From 6a7074519b7ff8ea0a38959e237ed2e701290188 Mon Sep 17 00:00:00 2001
From: michail-melizanis-sonarsource <michail.melizanis@sonarsource.com>
Date: Wed, 13 May 2026 12:57:31 +0200
Subject: [PATCH] Add commons-text 1.9 with reachable CVE-2022-42889 call

Adds TemplateServlet that calls StringSubstitutor.replaceSystemProperties()
with user-controlled input, creating a direct reachable path to the
vulnerable function in commons-text 1.9 (Text4Shell, CVE-2022-42889).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 pom.xml                                       |  5 ++++
 .../security/servlet/TemplateServlet.java     | 27 +++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 src/main/java/demo/security/servlet/TemplateServlet.java

diff --git a/pom.xml b/pom.xml
index 59ded444..0ac5a163 100644
--- a/pom.xml
+++ b/pom.xml
@@ -31,6 +31,11 @@
       <artifactId>commons-io</artifactId>
       <version>2.11.0</version>
     </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-text</artifactId>
+      <version>1.9</version>
+    </dependency>
     <dependency>
       <groupId>commons-codec</groupId>
       <artifactId>commons-codec</artifactId>
diff --git a/src/main/java/demo/security/servlet/TemplateServlet.java b/src/main/java/demo/security/servlet/TemplateServlet.java
new file mode 100644
index 00000000..6f5b07a0
--- /dev/null
+++ b/src/main/java/demo/security/servlet/TemplateServlet.java
@@ -0,0 +1,27 @@
+package demo.security.servlet;
+
+import org.apache.commons.text.StringSubstitutor;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.io.PrintWriter;
+
+@WebServlet("/template")
+public class TemplateServlet extends HttpServlet {
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String template = request.getParameter("template");
+        // CVE-2022-42889: StringSubstitutor with user-controlled input allows
+        // arbitrary code execution via script/dns/url lookups
+        String result = StringSubstitutor.replaceSystemProperties(template);
+        response.setContentType("text/html");
+        PrintWriter out = response.getWriter();
+        out.print("<p>" + result + "</p>");
+        out.close();
+    }
+}