This affects all Artemis users who test Java assignments. Ares is not required.
Students code that gets automatically tested can run arbitrary code in the container,
or arbitrary code on the machine of an assessor in case of manual correction.
The problem cannot be resolved easily in Ares itself. Use the Maven Enforcer Plugin as follows:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-enforcer-plugin</artifactId>
<version>3.0.0</version>
<executions>
<execution>
<id>enforce-no-student-code-in-trusted-packages</id>
<phase>process-classes</phase>
<goals>
<goal>enforce</goal>
</goals>
</execution>
</executions>
<configuration>
<rules>
<requireFilesDontExist>
<files>
</files>
</requireFilesDontExist>
</rules>
</configuration>
</plugin>
This fails the build if student classes reside in such packages that Ares trusts. Trusted packages added in Ares using @AddTrustedPackage
should be added as well.
If you have any questions or comments about this advisory:
See the assignment of Julius that passes the tests in TUM Artemis course: βTest - Praktikum: Grundlagen der Programmierung (Testkurs fΓΌr Tutoren) - Security Testsβ (if that still exists in 2022).
Also see #15 for almost the same problem.