engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

70
test/jdk/java/net/URLEncoder/DecodeNonEncoded.java Normal file
View file

@ -0,0 +1,70 @@
/*
* Copyright (c) 2000, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4307323
* @summary Test URLDecoder on strings that are not legally
* encoded. Incomplete escape patterns or illegal hex characters will cause
* an exception to be thrown. Otherwise, illegal characters will be
* silently accepted.
*
*/
import java.net.URLDecoder;
public class DecodeNonEncoded {
static String[] errorStrings
= {"%", "%A", "Hello%", "%xy", "%az", "%ab%q"};
static String[] ignoreStrings = {"#", "X@Y", "Hello There"};
public static void main(String[] args) throws Exception {
for (int i = 0; i < errorStrings.length; i++) {
try {
URLDecoder.decode(errorStrings[i]);
throw new Exception("String \"" + errorStrings[i]
+ "\" should have failed in URLDecoder.decode!");
} catch (IllegalArgumentException e) {
// All ok. Got to next string.
System.out.println("String \"" + errorStrings[i]
+ "\" correctly threw IllegalArgumentException: "
+ e.getMessage());
}
}
String temp;
for (int i = 0; i < ignoreStrings.length; i++) {
temp = URLDecoder.decode(ignoreStrings[i]);
if (!temp.equals(ignoreStrings[i]))
throw new Exception("String \"" + ignoreStrings[i]
+ "\" was converted to " + temp
+" by URLDecoder.decode to ");
else
System.out.println("String \"" + temp
+ "\" was left unchanged by URLDecoder.decode.");
}
}
}

73
test/jdk/java/net/URLEncoder/Decoder.java Normal file
View file

@ -0,0 +1,73 @@
/*
* Copyright (c) 2001, 2002, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 4407610
* @summary java.net.URLDecode.decode(st,"UTF-16") works incorrectly on '+' sign
*/
import java.net.*;
public class Decoder {
public static void main(String args[]) throws Exception {
boolean passed = true;
String enc = "UTF-16";
String strings[] = {
"\u0100\u0101",
"\u0100 \u0101",
"\u0100 \u0101\u0102",
"\u0100 \u0101 \u0102",
"\u0100C\u0101 \u0102",
"\u0100\u0101\u0102",
"?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&?&",
"foobar",
"foo?bar"
};
for (int i = 0; i < strings.length; i++) {
String encoded = URLEncoder.encode(strings[i], enc);
System.out.println("ecnoded: " + encoded);
String decoded = URLDecoder.decode(encoded, enc);
System.out.print("init: ");
printString(strings[i]);
System.out.print("decoded: ");
printString(decoded);
if (strings[i].equals(decoded)) {
System.out.println(" - correct - \n");
} else {
System.out.println(" - incorrect - \n");
throw new RuntimeException ("Unexpected decoded output on string " + i);
}
}
}
static void printString(String s) {
for (int i = 0; i < s.length(); i++) {
System.out.print((int)s.charAt(i) + " ");
}
System.out.println();
}
}

97
test/jdk/java/net/URLEncoder/EncodingTest.java Normal file
View file

@ -0,0 +1,97 @@
/*
* Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.net.URLDecoder;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import org.testng.Assert;
import org.testng.annotations.DataProvider;
import org.testng.annotations.Test;
/**
* @test
* @bug 8183743
* @summary Test to verify the new overload method with Charset functions the same
* as the existing method that takes a charset name.
* @run testng EncodingTest
*/
public class EncodingTest {
public static enum ParameterType {
STRING,
CHARSET
}
@DataProvider(name = "encode")
public Object[][] getDecodeParameters() {
return new Object[][]{
{"The string \u00FC@foo-bar"},
// the string from javadoc example
{""}, // an empty string
{"x"}, // a string of length 1
{"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-.*"},
// the string of characters should remain the same
{charactersRange('\u0000', '\u007F')},
// a string of characters from 0 to 127
{charactersRange('\u0080', '\u00FF')},
// a string of characters from 128 to 255
{"\u0100 \u0101 \u0555 \u07FD \u07FF"},
// a string of Unicode values can be expressed as 2 bytes
{"\u8000 \u8001 \uA000 \uFFFD \uFFFF"}, // a string of Unicode values can be expressed as 3 bytes
};
}
/**
* Verifies that the new overload method returns the same result as the
* existing method.
*
* @param s the string to be encoded
* @throws Exception if the test fails
*/
@Test(dataProvider = "encode")
public void encode(String s) throws Exception {
String encoded1 = URLEncoder.encode(s, StandardCharsets.UTF_8.name());
String encoded2 = URLEncoder.encode(s, StandardCharsets.UTF_8);
Assert.assertEquals(encoded1, encoded2);
// cross check
String returned1 = URLDecoder.decode(encoded1, StandardCharsets.UTF_8.name());
String returned2 = URLDecoder.decode(encoded2, StandardCharsets.UTF_8);
Assert.assertEquals(returned1, returned2);
}
String charactersRange(char c1, char c2) {
StringBuilder sb = new StringBuilder(c2 - c1);
for (char c = c1; c < c2; c++) {
sb.append(c);
}
return sb.toString();
}
}

91
test/jdk/java/net/URLEncoder/SurrogatePairs.java Normal file
View file

@ -0,0 +1,91 @@
/*
* Copyright (c) 2001, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4396708
* @summary Test URL encoder and decoder on a string that contains
* surrogate pairs.
* @run junit SurrogatePairs
*/
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.MethodSource;
import java.net.URLDecoder;
import java.net.URLEncoder;
import java.util.stream.Collectors;
import static java.nio.charset.StandardCharsets.UTF_8;
import static org.junit.jupiter.api.Assertions.*;
/*
* Surrogate pairs are two character Unicode sequences where the first
* character lies in the range [d800, dbff] and the second character lies
* in the range [dc00, dfff]. They are used as an escaping mechanism to add
* 1M more characters to Unicode.
*/
public class SurrogatePairs {
public static String[][] arguments() {
return new String[][] {
{"\uD800\uDC00", "%F0%90%80%80"},
{"\uD800\uDFFF", "%F0%90%8F%BF"},
{"\uDBFF\uDC00", "%F4%8F%B0%80"},
{"\uDBFF\uDFFF", "%F4%8F%BF%BF"},
{"1\uDBFF\uDC00", "1%F4%8F%B0%80"},
{"@\uDBFF\uDC00", "%40%F4%8F%B0%80"},
{"\uDBFF\uDC001", "%F4%8F%B0%801"},
{"\uDBFF\uDC00@", "%F4%8F%B0%80%40"},
{"\u0101\uDBFF\uDC00", "%C4%81%F4%8F%B0%80"},
{"\u0101\u0101\u0101\u0101\u0101\u0101\uDBFF\uDC00\u0101", "%C4%81%C4%81%C4%81%C4%81%C4%81%C4%81%F4%8F%B0%80%C4%81"},
{"\u0101\u0101\u0101\u0101\u0101\u0101\u0101\uDBFF\uDC00\u0101", "%C4%81%C4%81%C4%81%C4%81%C4%81%C4%81%C4%81%F4%8F%B0%80%C4%81"},
{"\u0101\u0101\u0101\u0101\u0101\u0101\u0101\u0101\uDBFF\uDC00\u0101", "%C4%81%C4%81%C4%81%C4%81%C4%81%C4%81%C4%81%C4%81%F4%8F%B0%80%C4%81"},
{"\uDBFF\uDC00\u0101", "%F4%8F%B0%80%C4%81"},
{"\uDE0A\uD83D", "%3F%3F"},
{"1\uDE0A\uD83D", "1%3F%3F"},
{"@\uDE0A\uD83D", "%40%3F%3F"},
{"1@1\uDE0A\uD800\uDC00 \uD83D", "1%401%3F%F0%90%80%80+%3F"}
};
}
@ParameterizedTest
@MethodSource("arguments")
public void test(String str, String correctEncoding) {
String encoded = URLEncoder.encode(str, UTF_8);
assertEquals(correctEncoding, encoded, () ->
"str=%s, expected=%s, actual=%s"
.formatted(escape(str), escape(correctEncoding), escape(encoded)));
// Map unmappable characters to '?'
String cleanStr = new String(str.getBytes(UTF_8), UTF_8);
String decoded = URLDecoder.decode(encoded, UTF_8);
assertEquals(cleanStr, decoded, () ->
"expected=%s, actual=%s".formatted(escape(str), escape(decoded)));
}
private static String escape(String s) {
return s.chars().mapToObj(c -> String.format("\\u%04x", c))
.collect(Collectors.joining());
}
}

127
test/jdk/java/net/URLEncoder/URLEncodeDecode.java Normal file
View file

@ -0,0 +1,127 @@
/*
* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4257115
* @summary Test URL encoder and decoder on a string that contains
* characters within and beyond the 8859-1 range.
*
*/
import java.io.*;
import java.net.*;
public class URLEncodeDecode {
static char chars[] = {'H', 'e', 'l', 'l', 'o',
' ', '+', '%',
'-', '_', '.', '!', '~', '*', '\'', '(',
')',
'@',
'\u00ae', '\u0101', '\u10a0'};
static String str = new String(chars);
static String correctEncodedUTF8 =
"Hello+%2B%25-_.%21%7E*%27%28%29%40%C2%AE%C4%81%E1%82%A0";
public static void main(String[] args) throws Exception {
System.out.println("Constructed the string: " + str);
System.out.println("The Unicode bytes are: " +
getHexBytes(str));
System.out.println("");
test("UTF-8", correctEncodedUTF8);
}
private static void test(String enc, String correctEncoded)
throws Exception{
String encoded = null;
String outStr = null;
if (enc == null) {
encoded = URLEncoder.encode(str);
outStr = "default";
}
else {
encoded = URLEncoder.encode(str, enc);
outStr = enc;
}
System.out.println("URLEncode it ("
+ outStr + ") : " + encoded);
System.out.println("The Unicode bytes are: " +
getHexBytes(encoded));
if (encoded.equals(correctEncoded))
System.out.println("The encoding is correct!");
else {
throw new Exception("The encoding is incorrect!" +
" It should be " + correctEncoded);
}
System.out.println("");
String decoded = null;
if (enc == null)
decoded = URLDecoder.decode(encoded);
else
decoded = URLDecoder.decode(encoded, enc);
System.out.println("URLDecode it ("
+ outStr + ") : " + decoded);
System.out.println("The Unicode bytes are: " +
getHexBytes(decoded));
if (str.equals(decoded))
System.out.println("The decoding is correct");
else {
throw new Exception("The decoded is not equal to the original");
}
}
private static String getHexBytes(String s) throws Exception {
StringBuffer sb = new StringBuffer();
for (int i = 0; i < s.length(); i++) {
int a = s.charAt(i);
int b1 = (a >>8) & 0xff;
int b2 = (byte)a;
int b11 = (b1>>4) & 0x0f;
int b12 = b1 & 0x0f;
int b21 = (b2 >>4) & 0x0f;
int b22 = b2 & 0x0f;
sb.append(Integer.toHexString(b11));
sb.append(Integer.toHexString(b12));
sb.append(Integer.toHexString(b21));
sb.append(Integer.toHexString(b22));
sb.append(' ');
}
return sb.toString();
}
}

48
test/jdk/java/net/URLEncoder/URLEncoderEncodeArgs.java Normal file
View file

@ -0,0 +1,48 @@
/*
* Copyright (c) 2001, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 4395472
* @summary java.net.URLEncode.encode(s, enc) treats an empty encoding name as "UTF-8"
*/
import java.net.URLEncoder;
import java.io.UnsupportedEncodingException;
public class URLEncoderEncodeArgs {
public static void main (String[] args) {
try {
String s1 = URLEncoder.encode ("Hello World", (String)null);
} catch (UnsupportedEncodingException e) {
throw new RuntimeException ("NPE should have been thrown");
} catch (NullPointerException e) {
try {
String s2 = URLEncoder.encode ("Hello World", "");
} catch (UnsupportedEncodingException ee) {
return;
}
throw new RuntimeException ("empty string was accepted as encoding name");
}
throw new RuntimeException ("null reference was accepted as encoding name");
}
}