engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

151
test/jdk/java/beans/Statement/ClassForName/ClassForName.java Normal file
View file

@ -0,0 +1,151 @@
/*
* Copyright (c) 2016, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.beans.Expression;
import java.beans.Statement;
/**
* @test
* @bug 8146313
* @run main/othervm ClassForName
*/
public final class ClassForName {
static boolean initialized;
static final String[] classes = {
"A.A", "java.lang.String", "ClassForName$Bean", "sun.awt.SunToolkit"
};
static final ClassLoader appl = new Object() {}.getClass().getClassLoader();
static final ClassLoader[] loaders = {
String.class.getClassLoader(), null, appl
};
static boolean[] inits = {false, true};
public static void main(final String[] args) throws Exception {
// Check that the Class.forName(name, boolean, classloader) is executed
// when requested via JavaBeans
simpleTest();
// Check that the Class.forName and Expression returns the same classes
for (final String cls : classes) {
complexTest1Args(cls);
for (final ClassLoader loader : loaders) {
for (final boolean init : inits) {
complexTest3Args(cls, loader, init);
}
}
}
}
private static void simpleTest() throws Exception {
// load the class without initialization
new Statement(Class.class, "forName", new Object[]{
"ClassForName$Bean", false, Bean.class.getClassLoader()
}).execute();
if (initialized) {
throw new RuntimeException("Should not be initialized");
}
// load the class and initialize it
new Statement(Class.class, "forName", new Object[]{
"ClassForName$Bean", true, Bean.class.getClassLoader()
}).execute();
if (!initialized) {
throw new RuntimeException("Should be initialized");
}
}
private static void complexTest1Args(final String cls) {
// load via standard Class.forName();
Class<?> classForName = null;
try {
classForName = Class.forName(cls);
} catch (final Exception ignored) {
}
// load via Expression.execute()
Class<?> classStatement = null;
try {
final Expression exp = new Expression(Class.class, "forName",
new Object[]{
cls
});
exp.execute();
classStatement = (Class<?>) exp.getValue();
} catch (final Exception ignored) {
}
if (classForName != classStatement) {
System.err.println(classForName);
System.err.println(classStatement);
throw new RuntimeException();
}
}
private static void complexTest3Args(final String cls,
final ClassLoader loader,
final boolean init) {
// load via standard Class.forName();
Class<?> classForName = null;
Class<?> excForName = null;
try {
classForName = Class.forName(cls, init, loader);
} catch (final Exception e) {
excForName = e.getClass();
}
// load via Expression.execute()
Class<?> classStatement = null;
Class<?> excStatement = null;
try {
final Expression exp = new Expression(Class.class, "forName",
new Object[]{
cls, init, loader
});
exp.execute();
classStatement = (Class<?>) exp.getValue();
} catch (final Exception e) {
excStatement = e.getClass();
}
if (classForName != classStatement) {
System.err.println(classForName);
System.err.println(classStatement);
throw new RuntimeException();
}
if (excForName != excStatement) {
System.err.println(excForName);
System.err.println(excStatement);
throw new RuntimeException();
}
}
public static final class Bean {
static {
initialized = true;
}
}
}

132
test/jdk/java/beans/Statement/Test4530962.java Normal file
View file

@ -0,0 +1,132 @@
/*
* Copyright (c) 2003, 2007, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4530962
* @summary Tests method search using parameter classes in Statement
* @author Mark Davidson
*/
import java.beans.Statement;
/**
* Ambiguous method signature should throw an exception.
* Statement should execute the most specific method.
*/
public class Test4530962 {
public static void main(String[] args) throws Exception {
try {
test(new A(), new Y(), new Y());
throw new Error("exception expected");
}
catch (NoSuchMethodException exception) {
// should throw an exception
}
catch (Exception exception) {
throw new Error("unexpected exception", exception);
}
test(new B(), new Y(), new Y());
test(new C(), new Z(), new Z());
test(new D(), new Z(), new Z());
test(new E(), new Z(), new Z());
}
private static void test(Object target, Object... params) throws Exception {
new Statement(target, "m", params).execute();
}
/**
* All ambiguous method declarations should fail.
*/
public static class A {
public void m(X x1, X x2) {
throw new Error("A.m(X,X) should not be called");
}
public void m(X x1, Y y2) {
throw new Error("A.m(X,Y) should not be called");
}
public void m(Y y1, X x2) {
throw new Error("A.m(Y,X) should not be called");
}
}
/**
* The most specific method in this case would be the second declaration.
*/
public static class B {
public void m(X x1, X x2) {
throw new Error("B.m(X,X) should not be called");
}
public void m(X x1, Y y2) {
// expected: B.m(X,Y) should be called
}
}
/**
* The most specific method in this case would be the first declaration.
*/
public static class C {
public void m(Y y1, Y y2) {
// expected: C.m(Y,Y) should be called
}
public void m(X x1, X x2) {
throw new Error("C.m(X,X) should not be called");
}
}
/**
* Same as the previous case but flip methods.
*/
public static class D {
public void m(X x1, X x2) {
throw new Error("D.m(X,X) should not be called");
}
public void m(Y y1, Y y2) {
// expected: D.m(Y,Y) should be called
}
}
/**
* The method should be called with (Z,Z).
*/
public static class E {
public void m(X x1, X x2) {
// expected: E.m(X,X) should be called
}
}
public static class X {
}
public static class Y extends X {
}
public static class Z extends Y {
}
}

67
test/jdk/java/beans/Statement/Test4653179.java Normal file
View file

@ -0,0 +1,67 @@
/*
* Copyright (c) 2003, 2007, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4653179
* @summary Tests string equality for Statement and Expression
* @author Mark Davidson
*/
import java.beans.Expression;
import javax.swing.JButton;
public class Test4653179 {
public static void main(String[] args) throws Exception {
String [] array = {"first string", "second one"};
Object valueInt = testInt(array, "get", 0);
if (!valueInt.equals(array[0]))
throw new Error("unexpected value: " + valueInt);
Object valueNew = testNew(array, "get", 1);
if (!valueNew.equals(array[1]))
throw new Error("unexpected value: " + valueNew);
valueInt = testInt(Class.class, "forName", "javax.swing.JButton");
if (!valueInt.equals(JButton.class))
throw new Error("unexpected value: " + valueInt);
valueNew = testNew(Class.class, "forName", "javax.swing.JButton");
if (!valueNew.equals(JButton.class))
throw new Error("unexpected value: " + valueNew);
testInt(JButton.class, "new");
testNew(JButton.class, "new");
}
private static Object testInt(Object target, String name, Object... args) throws Exception {
return new Expression(target, name, args).getValue();
}
private static Object testNew(Object target, String name, Object... args) throws Exception {
return testInt(target, new String(name), args); // non-intern string
}
}

45
test/jdk/java/beans/Statement/Test6707226.java Normal file
View file

@ -0,0 +1,45 @@
/*
* Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 6707226
* @summary Tests the value updating in Expression
* @author Sergey Malenkov
*/
import java.beans.Expression;
public class Test6707226 {
public static void main(String[] args) throws Exception {
Object value = new Object();
Expression expression = new Expression(value, Object.class, "new", null);
if (!value.equals(expression.getValue()))
throw new Error("the value is updated unexpectedly");
expression.execute();
if (value.equals(expression.getValue()))
throw new Error("the value is not updated as expected");
}
}

62
test/jdk/java/beans/Statement/Test6788531.java Normal file
View file

@ -0,0 +1,62 @@
/*
* Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 6788531
* @summary Tests public method lookup problem in Statement
* @author Sergey Malenkov
*/
import java.beans.Statement;
public class Test6788531 {
public static void main(String[] args) throws Exception {
new Statement(new Private(), "run", null).execute();
new Statement(new PrivateGeneric(), "run", new Object[] {"generic"}).execute();
}
public static class Public {
public void run() {
throw new Error("method is overridden");
}
}
static class Private extends Public {
public void run() {
System.out.println("default");
}
}
public static class PublicGeneric<T> {
public void run(T object) {
throw new Error("method is overridden");
}
}
static class PrivateGeneric extends PublicGeneric<String> {
public void run(String string) {
System.out.println(string);
}
}
}