feat(java_opts): replace eval with shell-free javaexec launcher (#1301)

Remove `eval "exec java $JAVA_OPTS ..."` from all container start commands.
Replace with a two-layer approach:
- Pure-bash `_expand_env_vars` in profile.d assembles JAVA_OPTS from .opts files,
  expanding $VAR/${VAR} references without executing command substitutions.
- Shell-free `javaexec` binary tokenizes JAVA_OPTS at JVM launch (POSIX word-split
  + quote-removal, no globbing, no $(...) execution) and execs the JVM directly.

User JAVA_OPTS from the environment are also expanded ($VAR/${VAR} only) and
warned about if they contain $(...) or backtick command substitutions.

Closes #1301

Author: stokpop

.gitignore

@@ -15,6 +15,7 @@ tmp/
 .cache/
 bin/detect
 bin/finalize
+bin/javaexec
 bin/release
 bin/supply
 /*.md

docs/framework-ordering.md

@@ -94,6 +94,16 @@ This ensures:
 2. **Container Security Provider runs BEFORE JRebel** (07 < 20)
 3. **User JAVA_OPTS override everything** (99 runs last)
 
+> **Note (safe expansion):** the snippet above is simplified. The real
+> `00_java_opts.sh` does **not** use `eval`. It expands only `$VAR` / `${VAR}`
+> references in `.opts` content via a pure-bash expander, so embedded command
+> substitutions (`$(...)`, backticks) are never executed. The one trusted
+> substitution the buildpack emits, `-XX:ActiveProcessorCount=$(nproc)`, is
+> resolved explicitly at runtime; any other surviving `$(...)` triggers a
+> warning. At launch the JVM is started through the shell-free `javaexec`
+> launcher (`$DEPS_DIR/<idx>/bin/javaexec`), which tokenizes `JAVA_OPTS`
+> without re-invoking a shell, rather than `eval "exec java $JAVA_OPTS"`.
+
 ## Critical Ordering Dependencies
 
 ### Container Security Provider (Priority 17, Line 51)

manifest.yml

@@ -9,6 +9,7 @@ include_files:
 - bin/compile
 - bin/detect
 - bin/finalize
+- bin/javaexec
 - bin/release
 - bin/supply
 - manifest.yml

src/integration/java_main_test.go

@@ -126,7 +126,7 @@ func testJavaMain(platform switchblade.Platform, fixtures string) func(*testing.
 
 				// Verify SAPMachine JRE was installed from manifest
 				Expect(logs.String()).To(ContainSubstring("Java Buildpack"))
-				Expect(logs.String()).To(ContainSubstring("Installing SAP Machine"))
+				Expect(logs.String()).To(ContainSubstring("Installing SapMachine"))
 				Expect(logs.String()).To(ContainSubstring("17."))
 			})
 		})

src/integration/tomcat_test.go

@@ -171,7 +171,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
 				Expect(logs.String()).To(ContainSubstring("Installing OpenJDK (8."))
-				Expect(logs.String()).To(ContainSubstring("Tomcat 9"))
+				Expect(logs.String()).To(ContainSubstring("Installed Tomcat (9."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 
@@ -185,7 +185,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
 				Expect(logs.String()).To(ContainSubstring("Installing OpenJDK (11."))
-				Expect(logs.String()).To(ContainSubstring("Tomcat 9"))
+				Expect(logs.String()).To(ContainSubstring("Installed Tomcat (9."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 
@@ -198,7 +198,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
 				Expect(logs.String()).To(ContainSubstring("Installing OpenJDK (17."))
-				Expect(logs.String()).To(ContainSubstring("Tomcat 9"))
+				Expect(logs.String()).To(ContainSubstring("Installed Tomcat (9."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 
@@ -224,7 +224,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
 				Expect(logs.String()).To(ContainSubstring("Installing OpenJDK (11."))
-				Expect(logs.String()).To(ContainSubstring("Tomcat 10"))
+				Expect(logs.String()).To(ContainSubstring("Installed Tomcat (10."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 
@@ -237,7 +237,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
 				Expect(logs.String()).To(ContainSubstring("Installing OpenJDK (17."))
-				Expect(logs.String()).To(ContainSubstring("Tomcat 10"))
+				Expect(logs.String()).To(ContainSubstring("Installed Tomcat (10."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 		})
@@ -258,7 +258,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
 				Expect(logs.String()).To(ContainSubstring("Installing OpenJDK (17."))
-				Expect(logs.String()).To(ContainSubstring("Tomcat 10.1."))
+				Expect(logs.String()).To(ContainSubstring("Installed Tomcat (10.1."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 		})
@@ -371,7 +371,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
-				Expect(logs.String()).To(ContainSubstring("Installing SAP Machine (17."))
+				Expect(logs.String()).To(ContainSubstring("Installing SapMachine (17."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 
@@ -384,7 +384,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
-				Expect(logs.String()).To(ContainSubstring("Installing SAP Machine (21."))
+				Expect(logs.String()).To(ContainSubstring("Installing SapMachine (21."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 
@@ -397,7 +397,7 @@ func testTomcat(platform switchblade.Platform, fixtures string) func(*testing.T,
 
 				Expect(err).NotTo(HaveOccurred(), logs.String)
 
-				Expect(logs.String()).To(ContainSubstring("Installing SAP Machine (25."))
+				Expect(logs.String()).To(ContainSubstring("Installing SapMachine (25."))
 				Eventually(deployment).Should(matchers.Serve(ContainSubstring("OK")))
 			})
 		})

src/java/containers/container.go

@@ -127,6 +127,24 @@ func (r *Registry) RegisterStandardContainers() {
 	r.Register(NewJavaMainContainer(r.context))
 }
 
+// JavaExecCommand builds a start command of the form:
+//
+//	exec $DEPS_DIR/<idx>/bin/javaexec "$JAVA_HOME/bin/java" <javaArgs>
+//
+// The javaexec launcher reads JAVA_OPTS from the environment and tokenizes it
+// without a shell, so glob characters, quotes, and shell metacharacters in
+// user-provided JAVA_OPTS are never expanded or executed. This replaces the
+// previous `eval "exec $JAVA_HOME/bin/java $JAVA_OPTS <javaArgs>"` form, which
+// let the shell glob-expand $JAVA_OPTS and execute embedded command
+// substitutions.
+//
+// javaArgs are buildpack-generated (jar paths, Main-Class, classpath, and
+// shell expansions like ${CLASSPATH} or BOOT-INF/lib/*) and are placed on a
+// normal command line, where the shell expands them exactly as before.
+func JavaExecCommand(depsIdx, javaArgs string) string {
+	return `exec $DEPS_DIR/` + depsIdx + `/bin/javaexec "$JAVA_HOME/bin/java" ` + javaArgs
+}
+
 // This script is used to process the CLASSPATH assembled from various framework scripts sourced from profile.d
 // to further create symlinks to the corresponding framework dependencies in WEB-INF/lib, BOOT-INF/lib and where ever
 // needed thus they are available for application classloading

src/java/containers/java_main.go

@@ -286,19 +286,20 @@ func (j *JavaMainContainer) Release() (string, error) {
 
 	args := ""
 	if cfg.Arguments != "" {
+		// Passed through as-is onto the start command line. The command is parsed
+		// once by the shell at launch (no eval), so any quoting in the arguments is
+		// applied exactly once, like a normal shell command line.
 		args = " " + cfg.Arguments
 	}
 
 	// JBP_CONFIG_JAVA_MAIN java_main_class takes precedence over manifest Main-Class.
 	// Use classpath mode so the configured class is actually invoked (not the manifest's).
 	if cfg.JavaMainClass != "" {
-		return fmt.Sprintf("eval exec $JAVA_HOME/bin/java $JAVA_OPTS -cp ${CLASSPATH}${CONTAINER_SECURITY_PROVIDER:+:$CONTAINER_SECURITY_PROVIDER} %s%s", cfg.JavaMainClass, args), nil
+		return JavaExecCommand(j.context.Stager.DepsIdx(), fmt.Sprintf("-cp ${CLASSPATH}${CONTAINER_SECURITY_PROVIDER:+:$CONTAINER_SECURITY_PROVIDER} %s%s", cfg.JavaMainClass, args)), nil
 	}
 
 	if j.jarFile != "" {
-		// JAR has its own Main-Class in the manifest — java -jar handles it
-		// Use eval to properly handle backslash-escaped values in $JAVA_OPTS (Ruby buildpack parity)
-		return fmt.Sprintf("eval exec $JAVA_HOME/bin/java $JAVA_OPTS -jar %s%s", j.jarFile, args), nil
+		return JavaExecCommand(j.context.Stager.DepsIdx(), fmt.Sprintf("-jar %s%s", j.jarFile, args)), nil
 	}
 
 	// Classpath mode: need an explicit main class
@@ -311,6 +312,5 @@ func (j *JavaMainContainer) Release() (string, error) {
 		j.context.Log.Debug("Main Class %s found in JAVA_MAIN_CLASS", mainClass)
 	}
 
-	// Use eval to properly handle backslash-escaped values in $JAVA_OPTS (Ruby buildpack parity)
-	return fmt.Sprintf("eval exec $JAVA_HOME/bin/java $JAVA_OPTS -cp ${CLASSPATH}${CONTAINER_SECURITY_PROVIDER:+:$CONTAINER_SECURITY_PROVIDER} %s%s", mainClass, args), nil
+	return JavaExecCommand(j.context.Stager.DepsIdx(), fmt.Sprintf("-cp ${CLASSPATH}${CONTAINER_SECURITY_PROVIDER:+:$CONTAINER_SECURITY_PROVIDER} %s%s", mainClass, args)), nil
 }

src/java/containers/java_main_test.go

@@ -154,6 +154,13 @@ var _ = Describe("Java Main Container", func() {
 	})
 
 	Describe("Release", func() {
+		expectSafeLaunch := func(cmd string) {
+			Expect(cmd).To(ContainSubstring("/bin/javaexec"))
+			Expect(cmd).To(ContainSubstring(`"$JAVA_HOME/bin/java"`))
+			Expect(cmd).NotTo(ContainSubstring("eval"))
+			Expect(cmd).NotTo(ContainSubstring("$JAVA_OPTS"))
+		}
+
 		Context("with JAR file", func() {
 			BeforeEach(func() {
 				Expect(createJar(
@@ -278,6 +285,78 @@ var _ = Describe("Java Main Container", func() {
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cmd).To(ContainSubstring("--foo=bar"))
 			})
+
+			It("passes double quotes in arguments through unescaped", func() {
+				os.Setenv("JBP_CONFIG_JAVA_MAIN", `{arguments: "--spring.datasource.url=\"jdbc:h2:mem:test\""}`)
+				Expect(createJar(
+					filepath.Join(buildDir, "app.jar"),
+					"Manifest-Version: 1.0\nMain-Class: com.example.Main\n",
+				)).To(Succeed())
+				container.Detect()
+				cmd, err := container.Release()
+				Expect(err).NotTo(HaveOccurred())
+				// No eval: the start command is parsed once by the shell, which
+				// consumes the quotes, so they must NOT be backslash-escaped.
+				Expect(cmd).To(ContainSubstring(`--spring.datasource.url="jdbc:h2:mem:test"`))
+			})
+		})
+
+		// Regression tests for issue #1301: start command must use the javaexec
+		// launcher and keep $JAVA_OPTS out of the command, so glob chars in
+		// JAVA_OPTS are never expanded by the shell.
+		Context("with JAR file (javaexec launch)", func() {
+			BeforeEach(func() {
+				Expect(createJar(
+					filepath.Join(buildDir, "app.jar"),
+					"Manifest-Version: 1.0\nMain-Class: com.example.Main\n",
+				)).To(Succeed())
+				container.Detect()
+			})
+
+			It("uses javaexec launcher and omits $JAVA_OPTS from the command", func() {
+				cmd, err := container.Release()
+				Expect(err).NotTo(HaveOccurred())
+				expectSafeLaunch(cmd)
+			})
+		})
+
+		Context("with JAVA_MAIN_CLASS env variable (javaexec launch)", func() {
+			BeforeEach(func() {
+				os.Setenv("JAVA_MAIN_CLASS", "com.example.Main")
+				os.WriteFile(filepath.Join(buildDir, "Main.class"), []byte("fake"), 0644)
+				container.Detect()
+			})
+
+			AfterEach(func() {
+				os.Unsetenv("JAVA_MAIN_CLASS")
+			})
+
+			It("uses javaexec launcher and omits $JAVA_OPTS from the command", func() {
+				cmd, err := container.Release()
+				Expect(err).NotTo(HaveOccurred())
+				expectSafeLaunch(cmd)
+			})
+		})
+
+		Context("with JBP_CONFIG_JAVA_MAIN java_main_class (javaexec launch)", func() {
+			BeforeEach(func() {
+				os.Setenv("JBP_CONFIG_JAVA_MAIN", "{java_main_class: com.example.Main}")
+				Expect(createJar(
+					filepath.Join(buildDir, "app.jar"),
+					"Manifest-Version: 1.0\nMain-Class: com.example.Main\n",
+				)).To(Succeed())
+				container.Detect()
+			})
+
+			AfterEach(func() {
+				os.Unsetenv("JBP_CONFIG_JAVA_MAIN")
+			})
+
+			It("uses javaexec launcher and omits $JAVA_OPTS from the command", func() {
+				cmd, err := container.Release()
+				Expect(err).NotTo(HaveOccurred())
+				expectSafeLaunch(cmd)
+			})
 		})
 
 		Context("without main class or JAR", func() {
@@ -351,6 +430,7 @@ var _ = Describe("Java Main Container", func() {
 				Expect(cmd).To(ContainSubstring("."))
 			})
 		})
+
 	})
 
 	Describe("Finalize", func() {

src/java/containers/play.go

@@ -548,8 +548,9 @@ func (p *PlayContainer) Release() (string, error) {
 				libPath = filepath.ToSlash(relPath)
 			}
 		}
-		// Use eval to properly handle backslash-escaped values in $JAVA_OPTS (Ruby buildpack parity)
-		cmd = fmt.Sprintf("eval exec java $JAVA_OPTS -cp $HOME/%s/* play.core.server.NettyServer $HOME", libPath)
+		// JAVA_OPTS is applied by the javaexec launcher, which tokenizes it
+		// without a shell (no glob/word-splitting/command execution).
+		cmd = fmt.Sprintf(`exec $DEPS_DIR/%s/bin/javaexec "$JAVA_HOME/bin/java" -cp $HOME/%s/* play.core.server.NettyServer $HOME`, p.context.Stager.DepsIdx(), libPath)
 	}
 
 	p.context.Log.Debug("Play Framework release command: %s", cmd)

src/java/containers/play_test.go

@@ -185,7 +185,9 @@ var _ = Describe("Play Container", func() {
 			It("returns correct java command", func() {
 				cmd, err := container.Release()
 				Expect(err).NotTo(HaveOccurred())
-				Expect(cmd).To(ContainSubstring("java $JAVA_OPTS -cp"))
+				Expect(cmd).To(ContainSubstring(`/bin/javaexec "$JAVA_HOME/bin/java" -cp`))
+				Expect(cmd).NotTo(ContainSubstring("eval"))
+				Expect(cmd).NotTo(ContainSubstring("$JAVA_OPTS"))
 				Expect(cmd).To(ContainSubstring("play.core.server.NettyServer $HOME"))
 			})
 		})
@@ -201,7 +203,9 @@ var _ = Describe("Play Container", func() {
 			It("returns correct java command", func() {
 				cmd, err := container.Release()
 				Expect(err).NotTo(HaveOccurred())
-				Expect(cmd).To(ContainSubstring("java $JAVA_OPTS -cp"))
+				Expect(cmd).To(ContainSubstring(`/bin/javaexec "$JAVA_HOME/bin/java" -cp`))
+				Expect(cmd).NotTo(ContainSubstring("eval"))
+				Expect(cmd).NotTo(ContainSubstring("$JAVA_OPTS"))
 				Expect(cmd).To(ContainSubstring("play.core.server.NettyServer $HOME"))
 			})
 		})