{"record":{"id":"362016e80d89dc95","repo":"pentaho/pentaho-kettle","slug":"potential-code-injection-detected-in-s-s","errorCode":null,"errorMessage":"Potential code injection detected in %s: %s","messagePattern":"Potential code injection detected in (.+?): (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"plugins/avro-format/core/src/main/java/org/pentaho/di/trans/steps/avro/AvroSchemaValidator.java","lineNumber":119,"sourceCode":"    }\n  }\n\n  /**\n   * Checks a string for injection patterns.\n   * \n   * @param content the content to check\n   * @param fieldName the name of the field being checked (for error messages)\n   * @throws IllegalArgumentException if injection patterns are found\n   */\n  private static void checkForInjectionPatterns(String content, String fieldName) \n      throws IllegalArgumentException {\n    if (content == null || content.isEmpty()) {\n      return;\n    }\n\n    for (Pattern pattern : INJECTION_PATTERNS) {\n      if (pattern.matcher(content).find()) {\n        throw new IllegalArgumentException(\n          String.format(\"Potential code injection detected in %s: %s\", fieldName, \n            \"schema contains suspicious code patterns\"));\n      }\n    }\n  }\n\n  /**\n   * Sanitizes a schema by removing or neutralizing suspicious patterns.\n   * This is a more lenient approach than strict validation.\n   * \n   * @param schemaString the schema JSON string to sanitize\n   * @return the sanitized schema string\n   */\n  public static String sanitizeSchema(String schemaString) {\n    if (schemaString == null || schemaString.isEmpty()) {\n      return schemaString;\n    }\n","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/avro-format/core/src/main/java/org/pentaho/di/trans/steps/avro/AvroSchemaValidator.java#L101-L137","documentation":"AvroSchemaValidator.checkForInjectionPatterns scans schema content strings against a list of suspicious regex patterns (code-injection signatures) and throws this IllegalArgumentException naming the offending field when a pattern matches. This is a security guard against malicious Avro schemas that embed executable-looking payloads.","triggerScenarios":"A schema field value (checked via validateSchemaNode → checkForInjectionPatterns) matches one of the INJECTION_PATTERNS regexes — e.g. strings containing script/exec/eval-like constructs or template injection signatures.","commonSituations":"Schemas from untrusted third parties containing suspicious strings; legitimate field names/docs/comments that accidentally match a pattern (false positive); a schema built by string-concatenating untrusted user input.","solutions":["The message names the field (%s) — inspect that field's value and remove/escape the pattern-matching content.","If the match is a false positive in a trusted schema, rephrase the field value (e.g. remove lookalike code snippets from doc strings).","Only accept schemas from trusted sources; never build schema JSON by concatenating raw user input.","Review the INJECTION_PATTERNS list to understand which exact pattern matched and why."],"exampleFix":"// before\n{\"name\": \"f\", \"doc\": \"use eval(payload) to decode\"}\n// after\n{\"name\": \"f\", \"doc\": \"decodes the payload\"}","handlingStrategy":"try-catch","validationCode":"// Pre-scan schema text with your own copy of the forbidden patterns before submitting\njava.util.regex.Pattern P = java.util.regex.Pattern.compile(\"(?i)(eval|exec|script\\\\s*:)\");\nif (P.matcher(schemaString).find()) throw new IllegalArgumentException(\"Schema contains suspicious content\");","typeGuard":null,"tryCatchPattern":"try {\n  AvroSchemaValidator.validateSchema(schemaString);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().startsWith(\"Potential code injection detected\")) {\n    String field = e.getMessage().split(\":\")[0].replace(\"Potential code injection detected in \", \"\").trim();\n    logger.warn(\"Suspicious content in schema field: \" + field);\n  }\n  throw e;\n}","preventionTips":["Only accept Avro schemas from trusted sources.","Never build schema JSON by concatenating untrusted user input.","Keep doc/description strings free of code-like snippets that trip injection regexes."],"tags":["avro","security","injection","schema-validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}