undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<!---->
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>Test data for ResourceBundle</comment>
<entry key="key">root: message</entry>
</properties>

View file

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<!---->
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>Test data for ResourceBundle</comment>
<entry key="key">de: message</entry>
</properties>

View file

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<!---->
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>Test data for ResourceBundle</comment>
<entry key="key">en: message</entry>
</properties>

View file

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<!---->
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>Test data for ResourceBundle</comment>
<entry key="key">fr: message</entry>
</properties>

View file

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<!---->
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>Test data for ResourceBundle in named modules.</comment>
<entry key="key">ja: message</entry>
</properties>

View file

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<!---->
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>Test data for ResourceBundle in named modules.</comment>
<entry key="key">zh: message</entry>
</properties>

View file

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<!---->
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>Test data for ResourceBundle in named modules.</comment>
<entry key="key">zh-TW: message</entry>
</properties>

View file

@ -0,0 +1,81 @@
/*
* Copyright (c) 2015, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package jdk.test.resources.spi;
import java.io.BufferedInputStream;
import java.io.InputStream;
import java.io.IOException;
import java.util.Enumeration;
import java.util.Locale;
import java.util.Properties;
import java.util.ResourceBundle;
import java.util.spi.ResourceBundleProvider;
public class MyResourcesProvider implements ResourceBundleProvider {
@Override
public ResourceBundle getBundle(String baseName, Locale locale) {
String xmlName = toXMLName(baseName, locale);
try (InputStream is = this.getClass().getModule().getResourceAsStream(xmlName)) {
return new XMLResourceBundle(new BufferedInputStream(is));
} catch (IOException e) {
throw new RuntimeException(e);
}
}
private String toXMLName(String baseName, Locale locale) {
StringBuilder sb = new StringBuilder(baseName.replace('.', '/'));
String lang = locale.getLanguage();
if (!lang.isEmpty()) {
sb.append('_').append(lang);
String country = locale.getCountry();
if (!country.isEmpty()) {
sb.append('_').append(country);
}
}
return sb.append(".xml").toString();
}
private static class XMLResourceBundle extends ResourceBundle {
private Properties props;
XMLResourceBundle(InputStream stream) throws IOException {
props = new Properties();
props.loadFromXML(stream);
}
@Override
protected Object handleGetObject(String key) {
if (key == null) {
throw new NullPointerException();
}
return props.get(key);
}
@Override
public Enumeration<String> getKeys() {
// Not implemented
return null;
}
}
}

View file

@ -0,0 +1,27 @@
/*
* Copyright (c) 2015, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
module bundles {
exports jdk.test.resources.spi to test;
provides jdk.test.resources.spi.MyResourcesProvider with jdk.test.resources.spi.MyResourcesProvider;
}

View file

@ -0,0 +1,51 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package jdk.test;
import java.util.Locale;
import java.util.ResourceBundle;
public class Main {
public static void main(String[] args) throws Exception {
int errors = 0;
for (String loctag : args) {
Locale locale = Locale.forLanguageTag(loctag);
if (locale.equals(Locale.ROOT)) {
continue;
}
ResourceBundle rb = ResourceBundle.getBundle("jdk.test.resources.MyResources",
locale);
String tag = locale.toLanguageTag(); // normalized
String value = rb.getString("key");
System.out.println("locale = " + tag + ", value = " + value);
if (!value.startsWith(tag + ':')) {
System.out.println("ERROR: " + value + " expected: " + tag);
errors++;
}
}
if (errors > 0) {
throw new RuntimeException(errors + " errors");
}
}
}

View file

@ -0,0 +1,28 @@
/*
* Copyright (c) 2015, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
module test {
requires bundles;
uses jdk.test.resources.spi.MyResourcesProvider;
}