undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,58 @@
/*
* Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8282696
* @summary Verify message and cause handling of InvalidClassException
*/
import java.io.*;
import java.util.Objects;
public class TestIceConstructors {
public static void main(String... args) {
String reason = "reason";
Throwable cause = new RuntimeException();
testException(new InvalidClassException(reason),
reason, null);
testException(new InvalidClassException(reason, cause),
reason, cause);
testException(new InvalidClassException("prefix", reason, cause),
"prefix" + "; " + reason, cause);
}
private static void testException(InvalidClassException ice,
String expectedMessage,
Throwable expectedCause) {
var message = ice.getMessage();
if (!Objects.equals(message, expectedMessage)) {
throw new RuntimeException("Unexpected message " + message);
}
var cause = ice.getCause();
if (cause != expectedCause) {
throw new RuntimeException("Unexpected cause");
}
}
}

View file

@ -0,0 +1,220 @@
/*
* Copyright (c) 1998, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
* @bug 4093279
* @compile DefaultPackage.java
* @run main DefaultPackage
* @summary Raise InvalidClassException if 1st NonSerializable superclass' no-arg constructor is not accessible. This test verifies default package access.
*/
import java.io.*;
class DefaultPackagePublicConstructor {
public DefaultPackagePublicConstructor() {
}
};
class DefaultPackageProtectedConstructor {
protected DefaultPackageProtectedConstructor() {
}
};
class DefaultPackageDefaultAccessConstructor {
DefaultPackageDefaultAccessConstructor() {
}
};
class DefaultPackagePrivateConstructor {
private DefaultPackagePrivateConstructor() {
}
/* need to have at least one protected constructor to extend this class.*/
protected DefaultPackagePrivateConstructor(int i) {
}
};
class DefaultPublicSerializable
extends DefaultPackagePublicConstructor implements Serializable
{
private static final long serialVersionUID = 1L;
int field1 = 5;
};
class DefaultProtectedSerializable
extends DefaultPackageProtectedConstructor implements Serializable
{
private static final long serialVersionUID = 1L;
int field1 = 5;
};
class DefaultAccessSerializable
extends DefaultPackageDefaultAccessConstructor implements Serializable
{
private static final long serialVersionUID = 1L;
int field1 = 5;
};
@SuppressWarnings("serial") /* Incorrect declarations are being tested */
class DefaultPrivateSerializable
extends DefaultPackagePrivateConstructor implements Serializable
{
private static final long serialVersionUID = 1L;
int field1 = 5;
DefaultPrivateSerializable() {
super(1);
}
};
class ExternalizablePublicConstructor implements Externalizable {
private static final long serialVersionUID = 1L;
public ExternalizablePublicConstructor() {
}
public void writeExternal(ObjectOutput out) throws IOException {
}
public void readExternal(ObjectInput in)
throws IOException, ClassNotFoundException
{
}
};
@SuppressWarnings("serial") /* Incorrect declarations are being tested */
class ExternalizableProtectedConstructor implements Externalizable {
private static final long serialVersionUID = 1L;
protected ExternalizableProtectedConstructor() {
}
public void writeExternal(ObjectOutput out) throws IOException {
}
public void readExternal(ObjectInput in)
throws IOException, ClassNotFoundException
{
}
};
@SuppressWarnings("serial") /* Incorrect declarations are being tested */
class ExternalizableAccessConstructor implements Externalizable {
private static final long serialVersionUID = 1L;
ExternalizableAccessConstructor() {
}
public void writeExternal(ObjectOutput out) throws IOException {
}
public void readExternal(ObjectInput in)
throws IOException, ClassNotFoundException
{
}
};
@SuppressWarnings("serial") /* Incorrect declarations are being tested */
class ExternalizablePrivateConstructor implements Externalizable {
private static final long serialVersionUID = 1L;
private ExternalizablePrivateConstructor() {
}
public ExternalizablePrivateConstructor(int i) {
}
public void writeExternal(ObjectOutput out) throws IOException {
}
public void readExternal(ObjectInput in)
throws IOException, ClassNotFoundException
{
}
};
public class DefaultPackage {
public static void main(String args[])
throws IOException, ClassNotFoundException
{
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream out = new ObjectOutputStream(baos);
out.writeObject(new DefaultPublicSerializable());
out.writeObject(new DefaultProtectedSerializable());
out.writeObject(new DefaultAccessSerializable());
out.writeObject(new DefaultPrivateSerializable());
InputStream is = new ByteArrayInputStream(baos.toByteArray());
ObjectInputStream in = new ObjectInputStream(is);
/* (DefaultPublicSerializable) */ in.readObject();
/* (DefaultProtectedSerializable) */ in.readObject();
/* (DefaultAcccessSerializable) */ in.readObject();
try {
/* (DefaultPrivateSerializable) */ in.readObject();
throw new Error("Expected InvalidClassException reading DefaultPrivateSerialziable");
} catch (InvalidClassException e) {
}
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new ExternalizablePublicConstructor());
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
/* (ExternalizablePublicConstructor) */ in.readObject();
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new ExternalizableProtectedConstructor());
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
/* (ExternalizableProtectedConstructor) */ in.readObject();
throw new Error("Expected InvalidClassException reading ExternalizableProtectedConstructor");
} catch (InvalidClassException e) {
}
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new ExternalizableAccessConstructor());
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
/* (ExternalizableAccessConstructor) */ in.readObject();
throw new Error("Expected InvalidClassException reading ExternalizableAccessConstructor");
} catch (InvalidClassException e) {
}
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new ExternalizablePrivateConstructor(2));
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
/* (ExternalizablePrivateConstructor) */ in.readObject();
throw new Error("Expected InvalidClassException reading ExternalizablePrivateConstructor");
} catch (InvalidClassException e) {
}
out.close();
in.close();
}
}

View file

@ -0,0 +1,35 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @bug 4093279
*/
package NonSerializable;
public class PackageCtor {
PackageCtor() {
}
public PackageCtor(int l) {
}
};

View file

@ -0,0 +1,36 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @bug 4093279
*/
package NonSerializable;
public class PrivateCtor {
private PrivateCtor() {
}
/* need to have at least one protected constructor to extend this class.*/
public PrivateCtor(int i) {
}
};

View file

@ -0,0 +1,33 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @bug 4093279
*/
package NonSerializable;
public class ProtectedCtor {
protected ProtectedCtor() {
}
};

View file

@ -0,0 +1,33 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @bug 4093279
*/
package NonSerializable;
public class PublicCtor {
public PublicCtor() {
}
};

View file

@ -0,0 +1,33 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @bug 4093279
*/
package Serialize;
public class SamePackageCtor {
SamePackageCtor() {
}
};

View file

@ -0,0 +1,268 @@
/*
* Copyright (c) 1998, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @bug 4093279
* REMOVED test, build and run tag since could not get this to work.
* Test is run via shell script, run.sh.
*/
package Serialize;
import java.io.*;
class PublicSerializable
extends NonSerializable.PublicCtor implements Serializable
{
private static final long serialVersionUID = 1L;
int field1 = 5;
};
class ProtectedSerializable
extends NonSerializable.ProtectedCtor implements Serializable
{
private static final long serialVersionUID = 1L;
int field1 = 5;
};
class DifferentPackageSerializable
extends NonSerializable.PackageCtor implements Serializable
{
private static final long serialVersionUID = 1L;
int field1 = 5;
DifferentPackageSerializable() {
super(1);
}
};
class SamePackageSerializable
extends Serialize.SamePackageCtor implements Serializable
{
private static final long serialVersionUID = 1L;
SamePackageSerializable() {
}
};
class SamePackageProtectedCtor {
private static final long serialVersionUID = 1L;
protected SamePackageProtectedCtor() {
}
};
class SamePackageProtectedSerializable
extends Serialize.SamePackageProtectedCtor implements Serializable
{
private static final long serialVersionUID = 1L;
SamePackageProtectedSerializable() {
}
};
class SamePackagePrivateCtor {
private static final long serialVersionUID = 1L;
private SamePackagePrivateCtor() {
}
public SamePackagePrivateCtor(int l) {
}
};
class SamePackagePrivateSerializable
extends Serialize.SamePackagePrivateCtor implements Serializable
{
private static final long serialVersionUID = 1L;
SamePackagePrivateSerializable() {
super(1);
}
};
class PrivateSerializable
extends NonSerializable.PrivateCtor implements Serializable
{
private static final long serialVersionUID = 1L;
int field1 = 5;
PrivateSerializable() {
super(1);
}
};
class ExternalizablePublicCtor implements Externalizable {
private static final long serialVersionUID = 1L;
public ExternalizablePublicCtor() {
}
public void writeExternal(ObjectOutput out) throws IOException {
}
public void readExternal(ObjectInput in)
throws IOException, ClassNotFoundException
{
}
};
@SuppressWarnings("serial") /* Incorrect declarations are being tested */
class ExternalizableProtectedCtor implements Externalizable {
private static final long serialVersionUID = 1L;
protected ExternalizableProtectedCtor() {
}
public void writeExternal(ObjectOutput out) throws IOException {
}
public void readExternal(ObjectInput in)
throws IOException, ClassNotFoundException
{
}
};
@SuppressWarnings("serial") /* Incorrect declarations are being tested */
class ExternalizablePackageCtor implements Externalizable {
private static final long serialVersionUID = 1L;
ExternalizablePackageCtor() {
}
public void writeExternal(ObjectOutput out) throws IOException {
}
public void readExternal(ObjectInput in)
throws IOException, ClassNotFoundException
{
}
};
@SuppressWarnings("serial") /* Incorrect declarations are being tested */
class ExternalizablePrivateCtor implements Externalizable {
private static final long serialVersionUID = 1L;
private ExternalizablePrivateCtor() {
}
public ExternalizablePrivateCtor(int i) {
}
public void writeExternal(ObjectOutput out) throws IOException {
}
public void readExternal(ObjectInput in)
throws IOException, ClassNotFoundException
{
}
};
public class SubclassAcrossPackage {
public static void main(String args[])
throws IOException, ClassNotFoundException
{
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream out = new ObjectOutputStream(baos);
out.writeObject(new PublicSerializable());
out.writeObject(new ProtectedSerializable());
out.writeObject(new SamePackageSerializable());
out.writeObject(new SamePackageProtectedSerializable());
out.writeObject(new DifferentPackageSerializable());
InputStream is = new ByteArrayInputStream(baos.toByteArray());
ObjectInputStream in = new ObjectInputStream(is);
/* (PublicSerializable)*/ in.readObject();
/* (ProtectedSerializable) */ in.readObject();
/* (SamePackageSerializable) */ in.readObject();
/* (SamePackageProtectedSerializable) */ in.readObject();
try {
/* (DifferentPackageSerializable) */ in.readObject();
} catch (InvalidClassException e) {
}
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new PrivateSerializable());
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
/* (PrivateSerializable) */ in.readObject();
throw new Error("Expected InvalidClassException reading PrivateSerialziable");
} catch (InvalidClassException e) {
}
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new SamePackagePrivateSerializable());
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
/* (SamePackagePrivateSerializable) */ in.readObject();
throw new Error("Expected InvalidClassException reading PrivateSerialziable");
} catch (InvalidClassException e) {
}
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new ExternalizablePublicCtor());
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
/* (ExternalizablePublicCtor) */ in.readObject();
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new ExternalizableProtectedCtor());
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
/* (ExternalizableProtectedCtor) */ in.readObject();
throw new Error("Expected InvalidClassException reading ExternalizableProtectedCtor");
} catch (InvalidClassException e) {
}
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new ExternalizablePackageCtor());
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
/* (ExternalizablePackageCtor) */ in.readObject();
throw new Error("Expected InvalidClassException reading ExternalizablePackageCtor");
} catch (InvalidClassException e) {
}
in.close();
baos.reset();
out = new ObjectOutputStream(baos);
out.writeObject(new ExternalizablePrivateCtor(2));
in = new ObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
/* (ExternalizablePrivateCtor) */ in.readObject();
throw new Error("Expected InvalidClassException reading ExternalizablePrivateCtor");
} catch (InvalidClassException e) {
}
out.close();
in.close();
}
}

View file

@ -0,0 +1,40 @@
/*
* Copyright (c) 1998, 2000, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4093279
* @summary Validate accessibility checking to NonSerializable superclass constuctor.
* @library NonSerialize Serialize
* @compile NonSerialize/PrivateCtor.java NonSerialize/ProtectedCtor.java NonSerialize/PackageCtor.java NonSerialize/PublicCtor.java
* @compile Serialize/SubclassAcrossPackage.java Serialize/SamePackageCtor.java
* @run main Test
*/
import java.io.*;
import Serialize.SubclassAcrossPackage;
public class Test {
public static void main(String[] args)
throws IOException, ClassNotFoundException {
Serialize.SubclassAcrossPackage.main(args);
}
}