engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

68
test/jdk/java/net/URLPermission/EmptyAuthorityTest.java Normal file
View file

@ -0,0 +1,68 @@
/*
* Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8367049
* @summary URLPermission must reject empty/missing host authority with IAE (no SIOOBE)
* @run testng EmptyAuthorityTest
*/
import java.net.URLPermission;
import org.testng.Assert;
import org.testng.annotations.DataProvider;
import org.testng.annotations.Test;
public class EmptyAuthorityTest {
@DataProvider(name = "badUrls")
public Object[][] badUrls() {
return new Object[][]{
{ "http:///path" }, // empty authority
{ "https:///x" }, // empty authority
{ "http://@/x" }, // userinfo + empty host
{ "http://user@/x" }, // userinfo + empty host
{ "http://[]/x" } // empty IPv6 literal
};
}
@DataProvider(name = "goodUrls")
public Object[][] goodUrls() {
return new Object[][]{
{ "http://example.com/x" },
{ "http://example.com:80/x" },
{ "http://[::1]/x" },
{ "http://[::1]:8080/x" }
};
}
@Test(dataProvider = "badUrls")
public void rejectsEmptyOrMalformedAuthority(String url) {
Assert.expectThrows(IllegalArgumentException.class, () -> new URLPermission(url));
}
@Test(dataProvider = "goodUrls")
public void acceptsValidAuthorities(String url) {
new URLPermission(url); // should not throw
}
}

57
test/jdk/java/net/URLPermission/InvalidCharacterTest.java Normal file
View file

@ -0,0 +1,57 @@
/*
* Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.net.URLPermission;
import org.testng.Assert;
import org.testng.annotations.Test;
/**
* @test
* @bug 8297311
* @summary Verify that the exception thrown by URLPermission class, for invalid host name,
* contains expected exception message
* @run testng InvalidCharacterTest
*/
public class InvalidCharacterTest {
/**
* Creates an instance of URLPermission with a string containing invalid character
* and verifies that the construction fails with IllegalArgumentException
*/
@Test
public void testIllegalArgException() throws Exception {
final char invalidChar = '%';
// we expect this string in the exception message
final String expectedStringInMessage = String.format("\\u%04x", (int) invalidChar);
final String url = "http://foo" + invalidChar + "bar.com:12345";
final IllegalArgumentException iae = Assert.expectThrows(IllegalArgumentException.class,
() -> new URLPermission(url));
// additionally check the error message contains the invalid char
final String exMessage = iae.getMessage();
System.out.println("Got exception message: " + exMessage);
Assert.assertNotNull(exMessage, "Exception message is null");
Assert.assertTrue(exMessage.contains(expectedStringInMessage),
expectedStringInMessage + " missing from exception message: " + exMessage);
}
}

100
test/jdk/java/net/URLPermission/OpenURL.java Normal file
View file

@ -0,0 +1,100 @@
/*
* Copyright (c) 2013, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8029354
* @library /test/lib
* @run main/othervm OpenURL
*/
import java.net.*;
import java.io.*;
import java.nio.charset.StandardCharsets;
import java.util.concurrent.atomic.AtomicBoolean;
import jdk.test.lib.net.URIBuilder;
import static java.net.Proxy.NO_PROXY;
public class OpenURL {
public static void main (String[] args) throws Exception {
// minimal HTTP/1.1 reply
final String reply = "HTTP/1.1 200 OK\r\n"+
"Connection: close\r\n" +
"Content-Length: 0\r\n\r\n";
try (ServerSocket serverSocket = new ServerSocket()) {
serverSocket.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
final AtomicBoolean done = new AtomicBoolean();
final Thread serverThread = new Thread(() -> {
while (!done.get()) {
try (Socket ss = serverSocket.accept()) {
ss.getOutputStream().write(reply.getBytes(StandardCharsets.US_ASCII));
ss.getOutputStream().close();
// Give a chance to the peer to close the socket first...
Thread.sleep(100);
// Reads the request headers - avoids Connection reset
BufferedReader reader = new BufferedReader(new InputStreamReader(ss.getInputStream()));
String line;
do {
System.out.println("Server: " + (line = reader.readLine()));
} while (!line.isBlank());
} catch (Exception x) {
if (!done.get()) {
// Something else than the expected client
// might have connected...
x.printStackTrace();
}
}
}
});
serverThread.start();
try {
URL url = URIBuilder.newBuilder()
.scheme("http")
.userInfo("joe")
.loopback()
.port(serverSocket.getLocalPort())
.path("/a/b")
.toURL();
System.out.println("URL: " + url);
// will throw if not fixed
URLPermission perm = new URLPermission(url.toString(), "listen,read,resolve");
System.out.println("Permission: " + perm);
// may throw if not fixed
HttpURLConnection urlc = (HttpURLConnection) url.openConnection(NO_PROXY);
InputStream is = urlc.getInputStream();
} finally {
// make sure the server thread eventually exit
done.set(true);
serverSocket.close();
}
serverThread.join();
System.out.println("OpenURL: OK");
}
}
}

573
test/jdk/java/net/URLPermission/URLPermissionTest.java Normal file
View file

@ -0,0 +1,573 @@
/*
* Copyright (c) 2013, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.net.URLPermission;
import java.io.*;
/**
* @test
* @bug 8010464 8027570 8027687 8029354 8114860 8071660 8161291 8294378
* @run main URLPermissionTest
* @run main/othervm -Duser.language=tr URLPermissionTest
*/
public class URLPermissionTest {
// super class for all test types
abstract static class Test {
boolean expected;
abstract boolean execute();
};
// Instantiation: should succeed
static class CreateTest extends Test {
String arg;
CreateTest(String arg) {
this.arg = arg;
}
@Override
boolean execute() {
try {
URLPermission p = new URLPermission(arg);
return true;
} catch (Exception e) {
return false;
}
}
};
static CreateTest createtest(String arg) {
return new CreateTest(arg);
}
// Should throw an IAE on construction
static class ExTest extends Test {
String arg;
ExTest(String arg) {
this.arg = arg;
}
@Override
boolean execute() {
try {
URLPermission p = new URLPermission(arg);
return false;
} catch (IllegalArgumentException e) {
return true;
}
}
};
static ExTest extest(String arg) {
return new ExTest(arg);
}
// Tests URL part of implies() method. This is the main test.
static class URLImpliesTest extends Test {
String arg1, arg2;
URLImpliesTest(String arg1, String arg2, boolean expected) {
this.arg1 = arg1;
this.arg2 = arg2;
this.expected = expected;
}
boolean execute() {
URLPermission p1 = new URLPermission (arg1, "GET:*");
URLPermission p2 = new URLPermission (arg2, "GET:*");
boolean result = p1.implies(p2);
if (result != expected) {
System.out.println("p1 = " + p1);
System.out.println("p2 = " + p2);
}
return result == expected;
}
};
static URLImpliesTest imtest(String arg1, String arg2, boolean expected) {
return new URLImpliesTest(arg1, arg2, expected);
}
static class ActionImpliesTest extends Test {
String arg1, arg2;
String url1 = "http://www.foo.com/-";
String url2 = "http://www.foo.com/a/b";
ActionImpliesTest(String arg1, String arg2, boolean expected) {
this.arg1 = arg1;
this.arg2 = arg2;
this.expected = expected;
}
ActionImpliesTest(String ur11, String url2, String arg1, String arg2,
boolean expected) {
this.url1 = ur11;
this.url2 = url2;
this.arg1 = arg1;
this.arg2 = arg2;
this.expected = expected;
}
@Override
boolean execute() {
URLPermission p1 = new URLPermission(url1, arg1);
URLPermission p2 = new URLPermission(url2, arg2);
boolean result = p1.implies(p2);
return result == expected;
}
}
static ActionsStringTest actionstest(String arg, String expectedActions) {
return new ActionsStringTest(arg, expectedActions);
}
static class ActionsStringTest extends Test {
String expectedActions;
String arg;
public ActionsStringTest(String arg, String expectedActions) {
this.arg = arg;
this.expectedActions = expectedActions;
}
@Override
boolean execute() {
String url = "http://www.foo.com/";
URLPermission urlp = new URLPermission(url, arg);
return (expectedActions.equals(urlp.getActions()));
}
}
static ActionImpliesTest actest(String arg1, String arg2, boolean expected) {
return new ActionImpliesTest(arg1, arg2, expected);
}
static ActionImpliesTest actest(String url1, String url2, String arg1,
String arg2, boolean expected) {
return new ActionImpliesTest(url1, url2, arg1, arg2, expected);
}
static class HashCodeTest extends Test {
String arg1, arg2;
int hash;
HashCodeTest(String arg1, String arg2, int hash) {
this.arg1 = arg1;
this.arg2 = arg2;
this.hash = hash;
}
@Override
boolean execute() {
URLPermission p = new URLPermission(arg1, arg2);
int h = p.hashCode();
return h == hash;
}
}
static HashCodeTest hashtest(String arg1, String arg2, int expected) {
return new HashCodeTest(arg1, arg2, expected);
}
static class URLEqualityTest extends Test {
String arg1, arg2;
URLEqualityTest(String arg1, String arg2, boolean expected) {
this.arg1 = arg1;
this.arg2 = arg2;
this.expected = expected;
}
@Override
boolean execute() {
URLPermission p1 = new URLPermission(arg1);
URLPermission p2 = new URLPermission(arg2);
boolean result = p1.equals(p2);
return result == expected;
}
}
static URLEqualityTest eqtest(String arg1, String arg2, boolean expected) {
return new URLEqualityTest(arg1, arg2, expected);
}
static Test[] pathImplies = {
// single
imtest("http://www.foo.com/", "http://www.foo.com/", true),
imtest("http://www.bar.com/", "http://www.foo.com/", false),
imtest("http://www.foo.com/a/b", "http://www.foo.com/", false),
imtest("http://www.foo.com/a/b", "http://www.foo.com/a/b/c", false),
// wildcard
imtest("http://www.foo.com/a/b/*", "http://www.foo.com/a/b/c", true),
imtest("http://www.foo.com/a/b/*", "http://www.foo.com/a/b/*", true),
imtest("http://www.foo.com/a/b/*", "http://www.foo.com/a/b/c#frag", true),
imtest("http://www.foo.com/a/b/*", "http://www.foo.com/a/b/c#frag?foo=foo", true),
imtest("http://www.foo.com/a/b/*", "http://www.foo.com/b/b/c", false),
imtest("http://www.foo.com/a/b/*", "http://www.foo.com/a/b/c.html", true),
imtest("http://www.foo.com/a/b/*", "http://www.foo.com/a/b/c.html", true),
imtest("http://www.foo.com/a/b/*", "https://www.foo.com/a/b/c", false),
// recursive
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/a/b/-", true),
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/a/b/c", true),
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/a/b/c#frag", true),
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/a/b/c#frag?foo=foo", true),
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/b/b/c", false),
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/a/b/c.html", true),
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/a/b/c.html", true),
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/a/b/c/d/e.html", true),
imtest("https://www.foo.com/a/b/-", "http://www.foo.com/a/b/c/d/e.html", false),
imtest("http://www.foo.com/a/b/-", "http://www.foo.com/a/b/c/d/e#frag", true),
imtest("http://www.foo.com/a/b/-", "https://www.foo.com/a/b/c", false),
// special cases
imtest("http:*", "https://www.foo.com/a/b/c", false),
imtest("http:*", "http://www.foo.com/a/b/c", true),
imtest("http:*", "http://foo/bar", true),
imtest("http://WWW.foO.cOM/a/b/*", "http://wwW.foo.com/a/b/c", true),
imtest("http://wWw.fOo.cOm/a/b/*", "http://Www.foo.com/a/b/*", true),
imtest("http://www.FOO.com/", "http://www.foo.COM/", true),
imtest("http://66ww-w.F-O012O.com/", "http://66ww-w.f-o012o.COM/",true),
imtest("http://xn--ire-9la.com/", "http://xn--ire-9la.COM/", true),
imtest("http://x/", "http://X/", true),
imtest("http://x/", "http://x/", true),
imtest("http://X/", "http://X/", true),
imtest("http://foo/bar", "https://foo/bar", false),
imtest("http://www.foo.com/*", "http://www.foo.com/#foo", true),
imtest("http://www.foo.com/a/*#foo", "http://www.foo.com/a/b#foo", true),
imtest("http://www.foo.com/a/-", "http://www.foo.com/a/b#foo", true),
imtest("http://www.foo.com/?q1=1&q2=2#foo", "http://www.foo.com/?q1=1&q2=2#bar", true),
imtest("http://www.foo.com/", "http://www.foo.com/?q1=1&q2=2#bar", true),
imtest("http://www.foo.com/", "http://www.foo.com?q1=1&q2=2#bar", false),
imtest("http://www.foo.com", "http://www.foo.com?q1=1&q2=2#bar", true)
};
// new functionality
static Test[] exceptionTests = {
extest("http://1.2.3.4.5/a/b/c"),
extest("http://www.*.com"),
extest("http://[foo.com]:99"),
extest("http://[fec0::X]:99"),
extest("http:\\www.foo.com"),
extest("http://w_09ww.foo.com"),
extest("http://w&09ww.foo.com/p"),
extest("http://www+foo.com"),
extest("http:")
};
static Test[] hashTests = {
hashtest("http://www.foo.com/path", "GET:X-Foo", 388644203),
hashtest("http:*", "*:*", 3255810)
};
static Test[] pathImplies2 = {
imtest("http://[FE80::]:99", "http://[fe80:0::]:99", true),
// hostnames
imtest("http://*.foo.com/a/b/-", "http://www.foo.com/a/b/c/d", true),
imtest("http://*.foo.com/a/b/-", "http://www.bar.com/a/b/c/d", false),
imtest("http://*.foo.com/a/b/-", "http://www.biz.bar.foo.com/a/b/c/d", true),
imtest("http://*.foo.com/a/b/-", "http://www.biz.bar.foo.como/a/b/c/d", false),
imtest("http://*/a/b/-", "http://www.biz.bar.foo.fuzz/a/b/c/d", true),
imtest("http://*/a/b/-", "http://*/a/b/c/d", true),
imtest("http://*.foo.com/a/b/-", "http://*/a/b/c/d", false),
imtest("http:*", "http://*/a/b/c/d", true),
// literal IPv4 addresses
imtest("http://1.2.3.4/a/b/-", "http://www.biz.bar.foo.com/a/b/c/d", false),
imtest("http://1.2.3.4/a/b/-", "http://1.2.3.4/a/b/c/d", true),
imtest("http://1.2.3.4/a/b/-", "http://1.2.88.4/a/b/c/d", false),
imtest("http:*", "http://1.2.88.4/a/b/c/d", true),
// literal IPv6 addresses
imtest("http://[fe80::]/a/b/-", "http://[fe80::0]/a/b/c", true),
imtest("http://[fe80::]/a/b/-", "http://[fe80::3]/a/b/c", false),
imtest("http://[1:2:3:4:5:6:7:8]/a/b/-","http://[1:002:03:4:0005:6:07:8]/a/b/c", true),
imtest("http://[1:2:3:4:5:6:7:8]/a/b/-","http://[1:002:03:4:0033:6:07:8]/a/b/c", false),
imtest("http://[1::2]/a/b/-", "http://[1:0:0:0::2]/a/b/c", true),
imtest("http://[1::2]/a/b/-", "http://[1:0:0:0::3]/a/b/c", false),
imtest("http://[FE80::]:99", "http://[fe80:0::]:99", true),
imtest("http:*", "http://[fe80:0::]:99", true),
// portranges
imtest("http://*.foo.com:1-2/a/b/-", "http://www.foo.com:1/a/b/c/d", true),
imtest("http://*.foo.com:1-2/a/b/-", "http://www.foo.com:3/a/b/c/d", false),
imtest("http://*.foo.com:3-/a/b/-", "http://www.foo.com:1/a/b/c/d", false),
imtest("http://*.foo.com:3-/a/b/-", "http://www.foo.com:4-5/a/b/c/d", true),
imtest("http://*.foo.com:3-/a/b/-", "http://www.foo.com:3-3/a/b/c/d", true),
imtest("http://*.foo.com:3-99/a/b/-", "http://www.foo.com:55-100/a/b/c/d", false),
imtest("http://*.foo.com:-44/a/b/-", "http://www.foo.com:1/a/b/c/d", true),
imtest("http://*.foo.com:-44/a/b/-", "http://www.foo.com:1-10/a/b/c/d", true),
imtest("http://*.foo.com:-44/a/b/-", "http://www.foo.com:44/a/b/c/d", true),
imtest("http://*.foo.com:-44/a/b/-", "http://www.foo.com:45/a/b/c/d", false),
imtest("http://www.foo.com:70-90/a/b", "http://www.foo.com/a/b", true),
imtest("https://www.foo.com/a/b", "https://www.foo.com:80/a/b", false),
imtest("https://www.foo.com:70-90/a/b", "https://www.foo.com/a/b", false),
imtest("https://www.foo.com/a/b", "https://www.foo.com:443/a/b", true),
imtest("https://www.foo.com:200-500/a/b", "https://www.foo.com/a/b", true),
imtest("http://www.foo.com:*/a/b", "http://www.foo.com:1-12345/a/b", true),
imtest("http://host/a/b", "http://HOST/a/b", true),
// misc
imtest("https:*", "http://www.foo.com", false),
imtest("https:*", "http:*", false)
};
static final String FOO_URL = "http://www.foo.com/";
static final String BAR_URL = "http://www.bar.com/";
static Test[] actionImplies = {
actest("GET", "GET", true),
actest("GET", "POST", false),
actest("GET:", "PUT", false),
actest("GET:", "GET", true),
actest("GET,POST", "GET", true),
actest("GET,POST:", "GET", true),
actest("GET:X-Foo", "GET:x-foo", true),
actest("GET:X-Foo,X-bar", "GET:x-foo", true),
actest("GET:X-Foo", "GET:x-boo", false),
actest("GET:X-Foo,X-Bar", "GET:x-bar,x-foo", true),
actest("GET:X-Bar,X-Foo,X-Bar,Y-Foo", "GET:x-bar,x-foo", true),
actest("GET:*", "GET:x-bar,x-foo", true),
actest("*:*", "GET:x-bar,x-foo", true),
actest("", "GET:x-bar,x-foo", false),
actest("GET:x-bar,x-foo", "", true),
actest("", "", true),
actest("GET,DELETE", "GET,DELETE:x-foo", false),
actest(FOO_URL, BAR_URL, "", "GET:x-bar,x-foo", false),
actest(FOO_URL, BAR_URL, "GET:x-bar,x-foo", "", false),
actest(FOO_URL, BAR_URL, "", "", false)
};
static Test[] actionsStringTest = {
actionstest("", ":"),
actionstest(":", ":"),
actionstest(":X-Bar", ":X-Bar"),
actionstest("GET", "GET:"),
actionstest("get", "GET:"),
actionstest("GET,POST", "GET,POST:"),
actionstest("GET,post", "GET,POST:"),
actionstest("get,post", "GET,POST:"),
actionstest("get,post,DELETE", "DELETE,GET,POST:"),
actionstest("GET,POST:", "GET,POST:"),
actionstest("GET:X-Foo,X-bar", "GET:X-Bar,X-Foo"),
actionstest("GET,POST,DELETE:X-Bar,X-Foo,X-Bar,Y-Foo", "DELETE,GET,POST:X-Bar,X-Bar,X-Foo,Y-Foo")
};
static Test[] equalityTests = {
eqtest("http://www.foo.com", "http://www.FOO.CoM", true),
eqtest("http://[fe80:0:0::]:1-2", "HTTP://[FE80::]:1-2", true),
eqtest("HTTP://1.2.3.5/A/B/C", "http://1.2.3.5/A/b/C", false),
eqtest("HTTP://1.2.3.5/A/B/C", "HTTP://1.2.3.5/A/b/C", false),
eqtest("http:*", "http:*", true),
eqtest("http://www.foo.com/a/b", "https://www.foo.com/a/b", false),
eqtest("http://w.foo.com", "http://w.foo.com/", false),
eqtest("http://*.foo.com", "http://*.foo.com", true),
eqtest("http://www.foo.com/a/b", "http://www.foo.com:80/a/b", true),
eqtest("http://www.foo.com/a/b", "http://www.foo.com:82/a/b", false),
eqtest("https://www.foo.com/a/b", "https://www.foo.com:443/a/b", true),
eqtest("https://www.foo.com/a/b", "https://www.foo.com:444/a/b", false),
eqtest("http://michael@foo.com/bar","http://michael@foo.com/bar", true),
eqtest("http://Michael@foo.com/bar","http://michael@goo.com/bar",false),
eqtest("http://michael@foo.com/bar","http://george@foo.com/bar", true),
eqtest("http://@foo.com/bar","http://foo.com/bar", true),
eqtest("http://www.IOU.com", "http://www.iou.com", true),
eqtest("HTTPI://www.IOU.com", "httpi://www.iou.com", true)
};
static Test[] createTests = {
createtest("http://user@foo.com/a/b/c"),
createtest("http://user:pass@foo.com/a/b/c"),
createtest("http://user:@foo.com/a/b/c"),
createtest("http://foo_bar"),
createtest("http://foo_bar:12345")
};
static boolean failed = false;
public static void main(String args[]) throws Exception {
for (int i=0; i<pathImplies.length ; i++) {
URLImpliesTest test = (URLImpliesTest)pathImplies[i];
Exception caught = null;
boolean result = false;
try {
result = test.execute();
} catch (Exception e) {
caught = e;
e.printStackTrace();
}
if (!result) {
failed = true;
System.out.printf("path test %d failed: %s : %s\n", i, test.arg1,
test.arg2);
} else {
System.out.println ("path test " + i + " OK");
}
}
// new tests for functionality added in revision of API
for (int i=0; i<pathImplies2.length ; i++) {
URLImpliesTest test = (URLImpliesTest)pathImplies2[i];
Exception caught = null;
boolean result = false;
try {
result = test.execute();
} catch (Exception e) {
caught = e;
e.printStackTrace();
}
if (!result) {
failed = true;
System.out.printf("path2 test %d failed: %s : %s\n", i, test.arg1,
test.arg2);
} else {
System.out.println ("path2 test " + i + " OK");
}
}
for (int i=0; i<equalityTests.length ; i++) {
URLEqualityTest test = (URLEqualityTest)equalityTests[i];
Exception caught = null;
boolean result = false;
try {
result = test.execute();
} catch (Exception e) {
caught = e;
e.printStackTrace();
}
if (!result) {
failed = true;
System.out.printf("equality test %d failed: %s : %s\n", i, test.arg1,
test.arg2);
} else {
System.out.println ("equality test " + i + " OK");
}
}
for (int i=0; i<hashTests.length; i++) {
HashCodeTest test = (HashCodeTest)hashTests[i];
boolean result = test.execute();
if (!result) {
System.out.printf ("test failed: %s %s %d\n", test.arg1, test.arg2, test.hash);
failed = true;
} else {
System.out.println ("hash test " + i + " OK");
}
}
for (int i=0; i<exceptionTests.length; i++) {
ExTest test = (ExTest)exceptionTests[i];
boolean result = test.execute();
if (!result) {
System.out.println ("test failed: " + test.arg);
failed = true;
} else {
System.out.println ("exception test " + i + " OK");
}
}
for (int i=0; i<createTests.length; i++) {
CreateTest test = (CreateTest)createTests[i];
boolean result = test.execute();
if (!result) {
System.out.println ("test failed: " + test.arg);
failed = true;
} else {
System.out.println ("create test " + i + " OK");
}
}
for (int i=0; i<actionImplies.length ; i++) {
ActionImpliesTest test = (ActionImpliesTest)actionImplies[i];
Exception caught = null;
boolean result = false;
try {
result = test.execute();
} catch (Exception e) {
caught = e;
e.printStackTrace();
}
if (!result) {
failed = true;
System.out.println ("test failed: " + test.arg1 + ": " +
test.arg2 + " Exception: " + caught);
}
System.out.println ("action test " + i + " OK");
}
for (int i = 0; i < actionsStringTest.length; i++) {
ActionsStringTest test = (ActionsStringTest) actionsStringTest[i];
Exception caught = null;
boolean result = false;
try {
result = test.execute();
} catch (Exception e) {
caught = e;
}
if (!result) {
failed = true;
System.out.println("test failed: " + test.arg + ": "
+ test.expectedActions + " Exception: " + caught);
}
System.out.println("Actions String test " + i + " OK");
}
serializationTest("http://www.foo.com/-", "GET,DELETE:*");
serializationTest("https://www.foo.com/-", "POST:X-Foo");
serializationTest("https:*", "*:*");
serializationTest("http://www.foo.com/a/b/s/", "POST:X-Foo");
serializationTest("http://www.foo.com/a/b/s/*", "POST:X-Foo");
if (failed) {
throw new RuntimeException("some tests failed");
}
}
static void serializationTest(String name, String actions)
throws Exception {
URLPermission out = new URLPermission(name, actions);
ByteArrayOutputStream baos = new ByteArrayOutputStream();
ObjectOutputStream o = new ObjectOutputStream(baos);
o.writeObject(out);
ByteArrayInputStream bain = new ByteArrayInputStream(baos.toByteArray());
ObjectInputStream i = new ObjectInputStream(bain);
URLPermission in = (URLPermission)i.readObject();
if (!in.equals(out)) {
System.out.println ("FAIL");
System.out.println ("in = " + in);
System.out.println ("out = " + out);
failed = true;
}
}
}

271
test/jdk/java/net/URLPermission/URLTest.java Normal file
View file

@ -0,0 +1,271 @@
/*
* Copyright (c) 2013, 2026, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8010464
* @modules jdk.httpserver
* @library /test/lib
* @build jdk.test.lib.net.SimpleSSLContext
* @run main/othervm URLTest
* @run main/othervm -Djava.net.preferIPv6Addresses=true URLTest
* @summary check URLPermission with Http(s)URLConnection
*/
import java.net.*;
import java.io.*;
import java.security.*;
import java.util.List;
import java.util.concurrent.*;
import com.sun.net.httpserver.*;
import javax.net.ssl.*;
import jdk.test.lib.net.SimpleSSLContext;
public class URLTest {
static boolean failed;
public static void main (String[] args) throws Exception {
createServers();
try {
test1();
test2();
test3();
if (failed)
throw new RuntimeException("Test failed");
} finally {
shutdown();
}
}
static void test1() throws IOException {
System.out.println("\n--- Test 1 ---");
List<URLPermission> perms = List.of(
new URLPermission("http://" + httpAuth + "/foo.html", "GET:X-Foo,Z-Bar"),
new URLPermission("https://" + httpsAuth + "/foo.html", "POST:X-Fob,T-Bar"));
String url1 = "http://" + httpAuth + "/foo.html";
String url2 = "https://" + httpsAuth + "/foo.html";
String url3 = "http://" + httpAuth + "/bar.html";
String url4 = "https://" + httpsAuth + "/bar.html";
// simple positive test. Should succeed
test(url1, "GET", "X-Foo", perms);
test(url1, "GET", "Z-Bar", "X-Foo", perms);
test(url1, "GET", "X-Foo", "Z-Bar", perms);
test(url1, "GET", "Z-Bar", perms);
test(url2, "POST", "X-Fob", perms);
// reverse the methods, should fail
test(url1, "POST", "X-Foo", perms, true);
test(url2, "GET", "X-Fob", perms, true);
// different URLs, should fail
test(url3, "GET", "X-Foo", perms, true);
test(url4, "POST", "X-Fob", perms, true);
}
static void test2() throws IOException {
System.out.println("\n--- Test 2 ---");
List<URLPermission> perms = List.of(
new URLPermission("http://" + httpAuth + "/*", "GET:X-Foo"),
new URLPermission("https://" + httpsAuth + "/*", "POST:X-Fob"));
String url1 = "http://" + httpAuth + "/foo.html";
String url2 = "https://" + httpsAuth + "/foo.html";
String url3 = "http://" + httpAuth + "/bar.html";
String url4 = "https://" + httpsAuth + "/bar.html";
// simple positive test. Should succeed
test(url1, "GET", "X-Foo", perms);
test(url2, "POST", "X-Fob", perms);
test(url3, "GET", "X-Foo", perms);
test(url4, "POST", "X-Fob", perms);
}
static void test3() throws IOException {
System.out.println("\n--- Test 3 ---");
List<URLPermission> perms = List.of(
new URLPermission("http://" + httpAuth + "/a/b/-", "DELETE,GET:X-Foo,Y-Foo"),
new URLPermission("https://" + httpsAuth + "/a/c/-", "POST:*"));
String url1 = "http://" + httpAuth + "/foo.html";
String url2 = "https://" + httpsAuth + "/a/c/d/e/foo.html";
String url3 = "http://" + httpAuth + "/a/b/c";
String url4 = "https://" + httpsAuth + "/a/b/c";
test(url1, "GET", "X-Foo", perms, true);
test(url2, "POST", "X-Zxc", perms);
test(url3, "DELETE", "Y-Foo", perms);
test(url4, "POST", "Y-Foo", perms,true);
}
static String authority(InetSocketAddress address) {
String hostaddr = address.getAddress().getHostAddress();
int port = address.getPort();
if (hostaddr.indexOf(':') > -1) {
return "[" + hostaddr + "]:" + port;
} else {
return hostaddr + ":" + port;
}
}
// Convenience methods to simplify previous explicit test scenarios.
static void test(String u, String method, String header, List<URLPermission> perms) throws IOException {
test(u, method, header, perms, false);
}
static void test(String u, String method, String header, List<URLPermission> perms, boolean expectException)
throws IOException
{
test(u, method, header, null, perms, expectException);
}
static void test(String u, String method, String header1, String header2, List<URLPermission> perms)
throws IOException
{
test(u, method, header1, header2, perms, false);
}
static void test(String u,
String method,
String header1,
String header2,
List<URLPermission> perms,
boolean expectException)
throws IOException
{
// check that no SecurityException is thrown
URL url = new URL(u);
System.out.println("url=" + u + " method=" + method +
" header1=" + header1 + " header2=" + header2 +
" expectException=" + expectException);
HttpURLConnection urlc = (HttpURLConnection)url.openConnection(Proxy.NO_PROXY);
if (urlc instanceof HttpsURLConnection) {
HttpsURLConnection ssl = (HttpsURLConnection)urlc;
ssl.setHostnameVerifier((host, sess) -> true);
ssl.setSSLSocketFactory(ctx.getSocketFactory());
}
urlc.setRequestMethod(method);
String action = method + ":";
if (header1 != null) {
urlc.addRequestProperty(header1, "foo");
action = action + header1;
}
if (header2 != null) {
urlc.addRequestProperty(header2, "bar");
if (header1 != null) action = action + ",";
action = action + header2;
}
int code = urlc.getResponseCode();
if (code != 200)
throw new RuntimeException("Unexpected response " + code);
InputStream is = urlc.getInputStream();
is.readAllBytes();
is.close();
// all good - now check permissions still work
URLPermission perm = new URLPermission(url.toString(), action);
PermissionCollection allperms = new Permissions();
perms.forEach(allperms::add);
try {
if (!allperms.implies(perm)) {
throw new RuntimeException(new SecurityException(perms.toString()));
}
if (expectException) {
System.out.println("Expected exception not thrown for " + perm);
failed = true;
}
} catch (RuntimeException e) {
if (!expectException || !(e.getCause() instanceof SecurityException)) {
System.out.println ("FAIL. Unexpected: " + e.getMessage());
e.printStackTrace();
failed = true;
return;
} else {
System.out.println("Got expected exception: " + e.getMessage());
}
}
System.out.println ("PASS");
}
static HttpServer httpServer;
static HttpsServer httpsServer;
static HttpContext c, cs;
static ExecutorService e, es;
private static final SSLContext ctx = SimpleSSLContext.findSSLContext();
static int httpPort;
static int httpsPort;
static String httpAuth;
static String httpsAuth;
static void createServers() throws Exception {
InetAddress loopback = InetAddress.getLoopbackAddress();
InetSocketAddress address = new InetSocketAddress(loopback, 0);
httpServer = HttpServer.create(address, 0);
httpsServer = HttpsServer.create(address, 0);
OkHandler h = new OkHandler();
c = httpServer.createContext("/", h);
cs = httpsServer.createContext("/", h);
e = Executors.newCachedThreadPool();
es = Executors.newCachedThreadPool();
httpServer.setExecutor(e);
httpsServer.setExecutor(es);
httpsServer.setHttpsConfigurator(new HttpsConfigurator (ctx));
httpServer.start();
httpsServer.start();
httpPort = httpServer.getAddress().getPort();
httpsPort = httpsServer.getAddress().getPort();
httpAuth = authority(httpServer.getAddress());
httpsAuth = authority(httpsServer.getAddress());
}
static void shutdown() {
httpServer.stop(1);
httpsServer.stop(1);
e.shutdown();
es.shutdown();
}
static class OkHandler implements HttpHandler {
public void handle(HttpExchange x) throws IOException {
x.sendResponseHeaders(200, -1);
x.close();
}
}
}

215
test/jdk/java/net/URLPermission/nstest/LookupTest.java Normal file
View file

@ -0,0 +1,215 @@
/*
* Copyright (c) 2013, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @summary A simple smoke test which checks URLPermission implies,
* and verify that HttpURLConnection either succeeds or throws
* IOException (due to unknown host).
* @run main/othervm -Djdk.net.hosts.file=LookupTestHosts LookupTest
*/
import java.io.BufferedWriter;
import java.io.FilePermission;
import java.io.FileWriter;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.PrintWriter;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.NetPermission;
import java.net.ProxySelector;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.SocketPermission;
import java.net.URL;
import java.net.URLConnection;
import java.net.URLPermission;
import java.security.Permission;
import java.security.PermissionCollection;
import java.security.Permissions;
import static java.nio.charset.StandardCharsets.US_ASCII;
public class LookupTest {
static LookupTestPermisions permissions;
static volatile ServerSocket serverSocket;
static void test(String url,
boolean throwsSecException,
boolean throwsIOException) {
ProxySelector.setDefault(null);
URL u;
InputStream is = null;
try {
u = new URL(url);
System.err.println("Connecting to " + u);
URLPermission permission = new URLPermission(url, "GET");
if (!permissions.implies(permission)) throw new SecurityException(permission.toString());
URLConnection urlc = u.openConnection();
is = urlc.getInputStream();
System.err.println("Connection sucessful");
} catch (SecurityException e) {
if (!throwsSecException) {
throw new RuntimeException("Unexpected SecurityException:", e);
}
return;
} catch (IOException e) {
if (!throwsIOException) {
System.err.println("Unexpected IOException:" + e.getMessage());
throw new RuntimeException(e);
} else {
System.err.println("Got expected exception: " + e);
}
return;
} finally {
if (is != null) {
try {
is.close();
} catch (IOException e) {
System.err.println("Unexpected IOException:" + e.getMessage());
throw new RuntimeException(e);
}
}
}
if (throwsIOException) {
System.err.printf("was expecting a %s\n", "IOException");
throw new RuntimeException("was expecting an exception");
}
}
static final String HOSTS_FILE_NAME = System.getProperty("jdk.net.hosts.file");
public static void main(String args[]) throws Exception {
addMappingToHostsFile("allowedAndFound.com",
InetAddress.getLoopbackAddress().getHostAddress(),
HOSTS_FILE_NAME,
false);
addMappingToHostsFile("notAllowedButFound.com",
"99.99.99.99",
HOSTS_FILE_NAME,
true);
// name "notAllowedAndNotFound.com" is not in map
// name "allowedButNotfound.com" is not in map
Server server = new Server();
int port = server.getPort();
permissions = new LookupTestPermisions(port);
try {
server.start();
test("http://allowedAndFound.com:" + port + "/foo", false, false);
test("http://notAllowedButFound.com:" + port + "/foo", true, false);
test("http://allowedButNotfound.com:" + port + "/foo", false, true);
test("http://notAllowedAndNotFound.com:" + port + "/foo", true, false);
} finally {
server.terminate();
}
}
static class Server extends Thread {
private volatile boolean done;
private final int port;
public Server() throws IOException {
InetAddress loopback = InetAddress.getLoopbackAddress();
serverSocket = new ServerSocket();
serverSocket.bind(new InetSocketAddress(loopback, 0));
port = serverSocket.getLocalPort();
}
int getPort() {
return port;
}
public void run() {
try {
while (!done) {
try (Socket s = serverSocket.accept()) {
readOneRequest(s.getInputStream());
OutputStream o = s.getOutputStream();
String rsp = "HTTP/1.1 200 Ok\r\n" +
"Connection: close\r\n" +
"Content-length: 0\r\n\r\n";
o.write(rsp.getBytes(US_ASCII));
}
}
} catch (IOException e) {
if (!done)
e.printStackTrace();
}
}
void terminate() {
done = true;
try { serverSocket.close(); }
catch (IOException unexpected) { unexpected.printStackTrace(); }
}
static final byte[] requestEnd = new byte[] {'\r', '\n', '\r', '\n' };
// Read until the end of a HTTP request
void readOneRequest(InputStream is) throws IOException {
int requestEndCount = 0, r;
while ((r = is.read()) != -1) {
if (r == requestEnd[requestEndCount]) {
requestEndCount++;
if (requestEndCount == 4) {
break;
}
} else {
requestEndCount = 0;
}
}
}
}
private static void addMappingToHostsFile(String host,
String addr,
String hostsFileName,
boolean append)
throws IOException
{
String mapping = addr + " " + host;
try (FileWriter fr = new FileWriter(hostsFileName, append);
PrintWriter hfPWriter = new PrintWriter(new BufferedWriter(fr))) {
hfPWriter.println(mapping);
}
}
static class LookupTestPermisions {
final PermissionCollection perms = new Permissions();
LookupTestPermisions(int port) {
perms.add(new SocketPermission("localhost:1024-", "resolve,accept"));
perms.add(new URLPermission("http://allowedAndFound.com:" + port + "/-", "*:*"));
perms.add(new URLPermission("http://allowedButNotfound.com:" + port + "/-", "*:*"));
perms.add(new FilePermission("<<ALL FILES>>", "read,write,delete"));
}
public boolean implies(Permission perm) {
return perms.implies(perm);
}
}
}