undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
|
|
@ -0,0 +1,162 @@
|
|||
/*
|
||||
* Copyright (c) 1999, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @author Gary Ellison
|
||||
* @bug 4232694
|
||||
* @summary PermissionCollection.setReadOnly() does not preclude using add()
|
||||
*/
|
||||
|
||||
import java.security.*;
|
||||
import java.net.SocketPermission;
|
||||
import java.io.FilePermission;
|
||||
import java.util.PropertyPermission;
|
||||
|
||||
public class AddToReadOnlyPermissionCollection {
|
||||
public static void main(String args[]) throws Exception {
|
||||
|
||||
try {
|
||||
if (args.length == 0) {
|
||||
tryAllPC();
|
||||
tryBasicPC();
|
||||
tryFilePC();
|
||||
tryPropPC();
|
||||
trySockPC();
|
||||
} else {
|
||||
for (int i=0; i <args.length; i++) {
|
||||
switch (args[i].toLowerCase().charAt(1)) {
|
||||
case 'a':
|
||||
tryAllPC();
|
||||
break;
|
||||
case 'b':
|
||||
tryBasicPC();
|
||||
break;
|
||||
case 'f':
|
||||
tryFilePC();
|
||||
break;
|
||||
case 'p':
|
||||
tryPropPC();
|
||||
break;
|
||||
case 's':
|
||||
trySockPC();
|
||||
break;
|
||||
default:
|
||||
throw new Exception("usage: AddToReadOnlyPermissonCollection [-a -b -f -p -s]");
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
throw e;
|
||||
}
|
||||
System.out.println("Passed. OKAY");
|
||||
}
|
||||
|
||||
static void tryPropPC() throws Exception {
|
||||
try {
|
||||
PropertyPermission p0 = new PropertyPermission("user.home","read");
|
||||
PermissionCollection pc = p0.newPermissionCollection();
|
||||
pc.setReadOnly(); // this should lock out future adds
|
||||
//
|
||||
PropertyPermission p1 = new PropertyPermission("java.home","read");
|
||||
pc.add(p1);
|
||||
throw new
|
||||
Exception("Failed...PropertyPermission added to readonly PropertyPermissionCollection.");
|
||||
|
||||
} catch (SecurityException se) {
|
||||
System.out.println("PropertyPermissionCollection passed");
|
||||
}
|
||||
}
|
||||
|
||||
static void trySockPC() throws Exception {
|
||||
try {
|
||||
SocketPermission p0= new SocketPermission("example.com","connect");
|
||||
PermissionCollection pc = p0.newPermissionCollection();
|
||||
pc.setReadOnly(); // this should lock out future adds
|
||||
//
|
||||
SocketPermission p1= new SocketPermission("example.net","connect");
|
||||
pc.add(p1);
|
||||
throw new
|
||||
Exception("Failed...SocketPermission added to readonly SocketPermissionCollection.");
|
||||
|
||||
} catch (SecurityException se) {
|
||||
System.out.println("SocketPermissionCollection passed");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
static void tryFilePC() throws Exception {
|
||||
try {
|
||||
FilePermission p0 = new FilePermission("/tmp/foobar","read");
|
||||
PermissionCollection pc = p0.newPermissionCollection();
|
||||
pc.setReadOnly(); // this should lock out future adds
|
||||
//
|
||||
FilePermission p1 = new FilePermission("/tmp/quux","read");
|
||||
pc.add(p1);
|
||||
throw new
|
||||
Exception("Failed...FilePermission added to readonly FilePermissionCollection.");
|
||||
|
||||
} catch (SecurityException se) {
|
||||
System.out.println("FilePermissionCollection passed");
|
||||
}
|
||||
}
|
||||
|
||||
static void tryBasicPC() throws Exception {
|
||||
try {
|
||||
MyBasicPermission p0 = new MyBasicPermission("BasicPermision");
|
||||
PermissionCollection pc = p0.newPermissionCollection();
|
||||
pc.setReadOnly(); // this should lock out future adds
|
||||
//
|
||||
MyBasicPermission p1 = new MyBasicPermission("EvenMoreBasic");
|
||||
pc.add(p1);
|
||||
throw new
|
||||
Exception("Failed...BasicPermission added to readonly BasicPermissionCollection.");
|
||||
|
||||
} catch (SecurityException se) {
|
||||
System.out.println("BasicPermissionCollection passed");
|
||||
}
|
||||
}
|
||||
|
||||
static void tryAllPC() throws Exception {
|
||||
try {
|
||||
AllPermission p0 = new AllPermission("AllOfIt","read");
|
||||
PermissionCollection pc = p0.newPermissionCollection();
|
||||
pc.setReadOnly(); // this should lock out future adds
|
||||
//
|
||||
AllPermission p1 = new AllPermission("SomeOfIt","read");
|
||||
pc.add(p1);
|
||||
throw new
|
||||
Exception("Failed...AllPermission added to readonly AllPermissionCollection.");
|
||||
|
||||
} catch (SecurityException se) {
|
||||
System.out.println("AllPermissionCollection passed");
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
class MyBasicPermission extends BasicPermission {
|
||||
public MyBasicPermission(String name) {
|
||||
super(name);
|
||||
}
|
||||
}
|
||||
234
test/jdk/java/security/PermissionCollection/Concurrent.java
Normal file
234
test/jdk/java/security/PermissionCollection/Concurrent.java
Normal file
|
|
@ -0,0 +1,234 @@
|
|||
/*
|
||||
* Copyright (c) 2003, 2021, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 4671598
|
||||
* @summary PermissionCollection is not properly synchronized
|
||||
*/
|
||||
|
||||
import java.security.*; // AllPermission, BasicPermission, Permissions
|
||||
import java.net.NetPermission;
|
||||
import java.net.SocketPermission;
|
||||
import java.io.FilePermission;
|
||||
import java.util.PropertyPermission;
|
||||
import javax.security.auth.AuthPermission;
|
||||
import javax.security.auth.kerberos.DelegationPermission;
|
||||
import javax.security.auth.kerberos.ServicePermission;
|
||||
import javax.management.MBeanServerPermission;
|
||||
|
||||
import java.util.*;
|
||||
|
||||
public class Concurrent {
|
||||
private static final int LIMIT1 = 2000;
|
||||
private static final int LIMIT2 = 1000;
|
||||
private static final boolean debug = false;
|
||||
private static final Map errors =
|
||||
Collections.synchronizedMap(new HashMap());
|
||||
|
||||
public static void main(String args[]) throws Exception {
|
||||
testPc(allp);
|
||||
testPc(filep);
|
||||
testPc(sockp);
|
||||
testPc(propp);
|
||||
testPc(basicp);
|
||||
testPc(delegatep);
|
||||
testPc(servicep);
|
||||
testPc(mbeanp);
|
||||
testPc(unresp);
|
||||
|
||||
testPerms();
|
||||
|
||||
if (errors.size() > 0) {
|
||||
if (true) {
|
||||
Iterator iter = errors.entrySet().iterator();
|
||||
while (iter.hasNext()) {
|
||||
System.out.println(iter.next());
|
||||
}
|
||||
};
|
||||
throw (Exception) new Exception("Got errors");
|
||||
}
|
||||
}
|
||||
|
||||
private static void testPc (final Permission[] perm) throws Exception {
|
||||
|
||||
final PermissionCollection pc = perm[0].newPermissionCollection();
|
||||
|
||||
new Thread() {
|
||||
{
|
||||
setDaemon(true);
|
||||
start();
|
||||
}
|
||||
public void run() {
|
||||
try {
|
||||
for (int i = 0; i < LIMIT1; i++) {
|
||||
for (int j = 0; j < perm.length; j++) {
|
||||
pc.add(perm[j]);
|
||||
if (debug) {
|
||||
System.out.println("added " + perm[j]);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
errors.put(perm[0].getClass().getName(), e);
|
||||
}
|
||||
}
|
||||
};
|
||||
try {
|
||||
for (int i = 0; i < LIMIT2; i++) {
|
||||
boolean result = pc.implies(perm[perm.length-1]);
|
||||
if (debug) {
|
||||
System.out.println(perm[perm.length-1] + " implies " + result);
|
||||
}
|
||||
|
||||
Enumeration en = pc.elements();
|
||||
while (en.hasMoreElements()) {
|
||||
Object obj = en.nextElement();
|
||||
if (debug) {
|
||||
System.out.println(obj);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
errors.put(perm[0].getClass().getName(), e);
|
||||
}
|
||||
}
|
||||
|
||||
private static void testPerms () throws Exception {
|
||||
|
||||
final Permissions pc = new Permissions();
|
||||
|
||||
new Thread() {
|
||||
{
|
||||
setDaemon(true);
|
||||
start();
|
||||
}
|
||||
public void run() {
|
||||
try {
|
||||
for (int i = 0; i < LIMIT1; i++) {
|
||||
for (int j = 0; j < permlist.length; j++) {
|
||||
for (int k = 0; k < permlist[j].length; k++) {
|
||||
pc.add(permlist[j][k]);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
errors.put("java.security.Permissions", e);
|
||||
}
|
||||
}
|
||||
};
|
||||
try {
|
||||
for (int i = 0; i < LIMIT2; i++) {
|
||||
for (int j = 0; j < permlist.length; j++) {
|
||||
boolean result = pc.implies(permlist[j][0]);
|
||||
if (debug) {
|
||||
System.out.println(permlist[j][0] + " implies " + result);
|
||||
}
|
||||
}
|
||||
|
||||
Enumeration en = pc.elements();
|
||||
while (en.hasMoreElements()) {
|
||||
Object obj = en.nextElement();
|
||||
if (debug) {
|
||||
System.out.println(obj);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (Exception e) {
|
||||
errors.put("java.security.Permissions", e);
|
||||
}
|
||||
}
|
||||
|
||||
private static final Permission[] allp = new Permission[]{
|
||||
new AllPermission(), new AllPermission()};
|
||||
|
||||
private static final Permission[] filep = new Permission[]{
|
||||
new FilePermission("/tmp/foobar", "read"),
|
||||
new FilePermission("/tmp/foo", "write"),
|
||||
new FilePermission("/tmp/foobar", "read,write"),
|
||||
};
|
||||
|
||||
private static final Permission[] sockp = new Permission[]{
|
||||
new SocketPermission("example.net", "connect"),
|
||||
new SocketPermission("www.sun.com", "resolve"),
|
||||
new SocketPermission("www.test1.com", "accept"),
|
||||
new SocketPermission("www.test3.com", "resolve,connect"),
|
||||
new SocketPermission("www.test4.com", "listen"),
|
||||
};
|
||||
|
||||
private static final Permission[] propp = new Permission[]{
|
||||
new PropertyPermission("user.home", "read"),
|
||||
new PropertyPermission("java.home", "write"),
|
||||
new PropertyPermission("test.home", "write"),
|
||||
new PropertyPermission("test1.home", "read"),
|
||||
new PropertyPermission("test2.home", "read"),
|
||||
};
|
||||
|
||||
private static final Permission[] basicp = new Permission[] {
|
||||
new NetPermission("setDefaultAuthenticator"),
|
||||
new NetPermission("requestPasswordAuthentication"),
|
||||
new NetPermission("specifyStreamHandler")
|
||||
};
|
||||
|
||||
private static final Permission[] delegatep = new Permission[] {
|
||||
new DelegationPermission(
|
||||
"\"host/foo.example.com@EXAMPLE.COM\" \"cn=John,o=imc,c=us\""),
|
||||
new DelegationPermission(
|
||||
"\"user/rosanna@EXAMPLE.COM\" \"cn=John,o=imc,c=us\""),
|
||||
new DelegationPermission(
|
||||
"\"host/bar.example.com@EXAMPLE.COM\" \"cn=John,o=imc,c=us\"")
|
||||
};
|
||||
|
||||
private static final Permission[] servicep = new Permission[]{
|
||||
new ServicePermission("krbtgt/EXAMPLE.COM@EXAMPLE.COM", "initiate"),
|
||||
new ServicePermission("ldap/EXAMPLE.COM@EXAMPLE.COM", "initiate"),
|
||||
new ServicePermission("imap/EXAMPLE.COM@EXAMPLE.COM", "accept"),
|
||||
new ServicePermission("acap/EXAMPLE.COM@EXAMPLE.COM", "initiate"),
|
||||
new ServicePermission("host/EXAMPLE.COM@EXAMPLE.COM", "initiate"),
|
||||
};
|
||||
|
||||
private static final Permission[] mbeanp = new Permission[] {
|
||||
new MBeanServerPermission("createMBeanServer"),
|
||||
new MBeanServerPermission("findMBeanServer"),
|
||||
new MBeanServerPermission("newMBeanServer"),
|
||||
new MBeanServerPermission("releaseMBeanServer"),
|
||||
};
|
||||
|
||||
private static final Permission[] unresp = new Permission[] {
|
||||
new UnresolvedPermission("com.unknown.TestClass", "UnknownPermission",
|
||||
"read,write", null),
|
||||
new UnresolvedPermission("com.unknown.TestClass", "APermission",
|
||||
"read,write", null),
|
||||
new UnresolvedPermission("com.unknown.TestClass", "BPermission",
|
||||
"read,write", null),
|
||||
new UnresolvedPermission("com.unknown.CClass", "CPermission",
|
||||
"read,write", null),
|
||||
new UnresolvedPermission("com.unknown.DClass", "DUnknownPermission",
|
||||
"read,write", null),
|
||||
new UnresolvedPermission("com.unknown.EClass", "EUnknownPermission",
|
||||
"read,write", null),
|
||||
};
|
||||
|
||||
private static final Permission[][] permlist = new Permission[][]{
|
||||
allp, filep, sockp, propp, basicp, delegatep, servicep, mbeanp, unresp};
|
||||
}
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
/*
|
||||
* Copyright (c) 2015, 2017, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
/* @test
|
||||
* @bug 8081678
|
||||
* @summary Tests for stream returning methods
|
||||
* @library /lib/testlibrary/bootlib
|
||||
* @build java.base/java.util.stream.OpTestCase
|
||||
* @run testng/othervm PermissionCollectionStreamTest
|
||||
*/
|
||||
|
||||
import org.testng.annotations.DataProvider;
|
||||
import org.testng.annotations.Test;
|
||||
|
||||
import java.io.FilePermission;
|
||||
import java.security.Permission;
|
||||
import java.security.PermissionCollection;
|
||||
import java.util.Collection;
|
||||
import java.util.Collections;
|
||||
import java.util.function.Supplier;
|
||||
import java.util.stream.OpTestCase;
|
||||
import java.util.stream.Stream;
|
||||
import java.util.stream.TestData;
|
||||
|
||||
public class PermissionCollectionStreamTest extends OpTestCase {
|
||||
|
||||
@DataProvider
|
||||
public static Object[][] permissions() {
|
||||
return new Object[][]{
|
||||
{
|
||||
"FilePermission",
|
||||
new Permission[]{
|
||||
new FilePermission("/tmp/foobar", "read"),
|
||||
new FilePermission("/tmp/foo", "write"),
|
||||
new FilePermission("/tmp/foobar", "read,write"),
|
||||
}
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
private PermissionCollection create(Permission[] pa) {
|
||||
PermissionCollection pc = pa[0].newPermissionCollection();
|
||||
for (Permission p : pa) {
|
||||
pc.add(p);
|
||||
}
|
||||
return pc;
|
||||
}
|
||||
|
||||
@Test(dataProvider = "permissions")
|
||||
public void testElementsAsStream(String description, Permission[] pa) {
|
||||
PermissionCollection pc = create(pa);
|
||||
|
||||
Supplier<Stream<Permission>> ss = pc::elementsAsStream;
|
||||
|
||||
Collection<Permission> expected = Collections.list(pc.elements());
|
||||
withData(TestData.Factory.ofSupplier(description, ss))
|
||||
.stream(s -> s)
|
||||
.expectedResult(expected)
|
||||
.exercise();
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue