undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
|
|
@ -0,0 +1,25 @@
|
|||
/*
|
||||
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
public class Bar implements java.io.Serializable {
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
/*
|
||||
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
public class Foo implements java.io.Serializable {
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
/*
|
||||
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
import java.rmi.Remote;
|
||||
import java.rmi.RemoteException;
|
||||
public interface Receiver extends Remote {
|
||||
public void receive(Object obj) throws RemoteException;
|
||||
}
|
||||
|
|
@ -0,0 +1,157 @@
|
|||
/*
|
||||
* Copyright (c) 1999, 2024, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/* @test
|
||||
* @bug 4174006
|
||||
* @summary If the "java.rmi.server.useCodebaseOnly" property has a boolean
|
||||
* value of true, then when the RMI runtime is unmarshalling a class
|
||||
* descriptor, it should not attempt to download the associate Class object
|
||||
* from the annotated codebase, but only from the codebase specified in the
|
||||
* "java.rmi.server.codebase" property and the context class loader.
|
||||
* @author Peter Jones
|
||||
*
|
||||
* @library ../../../testlibrary
|
||||
* @modules java.rmi/sun.rmi.registry
|
||||
* java.rmi/sun.rmi.server
|
||||
* java.rmi/sun.rmi.transport
|
||||
* java.rmi/sun.rmi.transport.tcp
|
||||
* @build TestLibrary Receiver UseCodebaseOnly_Stub Foo Bar TestLoaderHandler
|
||||
* @run main/othervm UseCodebaseOnly
|
||||
*/
|
||||
|
||||
import java.net.*;
|
||||
import java.rmi.*;
|
||||
import java.rmi.server.*;
|
||||
|
||||
public class UseCodebaseOnly
|
||||
extends UnicastRemoteObject
|
||||
implements Receiver
|
||||
{
|
||||
|
||||
public UseCodebaseOnly() throws RemoteException {
|
||||
}
|
||||
|
||||
public void receive(Object obj) {
|
||||
System.err.println("+ receive(): received object " + obj);
|
||||
}
|
||||
|
||||
public static void main(String[] args) {
|
||||
|
||||
System.err.println("\nRegression test for bug 4174006\n");
|
||||
|
||||
System.setProperty("java.rmi.server.RMIClassLoaderSpi", "TestLoaderHandler");
|
||||
|
||||
URL localCodebase = null, remoteCodebase = null;
|
||||
try {
|
||||
remoteCodebase =
|
||||
TestLibrary.installClassInCodebase("Foo", "remote_codebase");
|
||||
localCodebase =
|
||||
TestLibrary.installClassInCodebase("Bar", "local_codebase");
|
||||
} catch (MalformedURLException e) {
|
||||
TestLibrary.bomb(e);
|
||||
}
|
||||
|
||||
TestLibrary.setProperty("java.rmi.server.useCodebaseOnly", "true");
|
||||
TestLibrary.setProperty( // set local codebase property
|
||||
"java.rmi.server.codebase", localCodebase.toString());
|
||||
|
||||
/*
|
||||
* Load Foo and Bar from non-RMI class loaders so that they won't be
|
||||
* already loaded by RMI class loaders in this VM (for whatever that's
|
||||
* worth), but with URLClassLoader so that they will be annotated
|
||||
* properly.
|
||||
*/
|
||||
System.err.println("Creating class loader for remote codebase " +
|
||||
remoteCodebase);
|
||||
ClassLoader remoteCodebaseLoader =
|
||||
URLClassLoader.newInstance(new URL[] { remoteCodebase });
|
||||
System.err.println("Creating class loader for local codebase " +
|
||||
localCodebase);
|
||||
ClassLoader localCodebaseLoader =
|
||||
URLClassLoader.newInstance(new URL[] { localCodebase });
|
||||
|
||||
System.err.println("Creating remote object.");
|
||||
UseCodebaseOnly obj = null;
|
||||
try {
|
||||
obj = new UseCodebaseOnly();
|
||||
} catch (RemoteException e) {
|
||||
TestLibrary.bomb(e);
|
||||
}
|
||||
|
||||
try {
|
||||
Receiver stub = (Receiver) RemoteObject.toStub(obj);
|
||||
|
||||
/*
|
||||
* Pass an instance of Bar, the class in the local codebase.
|
||||
* This should succeed, because the server is allow to load
|
||||
* classes from the local codebase.
|
||||
*/
|
||||
System.err.println(
|
||||
"Passing class from local codebase (should succeed).");
|
||||
Class barClass = localCodebaseLoader.loadClass("Bar");
|
||||
Object barObj = barClass.newInstance();
|
||||
stub.receive(barObj);
|
||||
|
||||
/*
|
||||
* Pass an instance of Foo, the class in the remote codebase.
|
||||
* This should fail, because the server is not allowed to load
|
||||
* classes from other codebases besides the local codebase.
|
||||
*/
|
||||
System.err.println(
|
||||
"Passing class from remote codebase (should fail).");
|
||||
Class fooClass = remoteCodebaseLoader.loadClass("Foo");
|
||||
Object fooObj = fooClass.newInstance();
|
||||
try {
|
||||
stub.receive(fooObj);
|
||||
throw new RuntimeException("TEST FAILED: " +
|
||||
"class from remote codebase sucesssfully unmarshalled");
|
||||
} catch (RemoteException e) {
|
||||
/*
|
||||
* Verify that the failure was that the server couldn't
|
||||
* unmarshal the Foo class.
|
||||
*/
|
||||
if ((e instanceof ServerException) &&
|
||||
(e.detail instanceof UnmarshalException) &&
|
||||
(((RemoteException) e.detail).detail instanceof
|
||||
ClassNotFoundException) &&
|
||||
(((RemoteException) e.detail).detail.getMessage().equals(
|
||||
"Foo")))
|
||||
{
|
||||
System.err.println("TEST PASSED: ");
|
||||
e.printStackTrace();
|
||||
} else {
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
System.err.println("TEST FAILED: ");
|
||||
e.printStackTrace();
|
||||
throw new RuntimeException("TEST FAILED: " + e.toString());
|
||||
} finally {
|
||||
try {
|
||||
UnicastRemoteObject.unexportObject(obj, true);
|
||||
} catch (Throwable e) {
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
/*
|
||||
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
// Stub class generated by rmic, do not edit.
|
||||
// Contents subject to change without notice.
|
||||
|
||||
public final class UseCodebaseOnly_Stub
|
||||
extends java.rmi.server.RemoteStub
|
||||
implements Receiver, java.rmi.Remote
|
||||
{
|
||||
private static final java.rmi.server.Operation[] operations = {
|
||||
new java.rmi.server.Operation("void receive(java.lang.Object)")
|
||||
};
|
||||
|
||||
private static final long interfaceHash = -953299374608818732L;
|
||||
|
||||
private static final long serialVersionUID = 2;
|
||||
|
||||
private static boolean useNewInvoke;
|
||||
private static java.lang.reflect.Method $method_receive_0;
|
||||
|
||||
static {
|
||||
try {
|
||||
java.rmi.server.RemoteRef.class.getMethod("invoke",
|
||||
new java.lang.Class[] {
|
||||
java.rmi.Remote.class,
|
||||
java.lang.reflect.Method.class,
|
||||
java.lang.Object[].class,
|
||||
long.class
|
||||
});
|
||||
useNewInvoke = true;
|
||||
$method_receive_0 = Receiver.class.getMethod("receive", new java.lang.Class[] {java.lang.Object.class});
|
||||
} catch (java.lang.NoSuchMethodException e) {
|
||||
useNewInvoke = false;
|
||||
}
|
||||
}
|
||||
|
||||
// constructors
|
||||
public UseCodebaseOnly_Stub() {
|
||||
super();
|
||||
}
|
||||
public UseCodebaseOnly_Stub(java.rmi.server.RemoteRef ref) {
|
||||
super(ref);
|
||||
}
|
||||
|
||||
// methods from remote interfaces
|
||||
|
||||
// implementation of receive(Object)
|
||||
public void receive(java.lang.Object $param_Object_1)
|
||||
throws java.rmi.RemoteException
|
||||
{
|
||||
try {
|
||||
if (useNewInvoke) {
|
||||
ref.invoke(this, $method_receive_0, new java.lang.Object[] {$param_Object_1}, -578858472643205929L);
|
||||
} else {
|
||||
java.rmi.server.RemoteCall call = ref.newCall((java.rmi.server.RemoteObject) this, operations, 0, interfaceHash);
|
||||
try {
|
||||
java.io.ObjectOutput out = call.getOutputStream();
|
||||
out.writeObject($param_Object_1);
|
||||
} catch (java.io.IOException e) {
|
||||
throw new java.rmi.MarshalException("error marshalling arguments", e);
|
||||
}
|
||||
ref.invoke(call);
|
||||
ref.done(call);
|
||||
}
|
||||
} catch (java.lang.RuntimeException e) {
|
||||
throw e;
|
||||
} catch (java.rmi.RemoteException e) {
|
||||
throw e;
|
||||
} catch (java.lang.Exception e) {
|
||||
throw new java.rmi.UnexpectedException("undeclared checked exception", e);
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue