undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
32
test/jdk/java/rmi/server/useCustomRef/Ping.java
Normal file
32
test/jdk/java/rmi/server/useCustomRef/Ping.java
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
/*
|
||||
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
import java.rmi.Remote;
|
||||
import java.rmi.RemoteException;
|
||||
interface Ping extends Remote {
|
||||
public void ping() throws RemoteException;
|
||||
public void receiveAndPing(Ping p) throws RemoteException;
|
||||
}
|
||||
219
test/jdk/java/rmi/server/useCustomRef/UseCustomRef.java
Normal file
219
test/jdk/java/rmi/server/useCustomRef/UseCustomRef.java
Normal file
|
|
@ -0,0 +1,219 @@
|
|||
/*
|
||||
* Copyright (c) 1998, 2024, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/* @test
|
||||
* @bug 4155894
|
||||
*
|
||||
* @summary remote references can't be downloaded
|
||||
* @author Ann Wollrath
|
||||
*
|
||||
* test currently needs RMISecurityManager because of
|
||||
* 4180392
|
||||
*
|
||||
* @library ../../testlibrary
|
||||
* @modules java.rmi/sun.rmi.registry
|
||||
* java.rmi/sun.rmi.server
|
||||
* java.rmi/sun.rmi.transport
|
||||
* java.rmi/sun.rmi.transport.tcp
|
||||
* @build TestLibrary Ping UseCustomRef_Stub UseCustomRef_Skel
|
||||
* @run main/othervm/timeout=120 UseCustomRef
|
||||
*
|
||||
* This test was failing to run because the synthetic access
|
||||
* control context used by the application class loader to find and define
|
||||
* CustomServerRef does not have accessClassInPackage.sun.rmi.server runtime
|
||||
* permission necessary to load its superclass sun.rmi.server.UnicastServerRef,
|
||||
* even though this test's code is granted that permission in its policy file.
|
||||
* That bug number is 4256530
|
||||
*/
|
||||
|
||||
import java.io.*;
|
||||
import java.rmi.*;
|
||||
import java.rmi.server.*;
|
||||
import java.rmi.registry.*;
|
||||
import sun.rmi.transport.LiveRef;
|
||||
|
||||
public class UseCustomRef
|
||||
extends RemoteServer
|
||||
implements Ping
|
||||
{
|
||||
|
||||
public UseCustomRef() throws RemoteException {
|
||||
exportObject();
|
||||
}
|
||||
|
||||
public void exportObject() throws RemoteException {
|
||||
ref = new CustomServerRef(new LiveRef(0));
|
||||
((ServerRef) ref).exportObject(this, null);
|
||||
}
|
||||
|
||||
public RemoteRef getRef() { return ref; }
|
||||
|
||||
public void ping() {}
|
||||
|
||||
public void receiveAndPing(Ping p) throws RemoteException {
|
||||
p.ping();
|
||||
}
|
||||
|
||||
public static void main(String[] args) {
|
||||
Ping obj = null;
|
||||
Registry registry = null;
|
||||
|
||||
try {
|
||||
/*
|
||||
* create registry
|
||||
*/
|
||||
|
||||
System.err.println("creating Registry...");
|
||||
|
||||
registry = TestLibrary.createRegistryOnEphemeralPort();
|
||||
int port = TestLibrary.getRegistryPort(registry);
|
||||
/*
|
||||
* create object with custom ref and bind in registry
|
||||
*/
|
||||
System.err.println("creating UseCustomRef...");
|
||||
UseCustomRef cr = new UseCustomRef();
|
||||
RemoteRef ref = cr.getRef();
|
||||
if (!(ref instanceof CustomServerRef)) {
|
||||
TestLibrary.bomb("test failed: reference not " +
|
||||
"instanceof CustomServerRef");
|
||||
}
|
||||
|
||||
String name = "//:" + port + "/UseCustomRef";
|
||||
// String name = "UseCustomRef";
|
||||
System.err.println("binding object in registry...");
|
||||
Naming.rebind(name, cr);
|
||||
|
||||
/*
|
||||
* look up object and invoke its ping method
|
||||
*/
|
||||
System.err.println("ping object...");
|
||||
obj = (Ping) Naming.lookup(name);
|
||||
obj.ping();
|
||||
|
||||
/*
|
||||
* pass object with custom ref in remote call
|
||||
*/
|
||||
System.err.println("pass object in remote call...");
|
||||
obj.receiveAndPing(cr);
|
||||
|
||||
/*
|
||||
* write remote object with custom ref to output stream
|
||||
*/
|
||||
System.err.println("writing remote object to stream...");
|
||||
ByteArrayOutputStream bout = new ByteArrayOutputStream();
|
||||
ObjectOutputStream out = new ObjectOutputStream(bout);
|
||||
out.writeObject(cr);
|
||||
out.flush();
|
||||
out.close();
|
||||
|
||||
/*
|
||||
* read back remote object from output stream
|
||||
*/
|
||||
System.err.println("reading remote object from stream...");
|
||||
ObjectInputStream in = new ObjectInputStream(
|
||||
new ByteArrayInputStream(bout.toByteArray()));
|
||||
cr = (UseCustomRef) in.readObject();
|
||||
|
||||
/*
|
||||
* re-export object and ping
|
||||
*/
|
||||
System.err.println("re-export object read...");
|
||||
cr.exportObject();
|
||||
System.err.println("look up object again...");
|
||||
Naming.rebind(name, cr);
|
||||
System.err.println("ping object read...");
|
||||
obj = (Ping) Naming.lookup(name);
|
||||
obj.ping();
|
||||
System.err.println("TEST PASSED");
|
||||
Naming.unbind(name);
|
||||
cr = null;
|
||||
|
||||
} catch (Exception e) {
|
||||
TestLibrary.bomb("test failed with exception: ", e);
|
||||
} finally {
|
||||
TestLibrary.unexport(obj);
|
||||
TestLibrary.unexport(registry);
|
||||
|
||||
registry = null;
|
||||
obj = null;
|
||||
}
|
||||
}
|
||||
|
||||
public static class CustomServerRef
|
||||
extends sun.rmi.server.UnicastServerRef
|
||||
{
|
||||
public CustomServerRef() {}
|
||||
|
||||
public CustomServerRef(LiveRef ref) {
|
||||
super(ref);
|
||||
}
|
||||
/*****
|
||||
public CustomServerRef(int port,
|
||||
RMIClientSocketFactory csf,
|
||||
RMIServerSocketFactory ssf)
|
||||
{
|
||||
super (new LiveRef(port, csf, ssf));
|
||||
}
|
||||
*****/
|
||||
|
||||
public String getRefClass(ObjectOutput out) {
|
||||
return "";
|
||||
}
|
||||
|
||||
protected void unmarshalCustomCallData(ObjectInput in)
|
||||
throws IOException, ClassNotFoundException
|
||||
{
|
||||
System.err.println("unmarshalling call data...");
|
||||
String s = (String) (in.readObject());
|
||||
System.err.println(s);
|
||||
}
|
||||
|
||||
protected RemoteRef getClientRef() {
|
||||
return new CustomRef(ref);
|
||||
}
|
||||
}
|
||||
|
||||
public static class CustomRef extends sun.rmi.server.UnicastRef {
|
||||
|
||||
public CustomRef() {
|
||||
}
|
||||
|
||||
public CustomRef(sun.rmi.transport.LiveRef ref) {
|
||||
super(ref);
|
||||
}
|
||||
|
||||
protected void marshalCustomCallData(ObjectOutput out)
|
||||
throws IOException
|
||||
{
|
||||
// this custom data ensures that a custom server
|
||||
// ref has written the relevant information.
|
||||
System.err.println("marshalling call data...");
|
||||
out.writeObject("hello there.");
|
||||
}
|
||||
|
||||
public String getRefClass(ObjectOutput out) {
|
||||
return "";
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
97
test/jdk/java/rmi/server/useCustomRef/UseCustomRef_Skel.java
Normal file
97
test/jdk/java/rmi/server/useCustomRef/UseCustomRef_Skel.java
Normal file
|
|
@ -0,0 +1,97 @@
|
|||
/*
|
||||
* Copyright (c) 1998, 1999, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
// Skeleton class generated by rmic, do not edit.
|
||||
// Contents subject to change without notice.
|
||||
|
||||
public final class UseCustomRef_Skel
|
||||
implements java.rmi.server.Skeleton
|
||||
{
|
||||
private static final java.rmi.server.Operation[] operations = {
|
||||
new java.rmi.server.Operation("void ping()"),
|
||||
new java.rmi.server.Operation("void receiveAndPing(Ping)")
|
||||
};
|
||||
|
||||
private static final long interfaceHash = 8457085322718440165L;
|
||||
|
||||
public java.rmi.server.Operation[] getOperations() {
|
||||
return (java.rmi.server.Operation[]) operations.clone();
|
||||
}
|
||||
|
||||
public void dispatch(java.rmi.Remote obj, java.rmi.server.RemoteCall call, int opnum, long hash)
|
||||
throws java.lang.Exception
|
||||
{
|
||||
if (opnum < 0) {
|
||||
if (hash == 5866401369815527589L) {
|
||||
opnum = 0;
|
||||
} else if (hash == -5964458762870933304L) {
|
||||
opnum = 1;
|
||||
} else {
|
||||
throw new java.rmi.UnmarshalException("invalid method hash");
|
||||
}
|
||||
} else {
|
||||
if (hash != interfaceHash)
|
||||
throw new java.rmi.server.SkeletonMismatchException("interface hash mismatch");
|
||||
}
|
||||
|
||||
UseCustomRef server = (UseCustomRef) obj;
|
||||
switch (opnum) {
|
||||
case 0: // ping()
|
||||
{
|
||||
call.releaseInputStream();
|
||||
server.ping();
|
||||
try {
|
||||
call.getResultStream(true);
|
||||
} catch (java.io.IOException e) {
|
||||
throw new java.rmi.MarshalException("error marshalling return", e);
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
case 1: // receiveAndPing(Ping)
|
||||
{
|
||||
Ping $param_Ping_1;
|
||||
try {
|
||||
java.io.ObjectInput in = call.getInputStream();
|
||||
$param_Ping_1 = (Ping) in.readObject();
|
||||
} catch (java.io.IOException e) {
|
||||
throw new java.rmi.UnmarshalException("error unmarshalling arguments", e);
|
||||
} catch (java.lang.ClassNotFoundException e) {
|
||||
throw new java.rmi.UnmarshalException("error unmarshalling arguments", e);
|
||||
} finally {
|
||||
call.releaseInputStream();
|
||||
}
|
||||
server.receiveAndPing($param_Ping_1);
|
||||
try {
|
||||
call.getResultStream(true);
|
||||
} catch (java.io.IOException e) {
|
||||
throw new java.rmi.MarshalException("error marshalling return", e);
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
default:
|
||||
throw new java.rmi.UnmarshalException("invalid method number");
|
||||
}
|
||||
}
|
||||
}
|
||||
118
test/jdk/java/rmi/server/useCustomRef/UseCustomRef_Stub.java
Normal file
118
test/jdk/java/rmi/server/useCustomRef/UseCustomRef_Stub.java
Normal file
|
|
@ -0,0 +1,118 @@
|
|||
/*
|
||||
* Copyright (c) 1998, 1999, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
// Stub class generated by rmic, do not edit.
|
||||
// Contents subject to change without notice.
|
||||
|
||||
public final class UseCustomRef_Stub
|
||||
extends java.rmi.server.RemoteStub
|
||||
implements Ping, java.rmi.Remote
|
||||
{
|
||||
private static final java.rmi.server.Operation[] operations = {
|
||||
new java.rmi.server.Operation("void ping()"),
|
||||
new java.rmi.server.Operation("void receiveAndPing(Ping)")
|
||||
};
|
||||
|
||||
private static final long interfaceHash = 8457085322718440165L;
|
||||
|
||||
private static final long serialVersionUID = 2;
|
||||
|
||||
private static boolean useNewInvoke;
|
||||
private static java.lang.reflect.Method $method_ping_0;
|
||||
private static java.lang.reflect.Method $method_receiveAndPing_1;
|
||||
|
||||
static {
|
||||
try {
|
||||
java.rmi.server.RemoteRef.class.getMethod("invoke",
|
||||
new java.lang.Class[] {
|
||||
java.rmi.Remote.class,
|
||||
java.lang.reflect.Method.class,
|
||||
java.lang.Object[].class,
|
||||
long.class
|
||||
});
|
||||
useNewInvoke = true;
|
||||
$method_ping_0 = Ping.class.getMethod("ping", new java.lang.Class[] {});
|
||||
$method_receiveAndPing_1 = Ping.class.getMethod("receiveAndPing", new java.lang.Class[] {Ping.class});
|
||||
} catch (java.lang.NoSuchMethodException e) {
|
||||
useNewInvoke = false;
|
||||
}
|
||||
}
|
||||
|
||||
// constructors
|
||||
public UseCustomRef_Stub() {
|
||||
super();
|
||||
}
|
||||
public UseCustomRef_Stub(java.rmi.server.RemoteRef ref) {
|
||||
super(ref);
|
||||
}
|
||||
|
||||
// methods from remote interfaces
|
||||
|
||||
// implementation of ping()
|
||||
public void ping()
|
||||
throws java.rmi.RemoteException
|
||||
{
|
||||
try {
|
||||
if (useNewInvoke) {
|
||||
ref.invoke(this, $method_ping_0, null, 5866401369815527589L);
|
||||
} else {
|
||||
java.rmi.server.RemoteCall call = ref.newCall((java.rmi.server.RemoteObject) this, operations, 0, interfaceHash);
|
||||
ref.invoke(call);
|
||||
ref.done(call);
|
||||
}
|
||||
} catch (java.lang.RuntimeException e) {
|
||||
throw e;
|
||||
} catch (java.rmi.RemoteException e) {
|
||||
throw e;
|
||||
} catch (java.lang.Exception e) {
|
||||
throw new java.rmi.UnexpectedException("undeclared checked exception", e);
|
||||
}
|
||||
}
|
||||
|
||||
// implementation of receiveAndPing(Ping)
|
||||
public void receiveAndPing(Ping $param_Ping_1)
|
||||
throws java.rmi.RemoteException
|
||||
{
|
||||
try {
|
||||
if (useNewInvoke) {
|
||||
ref.invoke(this, $method_receiveAndPing_1, new java.lang.Object[] {$param_Ping_1}, -5964458762870933304L);
|
||||
} else {
|
||||
java.rmi.server.RemoteCall call = ref.newCall((java.rmi.server.RemoteObject) this, operations, 1, interfaceHash);
|
||||
try {
|
||||
java.io.ObjectOutput out = call.getOutputStream();
|
||||
out.writeObject($param_Ping_1);
|
||||
} catch (java.io.IOException e) {
|
||||
throw new java.rmi.MarshalException("error marshalling arguments", e);
|
||||
}
|
||||
ref.invoke(call);
|
||||
ref.done(call);
|
||||
}
|
||||
} catch (java.lang.RuntimeException e) {
|
||||
throw e;
|
||||
} catch (java.rmi.RemoteException e) {
|
||||
throw e;
|
||||
} catch (java.lang.Exception e) {
|
||||
throw new java.rmi.UnexpectedException("undeclared checked exception", e);
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue