EricGao888]

Is it hard to cover all types inject via block list, I think

If attackers try to inject code, I think it is hardly possible for them to bypass using ().[].

[rickchengx]

LGTM

[caishunfeng]

Maybe it's better to add the black keys in common config? WDYT? @zhongjiajie @EricGao888

[zhongjiajie]

Is it hard to cover all types inject via block list, I think

If attackers try to inject code, I think it is hardly possible for them to bypass using ().[].

Can they use encode and decode libs to bypass?

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 39.09%. Comparing base (faa794c) to head (336ea34).

❗ Current head 336ea34 differs from pull request most recent head cd39586. Consider uploading reports for the commit cd39586 to get more accurate results

Additional details and impacted files

@@            Coverage Diff            @@
##                dev   #15680   +/-   ##
=========================================
  Coverage     39.09%   39.09%           
  Complexity     4851     4851           
=========================================
  Files          1316     1316           
  Lines         44963    44963           
  Branches       4810     4810           
=========================================
  Hits          17579    17579           
  Misses        25485    25485           
  Partials       1899     1899           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[EricGao888]

Maybe it's better to add the black keys in common config? WDYT? @zhongjiajie @EricGao888

I think current solution in this PR (hard-coded black key) is good enough. If we make the black keys configurable, we also need to add comments above the config to warn users of this risk.

[caishunfeng]

Maybe it's better to add the black keys in common config? WDYT? @zhongjiajie @EricGao888

I think current solution in this PR (hard-coded black key) is good enough. If we make the black keys configurable, we also need to add comments above the config to warn users of this risk.

OK

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud