engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

102
test/jdk/java/security/CodeSource/CertsMatch.java Normal file
View file

@ -0,0 +1,102 @@
/*
* Copyright (c) 2005, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 6299163
* @summary Test to compare java.security.CodeSource
* Instructions to re-create the used certs file.
* - Generate a self-signed certificate with basicConstraints=CA:TRUE
* - Copy the generated certificate 2 times into a newly created certs file.
*/
import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.net.URL;
import java.security.CodeSigner;
import java.security.CodeSource;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.util.ArrayList;
import java.util.List;
public class CertsMatch {
public static void main(String[] args) throws Exception {
File certsFile = new File(System.getProperty("test.src", "."), "certs");
CertificateFactory cf = CertificateFactory.getInstance("X.509");
try (FileInputStream fis = new FileInputStream(certsFile);
BufferedInputStream bis = new BufferedInputStream(fis)) {
ArrayList certs1 = new ArrayList();
ArrayList certs2 = new ArrayList();
// read the first cert
Certificate cert = cf.generateCertificate(bis);
certs1.add(cert);
certs2.add(cert);
// read the second cert
cert = cf.generateCertificate(bis);
certs2.add(cert);
URL location = certsFile.toURI().toURL();
CodeSource cs0 = new CodeSource(location, (Certificate[]) null);
CodeSource cs1 = new CodeSource(location,
(Certificate[]) certs1.toArray(new Certificate[certs1.size()]));
CodeSource cs2 = new CodeSource(location,
(Certificate[]) certs2.toArray(new Certificate[certs2.size()]));
if (!cs0.implies(cs1) || !cs1.implies(cs2)) {
throw new Exception("The implies method is not working correctly");
}
if (cs0.equals(cs1) || cs1.equals(cs0)
|| cs2.equals(cs1) || cs1.equals(cs2)) {
throw new Exception("The equals method is not working correctly");
}
if (verifySigner(cs0.getCodeSigners(), null)) {
throw new RuntimeException("CodeSource.getCodeSigners() should be null");
}
if (!((verifySigner(cs1.getCodeSigners(), certs1))
&& (verifySigner(cs2.getCodeSigners(), certs2)))) {
throw new RuntimeException("Mismatched CodeSigners certificate");
}
}
}
private static boolean verifySigner(CodeSigner[] css, List certs) {
if (css == null || certs == null) {
return false;
}
if (css.length < 1 || certs.size() < 1) {
return false;
}
boolean result = true;
for (CodeSigner cs : css) {
result &= cs.getSignerCertPath().getCertificates().equals(certs);
}
return result;
}
}

110
test/jdk/java/security/CodeSource/CodeSourceNoInputs.java Normal file
View file

@ -0,0 +1,110 @@
/*
* Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.security.CodeSigner;
import java.security.CodeSource;
import java.security.PublicKey;
import java.security.cert.Certificate;
/**
* @test
* @bug 8366522
* @summary Verify that getCertificates() and getCodeSigners() return correct
* results when CodeSource is created with empty or null Certificate[]
* or CodeSigner[] arguments, or there are no X509 certificates in
* certs. Make sure that NPE is not thrown from
* CodeSource.getCodeSigners()
*/
public class CodeSourceNoInputs {
private static final Certificate NON_X509_CERT = new Certificate("") {
@Override
public byte[] getEncoded() {
return new byte[0];
}
@Override
public void verify(PublicKey key) {
}
@Override
public void verify(PublicKey key, String sigProvider) {
}
@Override
public String toString() {
return "";
}
@Override
public PublicKey getPublicKey() {
return null;
}
};
public static void main(String[] args) throws Exception {
CodeSource cs;
cs = new CodeSource(null, (Certificate[]) null);
if (cs.getCodeSigners() != null || cs.getCertificates() != null) {
throw new SecurityException("Both CodeSource.getCodeSigners() " +
"and CodeSource.getCertificates() should return null for " +
"new CodeSource(null, (Certificate[]) null)");
}
cs = new CodeSource(null, (CodeSigner[]) null);
if (cs.getCodeSigners() != null || cs.getCertificates() != null) {
throw new SecurityException("Both CodeSource.getCodeSigners() " +
"and CodeSource.getCertificates() should return null for " +
"new CodeSource(null, (CodeSigners[]) null)");
}
cs = new CodeSource(null, new Certificate[0]);
if (cs.getCodeSigners().length != 0
|| cs.getCertificates().length != 0) {
throw new SecurityException("Both CodeSource.getCodeSigners()" +
"and CodeSource.getCertificates() should return empty arrays " +
"for new CodeSource(null, new Certificate[0])");
}
cs = new CodeSource(null, new CodeSigner[0]);
if (cs.getCodeSigners().length != 0
|| cs.getCertificates().length != 0) {
throw new SecurityException("Both CodeSource.getCodeSigners() and" +
" CodeSource.getCertificates() should return empty arrays for" +
" new CodeSource(null, new CodeSigners[0])");
}
cs = new CodeSource(null, new Certificate[]{NON_X509_CERT});
if (cs.getCodeSigners().length != 0 || cs.getCertificates() == null) {
throw new SecurityException("Both CodeSource.getCodeSigners() and" +
" CodeSource.getCertificates() should return arrays for new" +
" CodeSource(null, new CodeSigners[1]{NON-X509-CERTIFICATE})");
}
}
}

103
test/jdk/java/security/CodeSource/Implies.java Normal file
View file

@ -0,0 +1,103 @@
/*
* Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4866847 7152564 7155693 8356557
* @summary various CodeSource.implies tests
*/
import java.security.CodeSource;
import java.net.InetAddress;
import java.net.URL;
public class Implies {
public static void main(String[] args) throws Exception {
URL thisURL = new URL("http", "localhost", "file");
URL thatURL = new URL("http", null, "file");
// should not throw NullPointerException
testImplies(thisURL, thatURL, false);
thisURL = new URL("http", "localhost", "dir/-");
thatURL = new URL("HTTP", "localhost", "dir/file");
// protocol check should ignore case
testImplies(thisURL, thatURL, true);
thisURL = new URL("http", "localhost", 80, "dir/-");
thatURL = new URL("HTTP", "localhost", "dir/file");
// port check should match default port of thatURL
testImplies(thisURL, thatURL, true);
thisURL = new URL("http", "204.160.241.0", "file");
thatURL = new URL("http", "localhost", "file");
// ip address should not imply localhost's IP address
testImplies(thisURL, thatURL, false);
thisURL = new URL("http", "204.160.241.0", "file");
thatURL = new URL("http", "*.example.com", "file");
// ip address should not imply wildcarded host
testImplies(thisURL, thatURL, false);
InetAddress ia = InetAddress.getLocalHost();
thisURL = new URL("http", ia.getHostAddress(), "file");
thatURL = new URL("http", ia.getHostName(), "file");
// ip address should imply host name with same ip address
testImplies(thisURL, thatURL, true);
thisURL = new URL("http", "*.example.com", "file");
thatURL = new URL("http", "*.foo.example.com", "file");
// wildcarded host name should imply wildcarded host name ending with
// same canonical host name
testImplies(thisURL, thatURL, true);
thisURL = new URL("http", "example.com", "file");
thatURL = new URL("http", "*.foo.example.com", "file");
// host name should not imply wildcarded host name ending with same
// canonical host name
testImplies(thisURL, thatURL, false);
thisURL = new URL("http", "*.example.com", "file");
thatURL = new URL("http", "foo.example.com", "file");
// wildcarded host name should imply host name ending with same
// canonical host name
testImplies(thisURL, thatURL, true);
System.out.println("test passed");
}
private static void testImplies(URL thisURL, URL thatURL, boolean result)
throws SecurityException {
CodeSource thisCs
= new CodeSource(thisURL, (java.security.cert.Certificate[]) null);
CodeSource thatCs
= new CodeSource(thatURL, (java.security.cert.Certificate[]) null);
if (thisCs.implies(thatCs) != result) {
throw new SecurityException("CodeSource.implies() returned "
+ !result + " instead of " + result);
}
if (thisCs.getCodeSigners() != null && thatCs.getCodeSigners() != null) {
throw new SecurityException("Both getCodeSigners should be null");
}
}
}

42
test/jdk/java/security/CodeSource/certs Normal file
View file

@ -0,0 +1,42 @@
-----BEGIN CERTIFICATE-----
MIIDgzCCAmugAwIBAgIJALi3XHB1pDxTMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
BAYTAlVTMQ0wCwYDVQQIDAR0ZXN0MQ0wCwYDVQQHDAR0ZXN0MQ0wCwYDVQQKDAR0
ZXN0MQ0wCwYDVQQLDAR0ZXN0MQ0wCwYDVQQDDAR0ZXN0MB4XDTIyMDYwODA3Mzkz
MFoXDTQ3MDYwMjA3MzkzMFowWDELMAkGA1UEBhMCVVMxDTALBgNVBAgMBHRlc3Qx
DTALBgNVBAcMBHRlc3QxDTALBgNVBAoMBHRlc3QxDTALBgNVBAsMBHRlc3QxDTAL
BgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUfQUR
jdnE1KyZKjPoL2np9T9grBJFaApt1oxNOXLzOW19EYUbbmzERKf9bHALfYIRZonj
wYEywWMLxVuM1YdJAKO2X/X2nvPZLmi9BPVa0aGyG/X19L9FKXEKugzujrq2gko0
ryDpV1Rrbqpv5G9wXA1+jzPVteFgCX9IoNLEatXVAN8gfnuOCvAM83VMit91+LNs
uK9Eo9xcPyVt0n7Tl+VtW/nVzlRz/p6xHIB0Uo3Dl//QziMllWng98TCxtcTvOBd
gl1AlTAwFWGwQRL2xC8iFrJ5vgY4/afth68W0pqsIH5TCJumGVf/0VBYIs+OWdyT
Wu0Eswjx34gsuvyTAgMBAAGjUDBOMB0GA1UdDgQWBBRmeQRExt2gPyc+b6fB8hL8
+oiT+jAfBgNVHSMEGDAWgBRmeQRExt2gPyc+b6fB8hL8+oiT+jAMBgNVHRMEBTAD
AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCRlgYqBPXnrhHySR0GzTG2eSQ2B6MqLTOX
nt10kmp92zFJ/AZIoHZGyNC45dRXLX1ZcV8dtAKzbZLo2u07TGxM/q66bHOpXbCn
FGZqyhanDrkwHWPI58pyDuzRKUQKq+kuwpctDiZpjVBcZIVP/ecZcI0DO7qKWEXc
JVXgfkqjU0PMCQDpahDuPLQ3otYDUgNAY82c4WETypjTE8GaLCg++JmPy0Yo8kR4
VBabOgp4FJi+DDo7VNZRuCTZG91pNlKUZNnR/T1VO0KPtbJoRV5XBRcwdCfhtxNW
lK33pqJx7xAY5Gkg+SdvQOA0d4y6YbCF7eO1QyA5x+dqq+YGHpw7
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDgzCCAmugAwIBAgIJALi3XHB1pDxTMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
BAYTAlVTMQ0wCwYDVQQIDAR0ZXN0MQ0wCwYDVQQHDAR0ZXN0MQ0wCwYDVQQKDAR0
ZXN0MQ0wCwYDVQQLDAR0ZXN0MQ0wCwYDVQQDDAR0ZXN0MB4XDTIyMDYwODA3Mzkz
MFoXDTQ3MDYwMjA3MzkzMFowWDELMAkGA1UEBhMCVVMxDTALBgNVBAgMBHRlc3Qx
DTALBgNVBAcMBHRlc3QxDTALBgNVBAoMBHRlc3QxDTALBgNVBAsMBHRlc3QxDTAL
BgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUfQUR
jdnE1KyZKjPoL2np9T9grBJFaApt1oxNOXLzOW19EYUbbmzERKf9bHALfYIRZonj
wYEywWMLxVuM1YdJAKO2X/X2nvPZLmi9BPVa0aGyG/X19L9FKXEKugzujrq2gko0
ryDpV1Rrbqpv5G9wXA1+jzPVteFgCX9IoNLEatXVAN8gfnuOCvAM83VMit91+LNs
uK9Eo9xcPyVt0n7Tl+VtW/nVzlRz/p6xHIB0Uo3Dl//QziMllWng98TCxtcTvOBd
gl1AlTAwFWGwQRL2xC8iFrJ5vgY4/afth68W0pqsIH5TCJumGVf/0VBYIs+OWdyT
Wu0Eswjx34gsuvyTAgMBAAGjUDBOMB0GA1UdDgQWBBRmeQRExt2gPyc+b6fB8hL8
+oiT+jAfBgNVHSMEGDAWgBRmeQRExt2gPyc+b6fB8hL8+oiT+jAMBgNVHRMEBTAD
AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCRlgYqBPXnrhHySR0GzTG2eSQ2B6MqLTOX
nt10kmp92zFJ/AZIoHZGyNC45dRXLX1ZcV8dtAKzbZLo2u07TGxM/q66bHOpXbCn
FGZqyhanDrkwHWPI58pyDuzRKUQKq+kuwpctDiZpjVBcZIVP/ecZcI0DO7qKWEXc
JVXgfkqjU0PMCQDpahDuPLQ3otYDUgNAY82c4WETypjTE8GaLCg++JmPy0Yo8kR4
VBabOgp4FJi+DDo7VNZRuCTZG91pNlKUZNnR/T1VO0KPtbJoRV5XBRcwdCfhtxNW
lK33pqJx7xAY5Gkg+SdvQOA0d4y6YbCF7eO1QyA5x+dqq+YGHpw7
-----END CERTIFICATE-----