undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/lang/Class/forName/modules/TestDriver.java

@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.stream.Stream;
+
+import jdk.test.lib.util.FileUtils;
+import jdk.test.lib.compiler.CompilerUtils;
+import static jdk.test.lib.process.ProcessTools.*;
+
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Test;
+import static org.testng.Assert.assertTrue;
+
+/**
+ * @test
+ * @bug 8087335
+ * @summary Tests for Class.forName(Module,String)
+ * @library /test/lib
+ * @modules jdk.compiler
+ * @build jdk.test.lib.Platform
+ *        jdk.test.lib.util.FileUtils
+ *        jdk.test.lib.compiler.CompilerUtils
+ *        jdk.test.lib.process.ProcessTools
+ *        TestDriver TestMain TestLayer
+ * @run testng TestDriver
+ */
+
+public class TestDriver {
+
+    private static final String TEST_SRC =
+            Paths.get(System.getProperty("test.src")).toString();
+    private static final String TEST_CLASSES =
+            Paths.get(System.getProperty("test.classes")).toString();
+
+    private static final Path MOD_SRC_DIR = Paths.get(TEST_SRC, "src");
+    private static final Path MOD_DEST_DIR = Paths.get("mods");
+
+    private static final String[] modules = new String[] {"m1", "m2"};
+
+    /**
+     * Compiles all modules used by the test.
+     */
+    @BeforeClass
+    public void setup() throws Exception {
+        assertTrue(CompilerUtils.compile(
+                        MOD_SRC_DIR, MOD_DEST_DIR,
+                        "--module-source-path",
+                        MOD_SRC_DIR.toString()));
+
+        copyDirectories(MOD_DEST_DIR.resolve("m1"), Paths.get("mods1"));
+        copyDirectories(MOD_DEST_DIR.resolve("m2"), Paths.get("mods2"));
+    }
+
+    @Test
+    public void test() throws Exception {
+        String[] options = new String[] {
+                "-cp", TEST_CLASSES,
+                "--module-path", MOD_DEST_DIR.toString(),
+                "--add-modules", String.join(",", modules),
+                "-m", "m2/p2.test.Main"
+        };
+        runTest(options);
+    }
+
+    @Test
+    public void testUnnamedModule() throws Exception {
+        String[] options = new String[] {
+                "-cp", TEST_CLASSES,
+                "--module-path", MOD_DEST_DIR.toString(),
+                "--add-modules", String.join(",", modules),
+                "TestMain"
+        };
+        runTest(options);
+    }
+
+    @Test
+    public void testLayer() throws Exception {
+        String[] options = new String[] {
+                "-cp", TEST_CLASSES,
+                "TestLayer"
+        };
+
+        runTest(options);
+    }
+
+    private void runTest(String[] options) throws Exception {
+        assertTrue(executeTestJava(options)
+                        .outputTo(System.out)
+                        .errorTo(System.err)
+                        .getExitValue() == 0);
+    }
+
+    private void copyDirectories(Path source, Path dest) throws IOException {
+        if (Files.exists(dest))
+            FileUtils.deleteFileTreeWithRetry(dest);
+        Files.walk(source, Integer.MAX_VALUE)
+                .filter(Files::isRegularFile)
+                .forEach(p -> {
+                    try {
+                        Path to = dest.resolve(source.relativize(p));
+                        Files.createDirectories(to.getParent());
+                        Files.copy(p, to);
+                    } catch (IOException e) {
+                        throw new UncheckedIOException(e);
+                    }
+                });
+    }
+}

test/jdk/java/lang/Class/forName/modules/TestLayer.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2016, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.lang.module.Configuration;
+import java.lang.module.ModuleFinder;
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Set;
+
+public class TestLayer {
+    private static final Path MODS_DIR = Paths.get("mods");
+    private static final Set<String> modules = Set.of("m1", "m2");
+
+    public static void main(String[] args) throws Exception {
+        ModuleFinder finder = ModuleFinder.of(MODS_DIR);
+
+        Configuration parent = ModuleLayer.boot().configuration();
+        Configuration cf = parent.resolveAndBind(ModuleFinder.of(),
+                                                 finder,
+                                                 modules);
+
+        ClassLoader scl = ClassLoader.getSystemClassLoader();
+        ModuleLayer layer = ModuleLayer.boot().defineModulesWithManyLoaders(cf, scl);
+
+        Module m1 = layer.findModule("m1").get();
+        Module m2 = layer.findModule("m2").get();
+
+        // find exported and non-exported class from a named module
+        findClass(m1, "p1.A");
+        findClass(m1, "p1.internal.B");
+        findClass(m2, "p2.C");
+
+        // find class from unnamed module
+        ClassLoader ld = TestLayer.class.getClassLoader();
+        findClass(ld.getUnnamedModule(), "TestDriver");
+
+        // check if clinit should not be initialized
+        // compile without module-path; so use reflection
+        Class<?> c = Class.forName(m1, "p1.Initializer");
+        Method m = c.getMethod("isInited");
+        Boolean isClinited = (Boolean) m.invoke(null);
+        if (isClinited.booleanValue()) {
+           throw new RuntimeException("clinit should not be invoked");
+        }
+    }
+
+    static Class<?> findClass(Module module, String cn) {
+        Class<?> c = Class.forName(module, cn);
+        if (c == null) {
+            throw new RuntimeException(cn + " not found in " + module);
+        }
+        if (c.getModule() != module) {
+            throw new RuntimeException(c.getModule() + " != " + module);
+        }
+        return c;
+    }
+}

test/jdk/java/lang/Class/forName/modules/TestMain.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.lang.reflect.Method;
+
+public class TestMain {
+    public static void main(String[] args) throws Exception {
+        ModuleLayer boot = ModuleLayer.boot();
+        Module m1 = boot.findModule("m1").get();
+        Module m2 = boot.findModule("m2").get();
+
+        // find exported and non-exported class from a named module
+        findClass(m1, "p1.A");
+        findClass(m1, "p1.internal.B");
+        findClass(m2, "p2.C");
+
+        // find class from unnamed module
+        ClassLoader loader = TestMain.class.getClassLoader();
+        findClass(loader.getUnnamedModule(), "TestDriver");
+
+        // check if clinit should not be initialized
+        // compile without module-path; so use reflection
+        Class<?> c = Class.forName(m1, "p1.Initializer");
+        Method m = c.getMethod("isInited");
+        Boolean isClinited = (Boolean) m.invoke(null);
+        if (isClinited.booleanValue()) {
+            throw new RuntimeException("clinit should not be invoked");
+        }
+    }
+
+    static Class<?> findClass(Module module, String cn) {
+        Class<?> c = Class.forName(module, cn);
+        if (c == null) {
+            throw new RuntimeException(cn + " not found in " + module);
+        }
+        if (c.getModule() != module) {
+            throw new RuntimeException(c.getModule() + " != " + module);
+        }
+        return c;
+    }
+}

test/jdk/java/lang/Class/forName/modules/src/m1/module-info.java

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+module m1 {
+    exports p1;
+}

test/jdk/java/lang/Class/forName/modules/src/m1/p1/A.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package p1;
+
+public class A {
+    static {
+        Initializer.init();
+        System.out.println("p1.A is initialzed");
+    }
+}

test/jdk/java/lang/Class/forName/modules/src/m1/p1/Initializer.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package p1;
+
+public class Initializer {
+    private static boolean inited = false;
+    static synchronized void init() {
+        inited = true;
+    }
+    public static synchronized boolean isInited() {
+        return inited;
+    }
+}

test/jdk/java/lang/Class/forName/modules/src/m1/p1/internal/B.java

@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package p1.internal;
+
+public class B {
+    public B() {}
+}

test/jdk/java/lang/Class/forName/modules/src/m2/module-info.java

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+module m2 {
+    exports p2;
+}

test/jdk/java/lang/Class/forName/modules/src/m2/p2/C.java

@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package p2;
+
+public class C {
+}

test/jdk/java/lang/Class/forName/modules/src/m2/p2/test/Main.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package p2.test;
+
+public class Main {
+    public static void main(String... args) throws Exception {
+        ModuleLayer boot = ModuleLayer.boot();
+        Module m1 = boot.findModule("m1").get();
+        Module m2 = Main.class.getModule();
+
+        // find exported and non-exported class from a named module
+        findClass(m1, "p1.A");
+        findClass(m1, "p1.internal.B");
+        findClass(m2, "p2.C");
+
+        // find class from unnamed module
+        ClassLoader loader = m2.getClassLoader();
+        findClass(loader.getUnnamedModule(), "TestDriver");
+
+        try {
+            Class<?> c = findClass(m1, "p1.internal.B");
+            c.newInstance();
+            throw new RuntimeException(c.getName() + " should not be exported to m2");
+        } catch (IllegalAccessException e) {}
+    }
+
+    static Class<?> findClass(Module module, String cn) {
+        Class<?> c = Class.forName(module, cn);
+        if (c == null) {
+            throw new RuntimeException(cn + " not found in " + module);
+        }
+        if (c.getModule() != module) {
+            throw new RuntimeException(c.getModule() + " != " + module);
+        }
+        return c;
+    }
+}