feat(java): add eval injection rule (CWE-95)

rules/java/lang/eval_using_user_input.yml

@@ -0,0 +1,39 @@
+imports:
+  - java_shared_lang_instance
+  - java_shared_lang_user_input
+patterns:
+  - pattern: |
+      $<ENGINE>.eval($<USER_INPUT>$<...>);
+    filters:
+      - variable: ENGINE
+        detection: java_lang_eval_using_user_input_script_engine
+      - variable: USER_INPUT
+        detection: java_shared_lang_user_input
+auxiliary:
+  - id: java_lang_eval_using_user_input_script_engine
+    patterns:
+      - pattern: $<ENGINE_MANAGER>.getEngineByName();
+        filters:
+          - variable: ENGINE_MANAGER
+            detection: java_shared_lang_instance
+            scope: cursor
+            filters:
+              - variable: JAVA_SHARED_LANG_INSTANCE_TYPE
+                regex: \A(javax\.script\.)?(ScriptEngineManager)\z
+languages:
+  - java
+metadata:
+  description: "Unsanitized user input in 'eval' type function"
+  remediation_message: |
+    ## Description
+    It is dangerous to use eval with user input, or to compile code with user-supplied data. Such practices can lead to command injection.
+
+    ## Remediations
+    ❌ Avoid using code execution methods with unsanitized user input.
+
+    ## Resources
+    - [OWASP Code injection explained](https://owasp.org/www-community/attacks/Code_Injection)
+  cwe_id:
+    - 95
+  id: java_lang_eval_using_user_input
+  documentation_url: https://docs.bearer.com/reference/rules/java_lang_eval_using_user_input

tests/java/lang/eval_using_user_input/test.js

@@ -0,0 +1,18 @@
+const {
+  createNewInvoker,
+  getEnvironment,
+} = require("../../../helper.js")
+const { ruleId, ruleFile, testBase } = getEnvironment(__dirname)
+
+describe(ruleId, () => {
+  const invoke = createNewInvoker(ruleId, ruleFile, testBase)
+
+  test("eval_using_user_input", () => {
+    const testCase = "main.java"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+})

tests/java/lang/eval_using_user_input/testdata/main.java

@@ -0,0 +1,24 @@
+import javax.script.ScriptEngine;
+import javax.script.ScriptEngineManager;
+import javax.script.ScriptException;
+
+public class Foo {
+  public static void bad(HttpServletRequest req, HttpServletResponse res) {
+    ScriptEngineManager manager = new ScriptEngineManager();
+    ScriptEngine engine = manager.getEngineByName("js");
+
+    String expression = "2 + 3 * " + req.getParameter("numUsers");
+
+    // bearer:expected java_lang_eval_using_user_input
+    Object result = engine.eval(expression);
+  }
+
+  public static void ok() {
+    ScriptEngineManager manager = new ScriptEngineManager();
+    ScriptEngine engine = manager.getEngineByName("js");
+
+    String expression = "2 + 3 * 5";
+
+    Object result = engine.eval(expression);
+  }
+}