Claude-generated mock-server code evaluated attacker-controlled request expressions with the full Java bridge, enabling remote code execution.

+ * Copyright 2025 Karate Labs Inc.+ *+ * Permission is hereby granted, free of charge, to any person obtaining a copy+ * of this software and associated documentation files (the "Software"), to deal+ * in the Software without restriction, including without limitation the rights+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell+ * copies of the Software, and to permit persons to whom the Software is+ * furnished to do so, subject to the following conditions:+ *+ * The above copyright notice and this permission notice shall be included in+ * all copies or substantial portions of the Software.+ *+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN+ * THE SOFTWARE.+ */+package io.karatelabs.core;++import io.karatelabs.common.FileUtils;+import io.karatelabs.common.Resource;+import org.slf4j.Logger;+import org.slf4j.LoggerFactory;++import javax.net.ssl.*;+import java.io.ByteArrayInputStream;+import java.io.InputStream;

+ * Factory for creating SSLContext instances from SslConfig.+ */+public class SslContextFactory {++    private static final Logger logger = LoggerFactory.getLogger(SslContextFactory.class);++    /**+     * Create an SSLContext for client use (connecting to HTTPS servers).+     */+    public static SSLContext createClientContext(SslConfig config) {+        try {+            if (config.isTrustAll()) {+                return createTrustAllContext(config.getAlgorithm());+            }++            TrustManager[] trustManagers = loadTrustManagers(config);+            KeyManager[] keyManagers = loadKeyManagers(config);++            SSLContext ctx = SSLContext.getInstance(config.getAlgorithm());+            ctx.init(keyManagers, trustManagers, new SecureRandom());+            return ctx;+        } catch (Exception e) {+            throw new RuntimeException("failed to create client SSL context: " + e.getMessage(), e);+        }+    }++    /**+     * Create an SSLContext for server use (accepting HTTPS connections).+     */+    public static SSLContext createServerContext(SslConfig config) {+        try {+            if (config.getCertPath() == null) {+                // Generate self-signed certificate+                return CertificateGenerator.generateSelfSigned();+            }+            return loadFromPem(config.getCertPath(), config.getKeyPath(), config.getAlgorithm());+        } catch (Exception e) {+            throw new RuntimeException("failed to create server SSL context: " + e.getMessage(), e);+        }+    }++    /**+     * Create a trust-all SSLContext (accepts any certificate).

+ *+ * Permission is hereby granted, free of charge, to any person obtaining a copy+ * of this software and associated documentation files (the "Software"), to deal+ * in the Software without restriction, including without limitation the rights+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell+ * copies of the Software, and to permit persons to whom the Software is+ * furnished to do so, subject to the following conditions:+ *+ * The above copyright notice and this permission notice shall be included in+ * all copies or substantial portions of the Software.+ *+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN+ * THE SOFTWARE.+ */+package io.karatelabs.core;++import java.util.Map;++/**+ * SSL/TLS configuration for both client and server contexts.+ * <p>+ * Client configuration (for HTTP client):+ * <ul>+ *   <li>trustAll - Trust all server certificates (for self-signed)</li>+ *   <li>keyStore/keyStorePassword/keyStoreType - Client certificate for mTLS</li>+ *   <li>trustStore/trustStorePassword/trustStoreType - Custom trust store</li>+ * </ul>+ * <p>+ * Server configuration (for mock server):+ * <ul>+ *   <li>certPath - PEM certificate file path</li>+ *   <li>keyPath - PEM private key file path</li>+ *   <li>clientAuth - Require client certificate (mTLS)</li>+ * </ul>+ */+public class SslConfig {++    // Trust configuration (client)+    private boolean trustAll;+    private String trustStore;+    private String trustStorePassword;+    private String trustStoreType;++    // Client certificate (mTLS)+    private String keyStore;+    private String keyStorePassword;+    private String keyStoreType;++    // Algorithm+    private String algorithm = "TLS";++    // Server-side (for MockServer)+    private String certPath;+    private String keyPath;+    private boolean clientAuth;+    private String trustStorePath; // For server-side client cert validation++    /**+     * Create a trust-all configuration (for self-signed certificates).+     */+    public static SslConfig trustAll() {+        SslConfig config = new SslConfig();+        config.setTrustAll(true);+        return config;+    }++    /**+     * Create an SslConfig from a map (for karate.configure('ssl', {...})).+     */+    @SuppressWarnings("unchecked")+    public static SslConfig fromMap(Map<String, Object> map) {+        SslConfig config = new SslConfig();++        if (map.containsKey("trustAll")) {+            config.setTrustAll(Boolean.TRUE.equals(map.get("trustAll")));+        }++        if (map.containsKey("keyStore")) {+            config.setKeyStore((String) map.get("keyStore"));+        }

+ *+ * Permission is hereby granted, free of charge, to any person obtaining a copy+ * of this software and associated documentation files (the "Software"), to deal+ * in the Software without restriction, including without limitation the rights+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell+ * copies of the Software, and to permit persons to whom the Software is+ * furnished to do so, subject to the following conditions:+ *+ * The above copyright notice and this permission notice shall be included in+ * all copies or substantial portions of the Software.+ *+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN+ * THE SOFTWARE.+ */+package io.karatelabs.core;++import io.karatelabs.gherkin.Feature;+import io.karatelabs.io.http.HttpServer;+import io.karatelabs.js.SimpleObject;+import org.slf4j.Logger;+import org.slf4j.LoggerFactory;++import java.util.ArrayList;+import java.util.List;+import java.util.Map;++/**+ * Public API for creating mock servers from feature files.+ * <p>+ * Usage:+ * <pre>+ * MockServer server = MockServer.feature("api.feature")+ *     .port(8080)+ *     .arg(Map.of("key", "value"))+ *     .start();+ *+ * // ... use server ...+ *+ * server.stop();+ * </pre>+ */+public class MockServer implements SimpleObject {++    private static final Logger logger = LoggerFactory.getLogger(MockServer.class);++    private final HttpServer httpServer;+    private final MockHandler handler;+    private final int port;++    private MockServer(HttpServer httpServer, MockHandler handler, int port) {+        this.httpServer = httpServer;+        this.handler = handler;+        this.port = port;+    }++    /**+     * Create a builder for a mock server from a feature file path.+     */+    public static Builder feature(String path) {+        return new Builder().feature(path);+    }++    /**+     * Create a builder for a mock server from a parsed Feature.+     */+    public static Builder feature(Feature feature) {+        return new Builder().feature(feature);+    }++    /**+     * Create a builder for a mock server from a Resource.+     */+    public static Builder feature(io.karatelabs.common.Resource resource) {+        return new Builder().feature(Feature.read(resource));+    }++    /**+     * Create a builder for a mock server from a feature string.+     * Useful for inline feature definitions in tests.+     */

+            Object enabled = evalKarateExpression(expr);+            runtime.getKarate().setJavaBridgeEnabled(Boolean.parseBoolean(String.valueOf(enabled)));+            return;+        }+        if (key.equals("requestExpressionsEnabled")) {+            // Opt a mock back in to evaluating embedded expressions in request-derived data+            // (off by default). Re-opens the injection surface - only for trusted mocks.+            Object enabled = evalKarateExpression(expr);+            runtime.setRequestExpressionsEnabled(Boolean.parseBoolean(String.valueOf(enabled)));+            return;+        }         if (key.equals("headers") || key.equals("cookies")) {             // v1 parity: `configure headers = obj` (and cookies) must hold a live             // reference to the source object so mutations made after the configure@@ -3174,6 +3189,13 @@ private Object processEmbeddedExpressions(Object value) {      * </ul>      */     private Object processEmbeddedExpressions(Object value, boolean lenient) {+        // Untrusted HTTP request data (Mock Server) must never be evaluated as embedded+        // expressions - returning it verbatim leaves any `#(...)` it carries as inert data.+        // Short-circuiting at the first request-derived container protects every nested value.+        // No-op for ordinary execution, where nothing is ever marked request-derived.+        if (runtime.isRequestDerived(value)) {+            return value;+        }         if (value instanceof Node) {             processXmlEmbeddedExpressions((Node) value);             return value;

+     // Debug support - step navigation     private List<Step> steps;     private int stepIndex;@@ -1290,6 +1300,51 @@ public KarateJs getKarate() {         return karate;     } +    /**+     * Whether a mock should evaluate embedded expressions found in request-derived data.+     * Off by default (request data is treated as inert data); a mock can opt in via the+     * {@code MockServer.Builder} flag or {@code configure requestExpressionsEnabled = true}.+     */+    public boolean isRequestExpressionsEnabled() {+        return requestExpressionsEnabled;+    }++    public void setRequestExpressionsEnabled(boolean requestExpressionsEnabled) {+        this.requestExpressionsEnabled = requestExpressionsEnabled;+    }++    /** Forget all request-derived values; called by the Mock Server at the start of each request. */+    public void clearRequestDerived() {+        if (!requestDerived.isEmpty()) {+            requestDerived.clear();+        }+    }++    /**+     * Deep-mark a value (and every nested Map/List) as having originated from an untrusted HTTP+     * request, so {@code processEmbeddedExpressions} will leave its {@code #(...)} strings inert.+     */+    public void markRequestDerived(Object value) {+        if (value instanceof Map<?, ?> map) {+            if (requestDerived.add(value)) { // add returns false if already present - stops cycles+                for (Object v : map.values()) {+                    markRequestDerived(v);+                }+            }+        } else if (value instanceof List<?> list) {+            if (requestDerived.add(value)) {+                for (Object v : list) {+                    markRequestDerived(v);+                }+            }+        }+    }++    /** True if the value was marked by {@link #markRequestDerived}. Free when nothing is marked. */+    public boolean isRequestDerived(Object value) {+        return !requestDerived.isEmpty() && requestDerived.contains(value);+    }+     /**      * Get the cookie jar for auto-sending cookies on subsequent requests.      * Returns a map of cookie name to cookie details (value, path, domain, etc.).

+        private boolean javaBridgeEnabled;+        private boolean requestExpressionsEnabled;          private Builder() {         }@@ -283,6 +285,31 @@ public Builder watch(boolean watch) {             return this;         } +        /**+         * Enable Java interop ({@code Java.type(...)}) for mock features. OFF by default: a+         * mock that assigns request-derived data (request/requestHeaders/requestParams) would+         * otherwise evaluate attacker-controlled embedded expressions with full Java access,+         * which is a remote code execution risk. Only enable for mocks that are not exposed to+         * untrusted clients and genuinely need Java interop. Individual features can also opt in+         * with {@code configure javaBridgeEnabled = true}.+         */+        public Builder javaBridgeEnabled(boolean javaBridgeEnabled) {+            this.javaBridgeEnabled = javaBridgeEnabled;+            return this;+        }++        /**+         * Evaluate embedded {@code #(...)} expressions found in request-derived data+         * (request/requestHeaders/requestParams). OFF by default: attacker-controlled request+         * data is treated as inert data, not Karate code. Only enable for trusted mocks that+         * intentionally template off request content. Individual features can also opt in with+         * {@code configure requestExpressionsEnabled = true}.+         */+        public Builder requestExpressionsEnabled(boolean requestExpressionsEnabled) {+            this.requestExpressionsEnabled = requestExpressionsEnabled;+            return this;+        }+         /**

+            this.requestExpressionsEnabled = requestExpressionsEnabled;