java_binary.jvm_flags allows Bash injection

[laszlocsomor]

Description of the problem / feature request:

On Linux/macOS, where java_binary uses a Bash stub script to start the JVM (in contrast to Windows where we use a C++ binary instead of the Bash stub), Bazel embeds the value of java_binary.jvm_flags directly into the stub script.

The intent is to support Bash quoting so the user can pass JVM flags like:

java_binary(
  ...
  jvm_flags = ["-Duser.name='Jane Doe'"],
)

The probably unintended consequence is, the user can also pass this:

java_binary(
  ...
  jvm_flags = ["-Duser.name='`date`'"],
)

which will dutifully pass the current date to the JVM.

This is arguably a bug.

Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

BUILD file:

java_binary(
    name = "helloarg",
    srcs = ["HelloArg.java"],
    main_class = "HelloArg",
    jvm_flags = ["-Duser.name=\"$(COMPILATION_MODE)`date`\\\\\"\ '\\\\\"Ada Lovelace'"],
)

HelloArg.java:

public class HelloArg {
  public static void main(String[] args) {
    System.out.printf("Hello %s\n", System.getProperty("user.name"));
  }
}

Output:

$ bazel run //:helloarg
...
Hello fastbuildFri Jan 11 17:37:25 CET 2019\ \\"Ada Lovelace

What operating system are you running Bazel on?

Linux

What's the output of bazel info release?

0.21

Have you found anything relevant by searching the web?

Found this while fixing #7072.

[sgowroji]

Hi there! We're doing a clean up of old issues and will be closing this one. Please reopen if you’d like to discuss anything further. We’ll respond as soon as we have the bandwidth/resources to do so.