undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,307 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8314263
* @summary Signed jars triggering Logger finder recursion and StackOverflowError
* @library /test/lib ../lib
* @compile/module=java.base share/classes/jdk/internal/event/EventHelper.java
* @modules java.base/jdk.internal.logger:+open
* @build jdk.test.lib.compiler.CompilerUtils
* jdk.test.lib.process.*
* jdk.test.lib.util.JarUtils
* jdk.test.lib.JDKToolLauncher
* @compile SignedLoggerFinderTest.java SimpleLoggerFinder.java
* @run main SignedLoggerFinderTest init
* @run main SignedLoggerFinderTest init sign
*/
import java.io.File;
import java.nio.file.*;
import java.security.*;
import java.util.*;
import java.util.function.*;
import java.util.jar.*;
import jdk.test.lib.JDKToolFinder;
import jdk.test.lib.JDKToolLauncher;
import jdk.test.lib.Utils;
import jdk.test.lib.process.OutputAnalyzer;
import jdk.test.lib.process.ProcessTools;
import jdk.test.lib.util.JarUtils;
import static java.nio.file.StandardCopyOption.REPLACE_EXISTING;
import static java.util.Arrays.asList;
public class SignedLoggerFinderTest {
/**
* This test triggers recursion in the broken JDK. The error can
* manifest in a few different ways.
* One error seen is "java.lang.NoClassDefFoundError:
* Could not initialize class jdk.internal.logger.LoggerFinderLoader$ErrorPolicy"
*
* The original reported error was a StackOverflow (also seen in different iterations
* of this run). Running test in signed and unsigned jar mode for sanity coverage.
* The current bug only manifests when jars are signed.
*/
private static boolean init = false;
private static boolean signJars = false;
private static boolean mutliThreadLoad = false;
private static volatile boolean testComplete = false;
private static final String KEYSTORE = "8314263.keystore";
private static final String ALIAS = "JavaTest";
private static final String STOREPASS = "changeit";
private static final String KEYPASS = "changeit";
private static final String DNAME = "CN=sample";
private static final String CUSTOM_LOGGER_FINDER_NAME =
"loggerfinder.SimpleLoggerFinder";
private static final String CUSTOM_LOGGER_NAME =
"loggerfinder.SimpleLoggerFinder$SimpleLogger";
private static final String INTERNAL_LOGGER_FINDER_NAME =
"sun.util.logging.internal.LoggingProviderImpl";
private static final String INTERNAL_LOGGER_NAME =
"sun.util.logging.internal.LoggingProviderImpl$JULWrapper";
private static final Path jarPath1 =
Path.of(System.getProperty("test.classes", "."), "SimpleLoggerFinder.jar");
private static final Path jarPath2 =
Path.of(System.getProperty("test.classes", "."), "SimpleLoggerFinder2.jar");
public static void main(String[] args) throws Throwable {
init = args.length >=1 && args[0].equals("init");
signJars = args.length >=2 && args[1].equals("sign");
// init only passed in by jtreg test run, initialize the environment
// for the subsequent test run
if (init) {
initialize();
launchTest(false, false);
launchTest(false, true);
launchTest(true, false);
launchTest(true, true);
} else {
// set up complete. Run the code to trigger the recursion
// We're in the JVM launched by ProcessTools.executeCommand
boolean multiThreadLoad = Boolean.getBoolean("multiThreadLoad");
boolean withCustomLoggerFinder = Boolean.getBoolean("withCustomLoggerFinder");
if (multiThreadLoad) {
long sleep = new Random().nextLong(100L) + 1L;
System.out.println("multi thread load sleep value: " + sleep);
new Thread(runnableWithSleep(
() -> System.getLogger("logger" + System.currentTimeMillis()),
sleep, "System.getLogger type: ")).start();
new Thread(runnableWithSleep(
() -> System.LoggerFinder.getLoggerFinder(),
sleep, "System.getLoggerFinder type: ")).start();
}
if (withCustomLoggerFinder) {
JarFile jf = new JarFile(jarPath1.toString(), true);
jf.getInputStream(jf.getJarEntry("loggerfinder/SimpleLoggerFinder.class"));
JarFile jf2 = new JarFile(jarPath2.toString(), true);
jf2.getInputStream(jf.getJarEntry("loggerfinder/SimpleLoggerFinder.class"));
} else {
// some other call to prod LoggerFinder loading
System.getLogger("random" + System.currentTimeMillis());
System.LoggerFinder.getLoggerFinder();
}
Security.setProperty("test_1", "test");
// some extra sanity checks
if (withCustomLoggerFinder) {
assertEquals(System.LoggerFinder.getLoggerFinder().getClass().getName(),
CUSTOM_LOGGER_FINDER_NAME);
System.Logger testLogger = System.getLogger("jdk.event.security");
assertEquals(testLogger.getClass().getName(), CUSTOM_LOGGER_NAME);
} else {
assertEquals(System.LoggerFinder.getLoggerFinder().getClass().getName(),
INTERNAL_LOGGER_FINDER_NAME);
System.Logger testLogger = System.getLogger("jdk.event.security");
assertEquals(testLogger.getClass().getName(), INTERNAL_LOGGER_NAME);
}
testComplete = true;
// LoggerFinder should be initialized, trigger a simple log call
Security.setProperty("test_2", "test");
// allow time to let bootstrap logger flush data
BootstrapLoggerUtils.awaitPending();
}
}
// helper to create the inner test. Run config variations with the LoggerFinder jars
// on the classpath and with other threads running System.Logger calls during load
private static void launchTest(boolean multiThreadLoad, boolean withCustomLoggerFinder) {
List<String> cmds = new ArrayList<>();
cmds.add(JDKToolFinder.getJDKTool("java"));
cmds.addAll(asList(Utils.getTestJavaOpts()));
if (withCustomLoggerFinder) {
cmds.addAll(List.of("-classpath",
System.getProperty("test.classes") + File.pathSeparator +
jarPath1.toString() + File.pathSeparator + jarPath2.toString(),
"-Dtest.classes=" + System.getProperty("test.classes")));
} else {
cmds.addAll(List.of("-classpath",
System.getProperty("test.classes")));
}
Path patches = Paths.get(System.getProperty("test.classes"), "patches", "java.base");
cmds.addAll(List.of(
// patch of EventHelper to log at INFO level (for bootstrap logger)
"--patch-module", "java.base=" + patches.toString(),
// allow test to access internal bootstrap logger functionality
"--add-opens=java.base/jdk.internal.logger=ALL-UNNAMED",
// following debug property seems useful to tickle the issue
"-Dsun.misc.URLClassPath.debug=true",
// console logger level to capture event output
"-Djdk.system.logger.level=DEBUG",
// useful for debug purposes
"-Djdk.logger.finder.error=DEBUG",
// enable logging to verify correct output
"-Djava.util.logging.config.file=" +
Path.of(System.getProperty("test.src", "."), "logging.properties")));
if (multiThreadLoad) {
cmds.add("-DmultiThreadLoad=true");
}
if (withCustomLoggerFinder) {
cmds.add("-DwithCustomLoggerFinder=true");
}
cmds.addAll(List.of(
"SignedLoggerFinderTest",
"no-init"));
try {
OutputAnalyzer outputAnalyzer = ProcessTools.executeCommand(cmds.stream()
.filter(t -> !t.isEmpty())
.toArray(String[]::new))
.shouldHaveExitValue(0);
if (withCustomLoggerFinder) {
outputAnalyzer
.shouldContain("TEST LOGGER: [test_1, test]")
.shouldContain("TEST LOGGER: [test_2, test]");
} else {
outputAnalyzer
.shouldContain("SecurityPropertyModification: key:test_1")
.shouldContain("SecurityPropertyModification: key:test_2");
}
if (withCustomLoggerFinder && signJars) {
// X509 cert generated during verification of signed jar file
outputAnalyzer
.shouldContain(DNAME);
}
} catch (Throwable t) {
throw new RuntimeException("Unexpected fail.", t);
}
}
private static Runnable runnableWithSleep(Supplier s, long sleep, String desc) {
return () -> {
while(!testComplete) {
System.out.println(desc + s.get().getClass().getName());
try {
Thread.sleep(sleep);
} catch (InterruptedException e) {
throw new RuntimeException(e);
}
}
};
}
private static void initialize() throws Throwable {
if (signJars) {
genKey();
}
Path classes = Paths.get(System.getProperty("test.classes", ""));
JarUtils.createJarFile(jarPath1,
classes,
classes.resolve("loggerfinder/SimpleLoggerFinder.class"),
classes.resolve("loggerfinder/SimpleLoggerFinder$SimpleLogger.class"));
JarUtils.updateJarFile(jarPath1, Path.of(System.getProperty("test.src")),
Path.of("META-INF", "services", "java.lang.System$LoggerFinder"));
if (signJars) {
signJar(jarPath1.toString());
}
// multiple signed jars with services to have ServiceLoader iteration
Files.copy(jarPath1, jarPath2, REPLACE_EXISTING);
}
private static void genKey() throws Throwable {
String keytool = JDKToolFinder.getJDKTool("keytool");
Files.deleteIfExists(Paths.get(KEYSTORE));
ProcessTools.executeCommand(keytool,
"-J-Duser.language=en",
"-J-Duser.country=US",
"-genkey",
"-keyalg", "rsa",
"-alias", ALIAS,
"-keystore", KEYSTORE,
"-keypass", KEYPASS,
"-dname", DNAME,
"-storepass", STOREPASS
).shouldHaveExitValue(0);
}
private static OutputAnalyzer signJar(String jarName) throws Throwable {
List<String> args = new ArrayList<>();
args.add("-verbose");
args.add(jarName);
args.add(ALIAS);
return jarsigner(args);
}
private static OutputAnalyzer jarsigner(List<String> extra)
throws Throwable {
JDKToolLauncher launcher = JDKToolLauncher.createUsingTestJDK("jarsigner")
.addVMArg("-Duser.language=en")
.addVMArg("-Duser.country=US")
.addToolArg("-keystore")
.addToolArg(KEYSTORE)
.addToolArg("-storepass")
.addToolArg(STOREPASS)
.addToolArg("-keypass")
.addToolArg(KEYPASS);
for (String s : extra) {
if (s.startsWith("-J")) {
launcher.addVMArg(s.substring(2));
} else {
launcher.addToolArg(s);
}
}
return ProcessTools.executeCommand(launcher.getCommand());
}
private static void assertEquals(String received, String expected) {
if (!expected.equals(received)) {
throw new RuntimeException("Received: " + received);
}
}
}

View file

@ -0,0 +1,74 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package loggerfinder;
import java.lang.*;
import java.util.*;
public class SimpleLoggerFinder extends System.LoggerFinder {
static {
try {
long sleep = new Random().nextLong(1000L) + 1L;
System.out.println("Logger finder service load sleep value: " + sleep);
// simulate a slow load service
Thread.sleep(sleep);
} catch (InterruptedException e) {
throw new RuntimeException(e);
}
}
@Override
public System.Logger getLogger(String name, Module module) {
return new SimpleLogger(name);
}
private static class SimpleLogger implements System.Logger {
private final String name;
public SimpleLogger(String name) {
this.name = name;
}
@Override
public String getName() {
return name;
}
@Override
public boolean isLoggable(Level level) {
return true;
}
@Override
public void log(Level level, ResourceBundle bundle, String msg, Throwable thrown) {
System.out.println("TEST LOGGER: " + msg);
}
@Override
public void log(Level level, ResourceBundle bundle, String format, Object... params) {
System.out.println("TEST LOGGER: " + Arrays.asList(params));
}
}
}

View file

@ -0,0 +1,155 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package jdk.internal.event;
import jdk.internal.access.JavaUtilJarAccess;
import jdk.internal.access.SharedSecrets;
import java.lang.invoke.MethodHandles;
import java.lang.invoke.VarHandle;
import java.time.Duration;
import java.time.Instant;
import java.util.Date;
import java.util.stream.Collectors;
import java.util.stream.LongStream;
/**
* A helper class to have events logged to a JDK Event Logger.
*/
public final class EventHelper {
private static final JavaUtilJarAccess JUJA = SharedSecrets.javaUtilJarAccess();
private static volatile boolean loggingSecurity;
private static volatile System.Logger securityLogger;
private static final VarHandle LOGGER_HANDLE;
static {
System.err.println("Patch version of EventHelper loaded");
try {
LOGGER_HANDLE =
MethodHandles.lookup().findStaticVarHandle(
EventHelper.class, "securityLogger", System.Logger.class);
} catch (ReflectiveOperationException e) {
throw new Error(e);
}
}
// a patch module to help this test ensure events are logged when
// bootstrap logger is in use
private static final System.Logger.Level LOG_LEVEL = System.Logger.Level.INFO;
// helper class used for logging security related events for now
private static final String SECURITY_LOGGER_NAME = "jdk.event.security";
public static void logTLSHandshakeEvent(Instant start,
String peerHost,
int peerPort,
String cipherSuite,
String protocolVersion,
long peerCertId) {
assert securityLogger != null;
String prepend = getDurationString(start);
securityLogger.log(LOG_LEVEL, prepend +
" TLSHandshake: {0}:{1,number,#}, {2}, {3}, {4,number,#}",
peerHost, peerPort, protocolVersion, cipherSuite, peerCertId);
}
public static void logSecurityPropertyEvent(String key,
String value) {
assert securityLogger != null;
securityLogger.log(LOG_LEVEL,
"SecurityPropertyModification: key:{0}, value:{1}", key, value);
}
public static void logX509ValidationEvent(long anchorCertId,
long[] certIds) {
assert securityLogger != null;
String codes = LongStream.of(certIds)
.mapToObj(Long::toString)
.collect(Collectors.joining(", "));
securityLogger.log(LOG_LEVEL,
"ValidationChain: {0,number,#}, {1}", anchorCertId, codes);
}
public static void logX509CertificateEvent(String algId,
String serialNum,
String subject,
String issuer,
String keyType,
int length,
long certId,
long beginDate,
long endDate) {
assert securityLogger != null;
securityLogger.log(LOG_LEVEL, "X509Certificate: Alg:{0}, Serial:{1}" +
", Subject:{2}, Issuer:{3}, Key type:{4}, Length:{5,number,#}" +
", Cert Id:{6,number,#}, Valid from:{7}, Valid until:{8}",
algId, serialNum, subject, issuer, keyType, length,
certId, new Date(beginDate), new Date(endDate));
}
/**
* Method to calculate a duration timestamp for events which measure
* the start and end times of certain operations.
* @param start Instant indicating when event started recording
* @return A string representing duraction from start time to
* time of this method call. Empty string is start is null.
*/
private static String getDurationString(Instant start) {
if (start != null) {
if (start.equals(Instant.MIN)) {
return "N/A";
}
Duration duration = Duration.between(start, Instant.now());
long micros = duration.toNanos() / 1_000;
if (micros < 1_000_000) {
return "duration = " + (micros / 1_000.0) + " ms:";
} else {
return "duration = " + ((micros / 1_000) / 1_000.0) + " s:";
}
} else {
return "";
}
}
/**
* Helper to determine if security events are being logged
* at a preconfigured logging level. The configuration value
* is read once at class initialization.
*
* @return boolean indicating whether an event should be logged
*/
public static boolean isLoggingSecurity() {
// Avoid a bootstrap issue where the commitEvent attempts to
// trigger early loading of System Logger but where
// the verification process still has JarFiles locked
if (securityLogger == null && !JUJA.isInitializing()) {
LOGGER_HANDLE.compareAndSet( null, System.getLogger(SECURITY_LOGGER_NAME));
loggingSecurity = securityLogger.isLoggable(LOG_LEVEL);
}
return loggingSecurity;
}
}

View file

@ -0,0 +1,13 @@
############################################################
# Configuration file for log testing
#
############################################################
handlers= java.util.logging.ConsoleHandler
.level= FINE
java.util.logging.ConsoleHandler.level = FINE
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
jdk.event.security.level = FINE