engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

304
test/jdk/java/io/Serializable/subclass/AbstractObjectInputStream.java Normal file
View file

@ -0,0 +1,304 @@
/*
* Copyright (c) 1998, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
*
*/
import java.io.*;
/**
* This abstract class enables one to subclass ObjectInputStream
* for the purpose of re-implementing serialization while preserving the
* existing public serialization API. A complimentary subclass of
* AbstractObjectInputStream must also be implemented.<p>
*
* Since serialization must override java access rules in order to
* access private, protected and package accessible Serializable fields,
* only trusted classes are allowed to subclass AbstractObjectInputStream.
* Implementations of this
* class should protect themselves from being subclassed in a way that will
* provide access to object references and other sensitive info.
* Specifically, readObjectOverride() should be made final.
* <p>
*
* A subclass of AbstractObjectInputStream deserializes primitive data and
* objects previously written by a subclass of AbstractObjectOutputStream.
* The subclass ensures that the types of all objects in the graph created
* from the stream match the classes present in the Java Virtual Machine.
* Classes are loaded as required using the standard mechanisms. <p>
*
* Only objects that support the java.io.Serializable or
* java.io.Externalizable interface can be read from streams.
*
* The method <STRONG>readObjectOverride</STRONG> is used to read an object
* from the stream. Java's safe casting should be used to get the
* desired type. In Java, strings and arrays are objects and are
* treated as objects during serialization. When read with readObject()
* they need to be cast to the expected type.<p>
*
* Primitive data types can be read from the stream using the appropriate
* method on DataInput. <p>
*
* The default deserialization mechanism for objects restores the
* contents of each field to the value and type it had when it was written.
* References to other objects cause those
* objects to be read from the stream as necessary. Graphs of objects
* are restored correctly using a reference sharing mechanism. New
* objects are always allocated when deserializing, which prevents
* existing objects from being overwritten. <p>
*
* Reading an object is analogous to running the constructors of a new
* object. Memory is allocated for the object and initialized to zero
* (NULL). No-arg constructors are invoked for the first non-serializable
* super class and then the fields of the serializable classes are
* restored from the stream starting with the serializable class closest to
* java.lang.object and finishing with the object's most specifiec
* class. <p>
*
* Classes control how they are serialized by implementing either the
* java.io.Serializable or java.io.Externalizable interfaces.<P>
*
* Implementing the Serializable interface allows object serialization
* to save and restore the entire state of the object and it allows
* classes to evolve between the time the stream is written and the time it is
* read. It automatically traverses references between objects,
* saving and restoring entire graphs.
*
* Serializable classes that require special handling during the
* serialization and deserialization process should implement both
* of these methods:<p>
*
* <PRE>
* private void writeObject(java.io.ObjectOutputStream stream)
* throws IOException;
* private void readObject(java.io.ObjectInputStream stream)
* throws IOException, ClassNotFoundException;
* </PRE><p>
*
* The readObject method is responsible for reading and restoring the
* state of the object for its particular class using data written to
* the stream by the corresponding writeObject method. The method
* does not need to concern itself with the state belonging to its
* superclasses or subclasses. State is restored by reading data from
* the ObjectInputStream for the individual fields and making
* assignments to the appropriate fields of the object. Reading
* primitive data types is supported by DataInput. <p>
*
* Serialization does not read or assign values to the fields of any
* object that does not implement the java.io.Serializable interface.
* Subclasses of Objects that are not serializable can be
* serializable. In this case the non-serializable class must have an
* accessible no-arg constructor to allow its fields to be initialized.
* In this case it is the responsibility of the subclass to save and restore
* the state of the non-serializable class. It is frequently the case that
* the fields of that class are accessible (public, package, or
* protected) or that there are get and set methods that can be used
* to restore the state. <p>
*
* Implementing the Externalizable interface allows the object to
* assume complete control over the contents and format of the object's
* serialized form. The methods of the Externalizable interface,
* writeExternal and readExternal, are called to save and restore the
* objects state. When implemented by a class they can write and read
* their own state using all of the methods of ObjectOutput and
* ObjectInput. It is the responsibility of the objects to handle any
* versioning that occurs.
*
* @author Joe Fialli
*
* @see java.io.ObjectInputStream
* @see java.io.DataInput
* @see java.io.Serializable
* @see java.io.Externalizable
* @see java.io.ext.AbstractObjectOutputStream
* @since JDK1.2
*/
public abstract class AbstractObjectInputStream extends ObjectInputStream
{
protected InputStream in;
/**
* Create an ObjectInputStream that reads from the specified InputStream.<p>
*
* @exception StreamCorruptedException The version or magic number are incorrect.
* @exception IOException An exception occurred in the underlying stream.
*/
public AbstractObjectInputStream(InputStream in)
throws IOException, StreamCorruptedException
{
this.in = in;
}
public abstract void close() throws IOException;
/***************************************************************/
/* Read an object from the stream. */
/**
* Read an object from the ObjectInputStream.<p>
*
* NOTE: The override method of this class should have the modifier final.<p>
*
* Default deserializing for a class can be
* overriden by defining a readObject method for the Serializable class.
* Objects referenced by this object are read transitively so
* that a complete equivalent graph of objects is reconstructed by
* readObject. <p>
*
* The root object is completely restored when all of its fields
* and the objects it references are completely restored. At this
* point the object validation callbacks are executed in order
* based on their registered priorities. The callbacks are
* registered by objects (in the readObject special methods)
* as they are individually restored. <p>
*
* For security's sake, any overrides of this method should be final.
* Serialization typically needs to disable java access rules
* to serialize private, protected and package accessible Serializable
* fields. This method gets called for ALL Serializable objects.
*
* @exception java.lang.ClassNotFoundException Class of a serialized object
* cannot be found.
* @exception InvalidClassException Something is wrong with a class used by
* serialization.
* @exception StreamCorruptedException Control information in the
* stream is inconsistent.
* @exception OptionalDataException Primitive data was found in the
* stream instead of objects.
* @exception IOException Any of the usual Input/Output related exceptions.
*
* @see java.io.ObjectInputStream#resolveObject(Object)
* @see java.io.Resolvable
* @see java.io.Externalizable
* @see java.io.ObjectInputValidation
* @see #registerValidation(ObjectInputValidation, int)
* @see java.io.ObjectInputStream#resolveClass(ObjectStreamClass)
*/
protected Object readObjectOverride()
throws OptionalDataException, ClassNotFoundException, IOException {
return null;
}
/**
* Read the Serializable fields of the current object from this stream.<p>
*
* Note: The object being deserialized is not passed to this method.
* For security purposes, the initial implementation maintained
* the state of the last object to be read by readObject
* only allowed this method to be invoked for this object.<p>
*
* @exception NotActiveException Thrown if a readObject method is not
* active.
* @exception ClassNotFoundException if no corresponding local class can be
* found in the local JVM.
*/
public abstract void defaultReadObject()
throws IOException, ClassNotFoundException, NotActiveException;
/**
* Enable allocation for subclass reimplementing serialization.<p>
*
* Note: Default allocation does not have the java access priviledges
* to invoke package and protected constructors.<p>
*
* Security alert: this JVM native method is private within ObjectInputStream; however,
* it was anticipated that re-implementors of serialization would need
* access to this method. Is this allocator considered a security problem? <p>
*
* @param ctorClass is the same class or a superclass of <STRONG>ofClass</STRONG>
* @param ofClass the type of the object to allocate.
* @return an object of <STRONG>ofClass</STRONG> type.
*
* @exception IllegalAccessException if no-arg constructor of
* <STRONG>ctorClass</STRONG> is not accessible from
* <STRONG>ofClass</STRONG>.
* @exception InstantiationException TBD.
*/
protected final native Object
allocateNewObject(Class<?> ofClass, Class<?> ctorClass)
throws InstantiationException, IllegalAccessException;
/**
* Enable allocation for subclass reimplementing serialization.<p>
*
* Note: Default allocation does not have the java access priviledges
* to invoke package and protected constructors.<p>
*
* Security alert: this JVM native method is private within ObjectInputStream; however,
* it was anticipated that re-implementors of serialization would need
* access to this method. Is this allocator considered a security problem?<p>
*
*
* @exception IllegalAccessException TBD.
* @exception InstantiationException TBD.
*/
protected final native Object
allocateNewArray(Class<?> componentClass, int length)
throws InstantiationException, IllegalAccessException;
/**
* Reads the Serializable fields from the stream into a buffer
* and makes the fields available by name.
*
* @exception java.lang.ClassNotFoundException if the class of a serialized
* object could not be found.
* @exception IOException if an I/O error occurs.
* @exception NotActiveException if readObject() is not currently active.
*/
public abstract ObjectInputStream.GetField readFields()
throws IOException, ClassNotFoundException, NotActiveException;
protected abstract boolean enableResolveObject(boolean enable);
public abstract void registerValidation(ObjectInputValidation obj,
int prio)
throws NotActiveException, InvalidObjectException;
/****************************************************************/
/* Use DataInput methods to read primitive data from the stream. */
public abstract int read() throws IOException;
public abstract int read(byte[] data, int offset, int length)
throws IOException;
public abstract boolean readBoolean() throws IOException;
public abstract byte readByte() throws IOException;
public abstract int readUnsignedByte() throws IOException;
public abstract short readShort() throws IOException;
public abstract int readUnsignedShort() throws IOException;
public abstract char readChar() throws IOException;
public abstract int readInt() throws IOException;
public abstract long readLong() throws IOException;
public abstract float readFloat() throws IOException;
public abstract double readDouble() throws IOException;
public abstract void readFully(byte[] data) throws IOException;
public abstract void readFully(byte[] data, int offset, int size) throws IOException;
public abstract String readUTF() throws IOException;
public abstract int available() throws IOException;
public abstract int skipBytes(int len) throws IOException;
/* @deprecated */
@SuppressWarnings("deprecation")
public abstract String readLine() throws IOException;
};

244
test/jdk/java/io/Serializable/subclass/AbstractObjectOutputStream.java Normal file
View file

@ -0,0 +1,244 @@
/*
* Copyright (c) 1998, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
*
*
*/
import java.io.*;
import java.security.*;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.lang.reflect.InvocationTargetException;
import java.io.IOException;
import java.io.OutputStream;
import java.io.ObjectOutputStream;
/**
* This class provides a means for a subclass to re-implement Serialization
* while preserving the existing public API to Serialization. A complimentary
* subclass of AbstractObjectInputStream must also be implemented to
* deserializa the new implementation.<p>
*
* Since serialization must override java access rules in order to
* access private, protected and package accessible Serializable fields,
* only trusted classes are allowed to subclass AbstractObjectOutputStream.
* Implementations of this class should protect themselves
* from being subclassed in a way that will provide access to object
* references and other sensitive info. Specifically, writeObjectOverride()
* should be made final.
*
* A subclass of AbstractObjectOutputStream writes primitive data types
* and graphs of Java objects to an ObjectOutputStream. The objects can be read
* (reconstituted) using he complimentary subclass of AbstractObjectInputStream.<p>
* Persistent storage of objects can be accomplished by using a file for
* the stream. If the stream is a network socket stream, the objects can
* be reconstituted on another host or in another process. <p>
*
* Only objects that support the java.io.Serializable interface can be
* written to streams.<p>
*
* The method <STRONG>writeObjectOverride</STRONG> is used to write an object
* to the stream. Any object, including Strings and arrays, is
* written with writeObject. Multiple objects or primitives can be
* written to the stream. The objects must be read back from the
* corresponding subclass of AbstractObjectInputstream with the same types
* and in the same order as they were written.<p>
*
* Primitive data types can also be written to the stream using the
* appropriate methods from DataOutput. Strings can also be written
* using the writeUTF method.<p>
*
* The default serialization mechanism for an object is defined by
* defaultWriteObject(). References to other objects
* (except in transient or static fields) cause those objects to be
* written also. Multiple references to a single object are encoded
* using a reference sharing mechanism so that graphs of objects can
* be restored to the same shape as when the original was written. <p>
*
* Classes that require special handling during the serialization and deserialization
* process must implement special methods with these exact signatures: <p>
*
* <PRE>
* private void readObject(java.io.ObjectInputStream stream)
* throws IOException, ClassNotFoundException;
* private void writeObject(java.io.ObjectOutputStream stream)
* throws IOException
* </PRE><p>
* The writeObject method is responsible for writing the state of
* the object for its particular class so that the corresponding
* readObject method can restore it.
* The method does not need to concern itself with the
* state belonging to the object's superclasses or subclasses.
* State is saved by writing the individual fields to the ObjectOutputStream
* using the writeObject method or by using the methods for
* primitive data types supported by DataOutput. <p>
*
* Serialization does not write out the fields of any object that does
* not implement the java.io.Serializable interface. Subclasses of
* Objects that are not serializable can be serialized. In this case
* the non-serializable class must have a no-arg constructor to allow
* its fields to be initialized. In this case it is the
* responsibility of the subclass to save and restore the state of the
* non-serializable class. It is frequently the case that the fields
* of that class are accessible (public, package, or protected) or
* that there are get and set methods that can be used to restore the
* state. <p>
*
* Serialization of an object can be prevented by implementing writeObject
* and readObject methods that throw the NotSerializableException.
* The exception will be caught by the ObjectOutputStream and abort the
* serialization process.
*
* Implementing the Externalizable interface allows the object to
* assume complete control over the contents and format of the object's
* serialized form. The methods of the Externalizable interface,
* writeExternal and readExternal, are called to save and restore the
* objects state. When implemented by a class they can write and read
* their own state using all of the methods of ObjectOutput and
* ObjectInput. It is the responsibility of the objects to handle any
* versioning that occurs.
*
* @author Joe Fialli
*
* @see java.io.ObjectOutputStream
* @see java.io.DataOutput
* @see java.io.Serializable
* @see java.io.Externalizable
* @see java.io.Replaceable
* @see java.io.ext.AbstractObjectInputStream
*
* @since JDK1.2
*/
public abstract class AbstractObjectOutputStream extends ObjectOutputStream
{
protected OutputStream out;
/* Stream Management Methods. */
/**
* Creates an ObjectOutputStream that writes to the specified OutputStream.
*
* @exception IOException Any exception thrown by the underlying OutputStream.
* @see java.io.ObjectOutputStream#writeStreamHeader()
*/
public AbstractObjectOutputStream(OutputStream out) throws IOException {
this.out = out;
}
public abstract void reset() throws IOException;
protected abstract void drain() throws IOException;
public abstract void close() throws IOException;
/*******************************************************************/
/* Write Objects to Stream */
/**
* Write the specified object to a subclass of AbstractObjectOutputStream.<p>
*
* NOTE: The override method of this class should have the modifier final.<p>
*
* Default serialization for a class can be
* overridden by defining writeObject and the readObject methods
* for the Serializable class. Objects referenced by this object are
* written transitively so that a complete equivalent graph of objects
* can be reconstructed by an ObjectInputStream. <p>
*
* This method must implement the substitution semantics on the
* object to be written, write Externalizable objects with its classes
* override of writeExternal, and it must call annotateClass when
* writing an ObjectStreamClass to the stream.
*
* Exceptions can be thrown for problems with the OutputStream and
* for classes that should not be serialized.
*
* For security's sake, any overrides of this method should be final.
* Serialization typically needs to disable java access rules
* to serialize private, protected and package accessible Serializable
* fields. This method gets called for ALL Serializable objects.
*
* @exception InvalidClassException Something is wrong with a class used by
* serialization.
* @exception NotSerializableException Some object to be serialized does not
* implement the java.io.Serializable interface.
* @exception IOException Any exception thrown by the underlying OutputStream.
* @see java.io.Externalizable
* @see java.io.ObjectOutputStream#replaceObject(Object)
* @see java.io.Replaceable
* @see java.io.ObjectOutputStream#annotateClass(Class)
*/
protected void writeObjectOverride(Object obj)
throws IOException
{
}
/**
* Write the Serializable fields of the current object to this stream.<p>
*
* Note: The object being serialized is not passed to this method.
* For security purposes, the initial implementation maintained
* the state of the last object to be passed to writeObject and
* only allowed this method to be invoked for this object.<p>
*
* @exception NotActiveException Thrown if a writeObject method is not
* active.
*/
public abstract void defaultWriteObject() throws IOException;
/*************************************************************/
/* Use the methods of PutField to map between Serializable fields
* and actual fields of a Serializable class.
*/
public abstract ObjectOutputStream.PutField putFields() throws IOException;
/**
* Note: The PutField being serialized is not passed to this method.
* For security purposes, the initial implementation maintained
* the state of the last putFields call and
* only allowed this method to be invoked for that PutFields object.
*/
public abstract void writeFields() throws IOException;
protected abstract boolean enableReplaceObject(boolean enable);
/*******************************************************************/
/* Write Primitive Data to stream. DataOutput methods. */
public abstract void write(int data) throws IOException;
public abstract void write(byte b[]) throws IOException;
public abstract void write(byte b[], int off, int len) throws IOException;
public abstract void writeBoolean(boolean data) throws IOException;
public abstract void writeByte(int data) throws IOException;
public abstract void writeShort(int data) throws IOException;
public abstract void writeChar(int data) throws IOException;
public abstract void writeInt(int data) throws IOException;
public abstract void writeLong(long data) throws IOException;
public abstract void writeFloat(float data) throws IOException;
public abstract void writeDouble(double data) throws IOException;
public abstract void writeBytes(String data) throws IOException;
public abstract void writeChars(String data) throws IOException;
public abstract void writeUTF(String data) throws IOException;
};

143
test/jdk/java/io/Serializable/subclass/SubclassTest.java Normal file
View file

@ -0,0 +1,143 @@
/*
* Copyright (c) 1998, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4100915
* @summary Verify that [write/read]ObjectOverride methods get called.
* Test verifies that ALL methods to write an object can
* be overridden. However, the testing for reading an object
* is incomplete. Only test that readObjectOverride is called.
* An entire protocol would need to be implemented and written
* out before being able to test the input side of the API.
*
* @compile AbstractObjectInputStream.java AbstractObjectOutputStream.java
* @compile XObjectInputStream.java XObjectOutputStream.java
* @compile SubclassTest.java
* @run main SubclassTest
*/
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.ObjectStreamField;
import java.io.Serializable;
/**
* Test if customized readObject and writeObject are called.
*/
class B implements Serializable {
private static final long serialVersionUID = 1L;
public int publicIntField;
public static int numWriteObjectCalled = 0;
B(int v) {
publicIntField = v;
}
private void writeObject(ObjectOutputStream os) throws IOException {
numWriteObjectCalled++;
os.defaultWriteObject();
}
private void readObject(ObjectInputStream is)
throws IOException, ClassNotFoundException
{
is.defaultReadObject();
}
};
/**
* Test PutFields interface.
*/
class C implements Serializable {
private static final long serialVersionUID = 1L;
public int xx1;
public int xx2;
private static final ObjectStreamField[] serialPersistentFields = {
new ObjectStreamField("x1", Integer.TYPE),
new ObjectStreamField("x2", Integer.TYPE),
new ObjectStreamField("x3", Integer.TYPE),
new ObjectStreamField("x4", Integer.TYPE)
};
C() {
xx1 = 300;
xx2 = 400;
}
private void writeObject(ObjectOutputStream os) throws IOException {
ObjectOutputStream.PutField putFields = os.putFields();
putFields.put("x1", xx1);
putFields.put("x2", xx2);
putFields.put("x3", xx1 * 2);
putFields.put("x4", xx2 * 2);
os.writeFields();
}
};
class A implements Serializable {
private static final long serialVersionUID = 1L;
public int publicIntField;
public long publicLongField;
public B publicBField;
public B[] publicBArray = { new B(4), new B(6)};
public C publicCField;
public A() {
publicIntField = 3;
publicLongField = 10L;
publicBField = new B(5);
publicCField = new C();
}
};
public class SubclassTest {
public static void main(String argv[])
throws IOException, ClassNotFoundException
{
ByteArrayOutputStream baos = new ByteArrayOutputStream(20);
XObjectOutputStream os = null;
os = new XObjectOutputStream(baos);
os.writeObject(new A());
os.close();
if (B.numWriteObjectCalled != 3)
throw new Error("Expected B.writeObject() to be called 3 times;" +
" observed only " + B.numWriteObjectCalled + " times");
XObjectInputStream is =
new XObjectInputStream(new ByteArrayInputStream(baos.toByteArray()));
try {
A a = (A)is.readObject();
throw new Error("Expected readObjectOverride() to be called and throw IOException(not implemented)");
} catch (IOException e) {
}
is.close();
}
};

241
test/jdk/java/io/Serializable/subclass/XObjectInputStream.java Normal file
View file

@ -0,0 +1,241 @@
/*
* Copyright (c) 1998, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.io.*;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.lang.reflect.InvocationTargetException;
import java.security.*;
class XObjectInputStream extends AbstractObjectInputStream {
XObjectInputStream(InputStream in)
throws IOException, StreamCorruptedException
{
super(in);
dis = new DataInputStream(in);
}
public final void defaultReadObject()
throws IOException, ClassNotFoundException, NotActiveException
{
}
protected final Object readObjectOverride()
throws OptionalDataException, ClassNotFoundException, IOException {
Object readResult = null;
Object prevObject = currentObject;
Class<?> prevDesc = currentClassDescriptor;
boolean NotImplemented = true;
if (NotImplemented)
throw new IOException("readObjectOverride not implemented");
try {
currentObject = null;
//Read in class of object to currentDescriptor
String className = dis.readUTF();
currentClassDescriptor = Class.forName(className);
try {
//currentObject = Allocate a new instance of the class
currentObject =
allocateNewObject(currentClassDescriptor,
currentClassDescriptor);
} catch (InstantiationException e) {
throw new InvalidClassException(currentClassDescriptor.getName(),
e.getMessage());
} catch (IllegalAccessException e) {
throw new InvalidClassException(currentClassDescriptor.getName(),
e.getMessage());
}
} finally {
readResult = currentObject;
currentObject = prevObject;
}
return readResult;
}
public ObjectInputStream.GetField readFields()
throws IOException, ClassNotFoundException, NotActiveException {
throw new Error("not implememted");
}
public synchronized void registerValidation(ObjectInputValidation obj,
int prio)
throws NotActiveException, InvalidObjectException {
}
public int read() throws IOException {
return dis.read();
}
public int read(byte[] data, int offset, int length) throws IOException {
return dis.read(data, offset, length);
}
public int available() throws IOException {
return in.available();
}
public boolean readBoolean() throws IOException {
throw new IOException("Not Implemented");
}
public byte readByte() throws IOException {
throw new IOException("Not Implemented");
}
public int readUnsignedByte() throws IOException {
throw new IOException("Not Implemented");
}
public short readShort() throws IOException {
throw new IOException("Not Implemented");
}
public int readUnsignedShort() throws IOException {
throw new IOException("Not Implemented");
}
public char readChar() throws IOException {
throw new IOException("Not Implemented");
}
public int readInt() throws IOException {
throw new IOException("Not Implemented");
}
public long readLong() throws IOException {
throw new IOException("Not Implemented");
}
public float readFloat() throws IOException {
throw new IOException("Not Implemented");
}
public double readDouble() throws IOException {
throw new IOException("Not Implemented");
}
public void readFully(byte[] data) throws IOException {
throw new IOException("Not Implemented");
}
public void readFully(byte[] data, int offset, int size) throws IOException {
throw new IOException("Not Implemented");
}
public int skipBytes(int len) throws IOException {
throw new IOException("Not Implemented");
}
public String readLine() throws IOException {
throw new IOException("Not Implemented");
}
public String readUTF() throws IOException {
throw new IOException("Not Implemented");
}
public void close() throws IOException {
in.close();
}
/**********************************************************/
/**
* Provide access to the persistent fields read from the input stream.
*/
public static class InternalGetField extends ObjectInputStream.GetField {
/**
* Get the ObjectStreamClass that describes the fields in the stream.
*/
public ObjectStreamClass getObjectStreamClass() {
throw new Error("not implemented");
}
/**
* Return true if the named field is defaulted and has no value
* in this stream.
*/
public boolean defaulted(String name)
throws IOException, IllegalArgumentException
{
throw new Error("not implemented");
//ObjectStreamField field = checkField(name, null);
}
public boolean get(String name, boolean defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public char get(String name, char defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public byte get(String name, byte defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public short get(String name, short defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public int get(String name, int defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public long get(String name, long defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public float get(String name, float defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public double get(String name, double defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public Object get(String name, Object defvalue)
throws IOException, IllegalArgumentException {
throw new Error("not implemented");
}
public void read(ObjectInputStream in)
throws IOException, ClassNotFoundException {
}
}
private Object currentObject;
private Class<?> currentClassDescriptor;
/*************************************************************/
protected boolean enableResolveObject(boolean enable) {
throw new Error("To be implemented");
}
private DataInputStream dis;
};

345
test/jdk/java/io/Serializable/subclass/XObjectOutputStream.java Normal file
View file

@ -0,0 +1,345 @@
/*
* Copyright (c) 1998, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.io.*;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.lang.reflect.InvocationTargetException;
import java.security.*;
public class XObjectOutputStream extends AbstractObjectOutputStream {
XObjectOutputStream(OutputStream out) throws IOException {
super(out);
}
protected boolean enableReplaceObject(boolean enable)
{
throw new Error("not implemented");
}
protected void annotateClass(Class<?> cl) throws IOException {
}
public void close() throws IOException{
out.close();
}
protected Object replaceObject(Object obj) throws IOException {
return obj;
}
protected void writeStreamHeader() throws IOException {
super.writeStreamHeader();
}
protected final void writeObjectOverride(Object obj) throws IOException {
Object prevCurrentObject = currentObject;
currentObject = obj;
System.out.println("writeObjectOverride(" + obj.toString() + ")");
try {
// ** Preserving reference semantics.
// if (obj already serialized) {
// look up streamId for obj and write it into 'this' stream.
// return;
// }
//
// if (obj instanceof Class) {
// //Special processing for classes.
// //Might need to call this.annotateClass(obj.getClass())
// //someday.
// return;
// }
//
// **Replacement semantics
// Object replacement = obj;
// if (enableReplace)
// replacement = this.writeReplace(obj);
// if (replacement instanceof Replaceable)
// replacement = ((Replaceable)replacement).replaceObject(this);
// if (obj != replacement) {
// //record that all future occurances of obj should be replaced
// //with replacement
// }
//
// if obj is Externalizeable {
// Object[] argList = {this};
// invokeMethod(obj, writeExternalMethod, argList);
// else
Method writeObjectMethod = getWriteObjectMethod(obj.getClass());
if (writeObjectMethod != null) {
Object[] arglist = {this};
invokeMethod(obj, writeObjectMethod, arglist);
} else
defaultWriteObject();
} finally {
currentObject = prevCurrentObject;
}
}
/* Since defaultWriteObject() does not take the object to write as a parameter,
* implementation is required to store currentObject when writeObject is called.
*/
public void defaultWriteObject() throws IOException {
Object obj = currentObject;
System.out.println("XObjectOutputStream.defaultWriteObject(" +
obj.toString() + ")");
//In order to access package, private and protected fields,
//one needs to use Priviledged Access and be trusted code.
//This test will avoid that problem by only serializing public fields.
Field[] fields = obj.getClass().getFields();
for (int i= 0; i < fields.length; i++) {
//Skip non-Serializable fields.
int mods = fields[i].getModifiers();
if (Modifier.isStatic(mods) || Modifier.isTransient(mods))
continue;
Class<?> FieldType = fields[i].getType();
if (FieldType.isPrimitive()) {
System.out.println("Field " + fields[i].getName() +
" has primitive type " + FieldType.toString());
} else {
System.out.println("**Field " + fields[i].getName() +
" is an Object of type " + FieldType.toString());
try {
writeObject(fields[i].get(obj));
if (FieldType.isArray()) {
Object[] array = ((Object[]) fields[i].get(obj));
Class<?> componentType = FieldType.getComponentType();
if (componentType.isPrimitive())
System.out.println("Output " + array.length + " primitive elements of" +
componentType.toString());
else {
System.out.println("Output " + array.length + " of Object elements of" +
componentType.toString());
for (int k = 0; k < array.length; k++) {
writeObject(array[k]);
}
}
}
} catch (IllegalAccessException e) {
throw new IOException(e.getMessage());
}
}
}
}
public PutField putFields() throws IOException {
currentPutField = new InternalPutField();
return currentPutField;
}
public void writeFields() throws IOException {
currentPutField.write(this);
}
static final class InternalPutField extends ObjectOutputStream.PutField {
String fieldName[];
int intValue[];
int next;
InternalPutField() {
fieldName = new String[10];
intValue = new int[10];
next = 0;
}
/**
* Put the value of the named boolean field into the persistent field.
*/
public void put(String name, boolean value) {
}
/**
* Put the value of the named char field into the persistent fields.
*/
public void put(String name, char value) {
}
/**
* Put the value of the named byte field into the persistent fields.
*/
public void put(String name, byte value) {
}
/**
* Put the value of the named short field into the persistent fields.
*/
public void put(String name, short value) {
}
/**
* Put the value of the named int field into the persistent fields.
*/
public void put(String name, int value) {
if (next < fieldName.length) {
fieldName[next] = name;
intValue[next] = value;
next++;
}
}
/**
* Put the value of the named long field into the persistent fields.
*/
public void put(String name, long value) {
}
/**
* Put the value of the named float field into the persistent fields.
*/
public void put(String name, float value) {
}
/**
* Put the value of the named double field into the persistent field.
*/
public void put(String name, double value) {
}
/**
* Put the value of the named Object field into the persistent field.
*/
public void put(String name, Object value) {
}
/**
* Write the data and fields to the specified ObjectOutput stream.
*/
@SuppressWarnings("deprecation")
public void write(ObjectOutput out) throws IOException {
for (int i = 0; i < next; i++)
System.out.println(fieldName[i] + "=" + intValue[i]);
}
};
/**
* Writes a byte. This method will block until the byte is actually
* written.
* @param b the byte
* @exception IOException If an I/O error has occurred.
* @since JDK1.1
*/
public void write(int data) throws IOException {
}
/**
* Writes an array of bytes. This method will block until the bytes
* are actually written.
* @param b the data to be written
* @exception IOException If an I/O error has occurred.
* @since JDK1.1
*/
public void write(byte b[]) throws IOException {
}
/**
* Writes a sub array of bytes.
* @param b the data to be written
* @param off the start offset in the data
* @param len the number of bytes that are written
* @exception IOException If an I/O error has occurred.
* @since JDK1.1
*/
public void write(byte b[], int off, int len) throws IOException {
}
public void writeBoolean(boolean data) throws IOException {
}
public void writeByte(int data) throws IOException {
}
public void writeShort(int data) throws IOException {
}
public void writeChar(int data) throws IOException {
}
public void writeInt(int data) throws IOException{}
public void writeLong(long data) throws IOException{}
public void writeFloat(float data) throws IOException{}
public void writeDouble(double data) throws IOException{}
public void writeBytes(String data) throws IOException{}
public void writeChars(String data) throws IOException{}
public void writeUTF(String data) throws IOException{}
public void reset() throws IOException {}
public void available() throws IOException {}
public void drain() throws IOException {}
private Object currentObject = null;
private InternalPutField currentPutField;
/********************************************************************/
/* CODE LIFTED FROM ObjectStreamClass constructor.
* ObjectStreamClass.writeObjectMethod is private.
*
* Look for the writeObject method
* Set the accessible flag on it here.
* Subclass of AbstractObjectOutputStream will call it as necessary.
*/
public static Method getWriteObjectMethod(final Class<?> cl) {
try {
Class<?>[] args = {ObjectOutputStream.class};
Method m = cl.getDeclaredMethod("writeObject", args);
int mods = m.getModifiers();
// Method must be private and non-static
if (!Modifier.isPrivate(mods) ||
Modifier.isStatic(mods)) {
return null;
} else {
m.setAccessible(true);
return m;
}
} catch (NoSuchMethodException e) {
return null;
}
}
/*************************************************************/
/* CODE LIFTED FROM ObjectOutputStream. */
private static void invokeMethod(final Object obj, final Method m,
final Object[] argList)
throws IOException
{
try {
m.invoke(obj, argList);
} catch (InvocationTargetException ex) {
Throwable t = ex.getTargetException();
if (t instanceof IOException)
throw (IOException)t;
else if (t instanceof RuntimeException)
throw (RuntimeException) t;
else if (t instanceof Error)
throw (Error) t;
else
throw new Error("intenral error");
} catch (IllegalAccessException iae) {
// IllegalAccessException can not happen
}
}
};