ANTLR4 Grammar Action Block Code Injection via OutputFile.java

#!/usr/bin/env bash
# CVE-2026-13500 Checker — ANTLR4 Tool (not runtime) presence & version
# Usage: bash check_cve_2026_13500.sh /path/to/project
# Exit codes: 0=PATCHED/NOT_AFFECTED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"
VULN_VERSIONS="4\.13\.[012]"
FOUND_TOOL=0
FOUND_VULN=0

echo "[*] CVE-2026-13500: Checking for antlr4-tool in $PROJECT_DIR"

# Check Maven pom.xml for antlr4-maven-plugin
while IFS= read -r -d '' pomfile; do
  if grep -q 'antlr4-maven-plugin' "$pomfile" 2>/dev/null; then
    FOUND_TOOL=1
    ver=$(grep -A5 'antlr4-maven-plugin' "$pomfile" | grep -oP '(?<=<version>)[^<]+' | head -1)
    if [[ -n "$ver" ]] && echo "$ver" | grep -qP "^${VULN_VERSIONS}$"; then
      echo "[!] VULNERABLE: $pomfile uses antlr4-maven-plugin version $ver"
      FOUND_VULN=1
    elif [[ -n "$ver" ]]; then
      echo "[+] $pomfile uses antlr4-maven-plugin version $ver (check manually)"
    else
      echo "[?] $pomfile references antlr4-maven-plugin but version not parsed"
    fi
  fi
done < <(find "$PROJECT_DIR" -name 'pom.xml' -print0 2>/dev/null)

# Check Gradle build files for antlr4 plugin or tool dependency
while IFS= read -r -d '' gradlefile; do
  if grep -qE '(antlr4|org\.antlr.*antlr4.*:4\.)' "$gradlefile" 2>/dev/null; then
    # Skip runtime-only references
    if grep -qE 'antlr4-runtime' "$gradlefile" && ! grep -qE 'antlr4[^-]' "$gradlefile"; then
      echo "[+] $gradlefile uses antlr4-runtime only — NOT AFFECTED"
      continue
    fi
    FOUND_TOOL=1
    ver=$(grep -oP 'antlr4[^-].*?:([0-9.]+)' "$gradlefile" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
    if [[ -n "$ver" ]] && echo "$ver" | grep -qP "^${VULN_VERSIONS}$"; then
      echo "[!] VULNERABLE: $gradlefile uses antlr4 tool version $ver"
      FOUND_VULN=1
    elif [[ -n "$ver" ]]; then
      echo "[+] $gradlefile uses antlr4 version $ver (check manually)"
    else
      echo "[?] $gradlefile references antlr4 but version not parsed"
    fi
  fi
done < <(find "$PROJECT_DIR" -name '*.gradle' -o -name '*.gradle.kts' -print0 2>/dev/null | tr '\n' '\0')

# Check pip / Python environments
if command -v pip &>/dev/null; then
  pipver=$(pip show antlr4-tools 2>/dev/null | grep -i '^Version:' | awk '{print $2}')
  if [[ -n "$pipver" ]]; then
    FOUND_TOOL=1
    if echo "$pipver" | grep -qP "^${VULN_VERSIONS}$"; then
      echo "[!] VULNERABLE: pip antlr4-tools version $pipver"
      FOUND_VULN=1
    else
      echo "[+] pip antlr4-tools version $pipver (check manually)"
    fi
  fi
fi

# Check for standalone antlr4 jar
while IFS= read -r -d '' jarfile; do
  if [[ "$jarfile" == *antlr4-4.13.[012]* ]] && [[ "$jarfile" != *runtime* ]]; then
    echo "[!] VULNERABLE: Found antlr4-tool jar: $jarfile"
    FOUND_TOOL=1
    FOUND_VULN=1
  fi
done < <(find "$PROJECT_DIR" -name 'antlr4-*.jar' -print0 2>/dev/null)

if [[ $FOUND_VULN -eq 1 ]]; then
  echo ""
  echo "VULNERABLE — antlr4-tool 4.13.0-4.13.2 detected."
  echo "NOTE: No vendor fix exists. Verify grammar files are from trusted, reviewed sources."
  exit 1
elif [[ $FOUND_TOOL -eq 0 ]]; then
  echo ""
  echo "PATCHED — No antlr4-tool dependency found (antlr4-runtime only is NOT affected)."
  exit 0
else
  echo ""
  echo "UNKNOWN — antlr4-tool found but version could not be confirmed as vulnerable."
  exit 2
fi