undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/security/Security/signedfirst/DynSignedProvFirst.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * precompiled
+ **/
+
+import java.security.*;
+import java.security.cert.*;
+
+public class DynSignedProvFirst {
+    public static void main(String[] args) throws Exception {
+
+        Provider p = new com.sun.exp.provider.EXP();
+        Security.insertProviderAt(p, 1);
+
+        Object[] signers = p.getClass().getSigners();
+        if (signers == null || signers.length <= 0) {
+            throw new SecurityException("Test Failed");
+        } else {
+            for (int i = 0; i < signers.length; i++) {
+                System.out.println("signer [" + i + "] = " + signers[i]);
+            }
+        }
+
+        MessageDigest md = MessageDigest.getInstance("SHA1");
+        System.out.println("test passed");
+    }
+}

test/jdk/java/security/Security/signedfirst/DynStatic.java

@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2021, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+/*
+ * @test
+ * @bug 4504355 4744260
+ * @summary problems if signed crypto provider is the most preferred provider
+ * @modules java.base/sun.security.tools.keytool
+ *          jdk.jartool/sun.security.tools.jarsigner
+ * @library /test/lib
+ * @run main/othervm DynStatic
+ */
+
+import java.io.File;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import jdk.test.lib.compiler.CompilerUtils;
+import jdk.test.lib.process.ProcessTools;
+import jdk.test.lib.util.JarUtils;
+
+public class DynStatic {
+
+    private static final String TEST_SRC =
+        Paths.get(System.getProperty("test.src")).toString();
+    private static final Path TEST_CLASSES =
+        Paths.get(System.getProperty("test.classes"));
+
+    private static final Path EXP_SRC_DIR = Paths.get(TEST_SRC, "com");
+    private static final Path EXP_DEST_DIR = Paths.get("build");
+    private static final Path DYN_SRC =
+        Paths.get(TEST_SRC, "DynSignedProvFirst.java");
+    private static final Path STATIC_SRC =
+        Paths.get(TEST_SRC, "StaticSignedProvFirst.java");
+    private static final Path STATIC_PROPS =
+        Paths.get(TEST_SRC, "Static.props");
+
+    public static void main(String[] args) throws Exception {
+
+        // Compile the provider
+        CompilerUtils.compile(EXP_SRC_DIR, EXP_DEST_DIR);
+
+        // Create a jar file containing the provider
+        JarUtils.createJarFile(Path.of("exp.jar"), EXP_DEST_DIR, "com");
+
+        // Create a keystore
+        sun.security.tools.keytool.Main.main(
+            ("-genkeypair -dname CN=Signer -keystore exp.ks -storepass "
+                + "changeit -keypass changeit -keyalg rsa").split(" "));
+
+        // Sign jar
+        sun.security.tools.jarsigner.Main.main(
+                "-storepass changeit -keystore exp.ks exp.jar mykey"
+                        .split(" "));
+
+        // Compile the DynSignedProvFirst test program
+        CompilerUtils.compile(DYN_SRC, TEST_CLASSES, "-classpath", "exp.jar");
+
+        // Run the DynSignedProvFirst test program
+        ProcessTools.executeTestJava("-classpath",
+            TEST_CLASSES.toString() + File.pathSeparator + "exp.jar",
+            "DynSignedProvFirst")
+            .shouldContain("test passed");
+
+        // Compile the StaticSignedProvFirst test program
+        CompilerUtils.compile(STATIC_SRC, TEST_CLASSES, "-classpath", "exp.jar");
+
+        // Run the StaticSignedProvFirst test program
+        ProcessTools.executeTestJava("-classpath",
+            TEST_CLASSES.toString() + File.pathSeparator + "exp.jar",
+            "-Djava.security.properties=" + STATIC_PROPS.toUri(),
+            "StaticSignedProvFirst")
+            .shouldContain("test passed");
+    }
+}

test/jdk/java/security/Security/signedfirst/Static.props

@@ -0,0 +1,8 @@
+security.provider.1=com.sun.exp.provider.EXP
+security.provider.2=sun.security.provider.Sun
+security.provider.3=sun.security.rsa.SunRsaSign
+security.provider.4=com.sun.net.ssl.internal.ssl.Provider
+security.provider.5=com.sun.crypto.provider.SunJCE
+security.provider.6=sun.security.jgss.SunProvider
+security.provider.7=com.sun.security.sasl.Provider
+

test/jdk/java/security/Security/signedfirst/StaticSignedProvFirst.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2002, 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * precompiled
+ **/
+
+import java.util.*;
+
+import java.security.*;
+import java.security.cert.*;
+
+public class StaticSignedProvFirst {
+    public static void main(String[] args) throws Exception {
+
+        Class clazz = Class.forName("com.sun.exp.provider.EXP");
+
+        Provider[] providers = Security.getProviders();
+        System.out.println("Providers: " + Arrays.asList(providers));
+        if (providers[0].getName().equals("EXP") == false) {
+            throw new Exception("EXP provider not loaded!");
+        }
+        Object[] signers = providers[0].getClass().getSigners();
+        if (signers == null || signers.length <= 0) {
+            throw new SecurityException("Test Failed - provider not signed");
+        } else {
+            for (int i = 0; i < signers.length; i++) {
+                System.out.println("signer [" + i + "] = " + signers[i]);
+            }
+        }
+
+        MessageDigest md = MessageDigest.getInstance("SHA1", "EXP");
+
+        System.out.println("test passed");
+    }
+}

test/jdk/java/security/Security/signedfirst/com/sun/exp/provider/EXP.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package com.sun.exp.provider;
+
+import java.security.Provider;
+
+public class EXP extends Provider {
+
+    public EXP() {
+        super("EXP", 0.0d, "Test provider");
+        put("MessageDigest.SHA1", "com.sun.exp.provider.SHA");
+    }
+}

test/jdk/java/security/Security/signedfirst/com/sun/exp/provider/SHA.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package com.sun.exp.provider;
+
+import java.security.MessageDigestSpi;
+
+public class SHA extends MessageDigestSpi {
+    protected void engineReset() {}
+    protected void engineUpdate(byte input) {}
+    protected void engineUpdate(byte[] input, int offset, int len) {}
+    protected byte[] engineDigest() { return null; }
+}