engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

54
test/jdk/java/lang/Class/getModifiers/ForInnerClass.java Normal file
View file

@ -0,0 +1,54 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4109635
@summary For an inner class, the access bits must come from the
InnerClasses attribute, not from the class block's access.
Note however that the VM should not rely on these access
flags from the attribute!
*/
import java.lang.reflect.Modifier;
public class ForInnerClass {
private class Inner {
}
protected class Protected {
}
public static void main(String[] args) throws Exception {
/* We are not testing for the ACC_SUPER bug, so strip we strip
* synchorized. */
int m = 0;
m = Inner.class.getModifiers() & (~Modifier.SYNCHRONIZED);
if (m != Modifier.PRIVATE)
throw new Exception("Access bits for innerclass not from " +
"InnerClasses attribute");
m = Protected.class.getModifiers() & (~Modifier.SYNCHRONIZED);
if (m != Modifier.PROTECTED)
throw new Exception("Protected inner class wronged modifiers");
}
}

39
test/jdk/java/lang/Class/getModifiers/ForStaticInnerClass.java Normal file
View file

@ -0,0 +1,39 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4163105
@summary VM loses static modifier of inner class.
*/
import java.lang.reflect.Modifier;
public class ForStaticInnerClass {
static class Static {
}
public static void main(String[] args) throws Exception {
if (!Modifier.isStatic(Static.class.getModifiers()))
throw new Exception("VM lost static modifier of innerclass.");
}
}

41
test/jdk/java/lang/Class/getModifiers/ResolveFrom.java Normal file
View file

@ -0,0 +1,41 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4127549
@summary getModifiers should resolve constant pool entries from
its own class.
@author James Bond
*/
import java.lang.reflect.Modifier;
public class ResolveFrom {
private class Inner {
int i;
}
public static void main(String argv[]) throws Exception {
int m = ResolveFrom.class.getModifiers();
System.out.println("ResolveFrom has modifiers = " +
Modifier.toString(m));
}
}

38
test/jdk/java/lang/Class/getModifiers/StripACC_SUPER.java Normal file
View file

@ -0,0 +1,38 @@
/*
* Copyright (c) 1998, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/* @test
@bug 4109635
@summary VM adds ACC_SUPER bit to access flags of a class. This must
be stripped by the Class.getModifiers method, or else this
shows up as though the class is synchronized and that doesn't
make any sense.
@author Anand Palaniswamy
*/
public class StripACC_SUPER {
public static void main(String[] args) throws Exception {
int access = StripACC_SUPER.class.getModifiers();
if (java.lang.reflect.Modifier.isSynchronized(access))
throw new Exception("ACC_SUPER bit is not being stripped");
}
}

136
test/jdk/java/lang/Class/getModifiers/TestPrimitiveAndArrayModifiers.java Normal file
View file

@ -0,0 +1,136 @@
/*
* Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.lang.reflect.Modifier;
import java.lang.annotation.*;
/*
* @test
* @bug 8296743
* @summary Verify array classes and primitives have expected modifiers
*/
@ExpectedModifiers(Modifier.PUBLIC | Modifier.FINAL | Modifier.ABSTRACT)
public class TestPrimitiveAndArrayModifiers {
/*
* Relevant excerpt of the Class.getModifiers() specification:
* <p> If the underlying class is an array class:
* <ul>
* <li> its {@code public}, {@code private} and {@code protected}
* modifiers are the same as those of its component type
* <li> its {@code final} and {@code abstract} modifiers are always
* {@code true}
* <li> its interface modifier is always {@code false}, even when
* the component type is an interface
* </ul>
*/
public static void main(String... args) throws Exception {
testPrimitives();
testArrays();
}
private static void testArrays() {
Class<?>[] testCases = {
TestPrimitiveAndArrayModifiers.class,
PackagePrivateClass.class,
ProtectedClass.class,
PrivateClass.class,
PublicInterface.class,
PackagePrivateInterface.class,
ProtectedInterface.class,
PrivateInterface.class,
};
for(var testCase : testCases) {
int expectedModifiers =
testCase.getAnnotation(ExpectedModifiers.class).value();
Class<?> arrayClass = testCase.arrayType();
int actualModifiers = arrayClass.getModifiers();
if (expectedModifiers != actualModifiers) {
throw new RuntimeException("Expected " + Modifier.toString(expectedModifiers) +
"on " + testCase.getCanonicalName() +
", but got " + Modifier.toString(actualModifiers));
}
}
}
@ExpectedModifiers(Modifier.FINAL | Modifier.ABSTRACT)
class PackagePrivateClass {}
@ExpectedModifiers(Modifier.FINAL | Modifier.ABSTRACT | Modifier.PROTECTED)
protected class ProtectedClass {}
@ExpectedModifiers(Modifier.FINAL | Modifier.ABSTRACT | Modifier.PRIVATE)
private class PrivateClass {}
@ExpectedModifiers(Modifier.FINAL | Modifier.ABSTRACT | Modifier.PUBLIC)
public interface PublicInterface {}
@ExpectedModifiers(Modifier.FINAL | Modifier.ABSTRACT)
interface PackagePrivateInterface {}
@ExpectedModifiers(Modifier.FINAL | Modifier.ABSTRACT | Modifier.PROTECTED)
protected interface ProtectedInterface {}
@ExpectedModifiers(Modifier.FINAL | Modifier.ABSTRACT | Modifier.PRIVATE)
private interface PrivateInterface {}
/*
* Relevant excerpt of the Class.getModifiers() specification:
*
* If this {@code Class} object represents a primitive type or
* void, its {@code public}, {@code abstract}, and {@code final}
* modifiers are always {@code true}.
*/
private static void testPrimitives() {
Class<?>[] testCases = {
void.class,
boolean.class,
byte.class,
short.class,
char.class,
int.class,
float.class,
long.class,
double.class,
};
for(var testCase : testCases) {
int actualModifiers = testCase.getModifiers();
if ((Modifier.PUBLIC | Modifier.ABSTRACT | Modifier.FINAL) !=
actualModifiers) {
throw new RuntimeException("Bad modifiers " +
Modifier.toString(actualModifiers) +
" on primitive type " + testCase);
}
}
}
}
@Retention(RetentionPolicy.RUNTIME)
@interface ExpectedModifiers {
int value() default 0;
}