undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/util/spi/ResourceBundleControlProvider/UserDefaultControlTest.java

@@ -0,0 +1,107 @@
+/*
+ * Copyright (c) 2012, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+/*
+ * @test
+ * @bug 6959653 8172365
+ * @summary Test ResourceBundle.Control provided using SPI.
+ * @library test
+ * @build test/*
+ * @build com.foo.UserControlProvider
+ * @run main/othervm UserDefaultControlTest
+ */
+
+import java.io.IOException;
+import java.nio.file.*;
+import java.util.*;
+
+import jdk.test.*;
+
+public class UserDefaultControlTest {
+    public static void main(String... args) throws Exception {
+        initServices();
+        test();
+    }
+
+    private static void initServices() throws IOException {
+        Path testClasses = Paths.get(System.getProperty("test.classes"));
+        Path services = testClasses.resolve(Paths.get("META-INF", "services"));
+        Files.createDirectories(services);
+        Files.write(services.resolve("java.util.spi.ResourceBundleControlProvider"),
+                List.of("com.foo.UserControlProvider"));
+        Path comfoo = testClasses.resolve(Paths.get("com", "foo"));
+        Path testSrcComFoo =
+            Paths.get(System.getProperty("test.src")).resolve(Paths.get("com", "foo"));
+        Files.copy(testSrcComFoo.resolve("XmlRB.xml"), comfoo.resolve("XmlRB.xml"),
+            StandardCopyOption.REPLACE_EXISTING);
+        Files.copy(testSrcComFoo.resolve("XmlRB_ja.xml"), comfoo.resolve("XmlRB_ja.xml"),
+            StandardCopyOption.REPLACE_EXISTING);
+    }
+
+    private static void test() {
+        ResourceBundle rb = ResourceBundle.getBundle("com.foo.XmlRB", Locale.ROOT);
+        String type = rb.getString("type");
+        if (!type.equals("XML")) {
+            throw new RuntimeException("Root Locale: type: got " + type
+                                       + ", expected XML (ASCII)");
+        }
+
+        rb = ResourceBundle.getBundle("com.foo.XmlRB", Locale.JAPAN);
+        type = rb.getString("type");
+        // Expect fullwidth "XML"
+        if (!type.equals("\uff38\uff2d\uff2c")) {
+            throw new RuntimeException("Locale.JAPAN: type: got " + type
+                                       + ", expected \uff38\uff2d\uff2c (fullwidth XML)");
+        }
+
+        try {
+            rb = ResourceBundle.getBundle("com.bar.XmlRB", Locale.JAPAN);
+            throw new RuntimeException("com.bar.XmlRB test failed.");
+        } catch (MissingResourceException e) {
+            // OK
+        }
+
+        // tests with named module. Only resource bundles on the classpath
+        // should be available, unless an unnamed module is explicitly
+        // specified.
+        rb = ResourceBundleDelegate.getBundle("simple", Locale.ROOT);
+        try {
+            rb = ResourceBundleDelegate.getBundle("com.foo.XmlRB", Locale.ROOT);
+            throw new RuntimeException("getBundle in a named module incorrectly loaded " +
+                                    "a resouce bundle through RBControlProvider");
+        } catch (MissingResourceException e) {
+            // OK
+        }
+
+        Module unnamedModule = UserDefaultControlTest.class
+                                .getClassLoader()
+                                .getUnnamedModule();
+        rb = ResourceBundleDelegate.getBundle("com.foo.XmlRB", Locale.JAPAN, unnamedModule);
+        type = rb.getString("type");
+        // Expect fullwidth "XML"
+        if (!type.equals("\uff38\uff2d\uff2c")) {
+            throw new RuntimeException("getBundle called from named module for unnamed module."
+                                       + " Locale.JAPAN: type: got " + type
+                                       + ", expected \uff38\uff2d\uff2c (fullwidth XML)");
+        }
+    }
+}

test/jdk/java/util/spi/ResourceBundleControlProvider/com/foo/UserControlProvider.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 2012, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package com.foo;
+
+import java.util.ResourceBundle;
+import java.util.spi.ResourceBundleControlProvider;
+
+public class UserControlProvider implements ResourceBundleControlProvider {
+    static final ResourceBundle.Control XMLCONTROL = new UserXMLControl();
+
+    public ResourceBundle.Control getControl(String baseName) {
+        System.out.println(getClass().getName()+".getControl called for " + baseName);
+
+        // Throws a NPE if baseName is null.
+        if (baseName.startsWith("com.foo.Xml")) {
+            System.out.println("\treturns " + XMLCONTROL);
+            return XMLCONTROL;
+        }
+        System.out.println("\treturns null");
+        return null;
+    }
+}

test/jdk/java/util/spi/ResourceBundleControlProvider/com/foo/UserXMLControl.java

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2012, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package com.foo;
+
+import java.io.*;
+import java.net.*;
+import java.util.*;
+import static java.util.ResourceBundle.Control.*;
+
+public class UserXMLControl extends ResourceBundle.Control {
+    @Override
+    public List<String> getFormats(String baseName) {
+        if (baseName == null) {
+            throw new NullPointerException();
+        }
+        return Arrays.asList("xml");
+    }
+
+    @Override
+    public ResourceBundle newBundle(String baseName, Locale locale,
+                                    String format,
+                                    ClassLoader loader,
+                                    boolean reload)
+        throws IllegalAccessException,
+               InstantiationException, IOException {
+        if (baseName == null || locale == null
+            || format == null || loader == null) {
+            throw new NullPointerException();
+        }
+        ResourceBundle bundle = null;
+        if (format.equals("xml")) {
+            String bundleName = toBundleName(baseName, locale);
+            String resourceName = toResourceName(bundleName, format);
+            URL url = loader.getResource(resourceName);
+            if (url != null) {
+                URLConnection connection = url.openConnection();
+                if (connection != null) {
+                    if (reload) {
+                        // disable caches if reloading
+                        connection.setUseCaches(false);
+                    }
+                    try (InputStream stream = connection.getInputStream()) {
+                        if (stream != null) {
+                            BufferedInputStream bis = new BufferedInputStream(stream);
+                            bundle = new XMLResourceBundle(bis);
+                        }
+                    }
+                }
+            }
+        }
+        return bundle;
+    }
+
+    private static class XMLResourceBundle extends ResourceBundle {
+        private Properties props;
+
+        XMLResourceBundle(InputStream stream) throws IOException {
+            props = new Properties();
+            props.loadFromXML(stream);
+        }
+
+        protected Object handleGetObject(String key) {
+            if (key == null) {
+                throw new NullPointerException();
+            }
+            return props.get(key);
+        }
+
+        public Enumeration<String> getKeys() {
+            // Not implemented
+            return null;
+        }
+    }
+}

test/jdk/java/util/spi/ResourceBundleControlProvider/com/foo/XmlRB.xml

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ 
+ This code is free software; you can redistribute it and/or modify it
+ under the terms of the GNU General Public License version 2 only, as
+ published by the Free Software Foundation.
+ 
+ This code is distributed in the hope that it will be useful, but WITHOUT
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ version 2 for more details (a copy is included in the LICENSE file that
+ accompanied this code).
+ 
+ You should have received a copy of the GNU General Public License version
+ 2 along with this work; if not, write to the Free Software Foundation,
+ Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ 
+ Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ or visit www.oracle.com if you need additional information or have any
+ questions.
+-->
+<!---->
+
+<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
+<properties>
+    <comment>Test data for UserDefaultControlTest.java</comment>
+    <entry key="type">XML</entry>
+</properties>

test/jdk/java/util/spi/ResourceBundleControlProvider/com/foo/XmlRB_ja.xml

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ 
+ This code is free software; you can redistribute it and/or modify it
+ under the terms of the GNU General Public License version 2 only, as
+ published by the Free Software Foundation.
+ 
+ This code is distributed in the hope that it will be useful, but WITHOUT
+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ version 2 for more details (a copy is included in the LICENSE file that
+ accompanied this code).
+ 
+ You should have received a copy of the GNU General Public License version
+ 2 along with this work; if not, write to the Free Software Foundation,
+ Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ 
+ Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ or visit www.oracle.com if you need additional information or have any
+ questions.
+-->
+<!---->
+
+<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
+<properties>
+    <comment>Test data for UserDefaultControlTest.java</comment>
+    <entry key="type">ＸＭＬ</entry>
+</properties>

test/jdk/java/util/spi/ResourceBundleControlProvider/simple.properties

@@ -0,0 +1,23 @@
+#
+# Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+key = value

test/jdk/java/util/spi/ResourceBundleControlProvider/test/jdk/test/ResourceBundleDelegate.java

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package jdk.test;
+
+import java.util.Locale;
+import java.util.ResourceBundle;
+
+public class ResourceBundleDelegate {
+    public static ResourceBundle getBundle(String baseName, Locale locale) {
+        return ResourceBundle.getBundle(baseName, locale);
+    }
+
+    public static ResourceBundle getBundle(String baseName, Locale locale, Module module) {
+        return ResourceBundle.getBundle(baseName, locale, module);
+    }
+}

test/jdk/java/util/spi/ResourceBundleControlProvider/test/module-info.java

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+module test {
+    exports jdk.test;
+}

test/jdk/java/util/spi/ToolProviderDescriptionTest.java

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8287121
+ * @summary test ToolProvider's description API
+ * @run main/othervm ToolProviderDescriptionTest
+ */
+
+import java.util.Comparator;
+import java.util.List;
+import java.util.ServiceLoader;
+import java.util.spi.ToolProvider;
+import java.util.stream.StreamSupport;
+
+public class ToolProviderDescriptionTest {
+    public static void main(String... args) throws Exception {
+        List<String> descriptions = listToolDescriptions();
+        if (descriptions.isEmpty()) {
+            throw new AssertionError("No tool observable?");
+        }
+    }
+
+    static List<String> listToolDescriptions() {
+        return StreamSupport.stream(ServiceLoader.load(ToolProvider.class).spliterator(), false)
+            .sorted(Comparator.comparing(ToolProvider::name))
+            .map(ToolProviderDescriptionTest::describeTool)
+            .toList();
+    }
+
+    static String describeTool(ToolProvider tool) {
+        String name = tool.name();
+        String description = tool.description().orElse("<tool description not available>");
+        return "%20s - %s".formatted(name, description);
+    }
+}

test/jdk/java/util/spi/ToolProviderTest.java

@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2016, 2024, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8159855
+ * @summary test ToolProvider SPI
+ * @run main/othervm ToolProviderTest
+ */
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.spi.ToolProvider;
+
+public class ToolProviderTest {
+    public static void main(String... args) throws Exception {
+        ToolProviderTest t = new ToolProviderTest();
+        t.run();
+    }
+
+    void run() throws Exception {
+        initServices();
+        test();
+        testNullArgs();
+    }
+
+    private void test() throws Exception {
+        ToolProvider testProvider = ToolProvider.findFirst("test").get();
+        int rc = testProvider.run(System.out, System.err, "hello test");
+        if (rc != 0) {
+            throw new Exception("unexpected exit code: " + rc);
+        }
+    }
+
+    private void testNullArgs() {
+        ToolProvider testProvider = ToolProvider.findFirst("test").get();
+
+        // out null check
+        expectNullPointerException(() -> testProvider.run(null, System.err));
+
+        // err null check
+        expectNullPointerException(() -> testProvider.run(System.out, null));
+
+        // args array null check
+        expectNullPointerException(() ->
+                testProvider.run(System.out, System.err, (String[]) null));
+
+        // args array elements null check
+        expectNullPointerException(() ->
+                testProvider.run(System.out, System.err, (String) null));
+    }
+
+    private static void expectNullPointerException(Runnable test) {
+        try {
+            test.run();
+            throw new Error("NullPointerException not thrown");
+        } catch (NullPointerException e) {
+            // expected
+        }
+    }
+
+    private void initServices() throws IOException {
+        Path testClasses = Paths.get(System.getProperty("test.classes"));
+        Path services = testClasses.resolve(Paths.get("META-INF", "services"));
+        Files.createDirectories(services);
+        Files.write(services.resolve(ToolProvider.class.getName()),
+                Arrays.asList(TestProvider.class.getName()));
+    }
+
+    public static class TestProvider implements ToolProvider {
+        public String name() {
+            return "test";
+        }
+
+        public int run(PrintWriter out, PrintWriter err, String... args) {
+            out.println("Test: " + Arrays.toString(args));
+            return 0;
+        }
+    }
+}
+