engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

139
test/langtools/tools/javac/AnonymousClass/AnonymousClassFlags.java Normal file
View file

@ -0,0 +1,139 @@
/*
* Copyright (c) 2016, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8161013
* @summary Verify that anonymous class binaries have the correct flags set
* @run main AnonymousClassFlags
*/
import java.util.*;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.lang.classfile.*;
import java.lang.classfile.attribute.InnerClassInfo;
import java.lang.classfile.attribute.InnerClassesAttribute;
public class AnonymousClassFlags {
public static void main(String[] args) throws Exception {
new AnonymousClassFlags().test(System.getProperty("test.classes", "."));
}
/** Maps names of anonymous classes to their expected inner_class_access_flags */
private static Map<String, Integer> anonClasses = new LinkedHashMap<>();
// ******* TEST CASES ********
static Object o1 = new Object() {
{ anonClasses.put(getClass().getName(), 0); }
};
static void staticMethod() {
Object o2 = new Object() {
{ anonClasses.put(getClass().getName(), 0); }
};
}
static {
staticMethod();
Object o3 = new Object() {
{ anonClasses.put(getClass().getName(), 0); }
};
}
Object o4 = new Object() {
{ anonClasses.put(getClass().getName(), 0); }
};
void instanceMethod() {
Object o5 = new Object() {
{ anonClasses.put(getClass().getName(), 0); }
};
}
{
instanceMethod();
Object o6 = new Object() {
{ anonClasses.put(getClass().getName(), 0); }
};
}
// ******* TEST IMPLEMENTATION ********
void test(String classesDir) throws Exception {
staticMethod();
instanceMethod();
Path outerFile = Paths.get(classesDir, getClass().getName() + ".class");
ClassModel outerClass = ClassFile.of().parse(outerFile);
for (Map.Entry<String,Integer> entry : anonClasses.entrySet()) {
Path innerFile = Paths.get(classesDir, entry.getKey() + ".class");
ClassModel innerClass = ClassFile.of().parse(innerFile);
String name = entry.getKey();
int expected = entry.getValue();
assertInnerFlags(outerClass, name, expected);
assertClassFlags(innerClass, name, expected);
assertInnerFlags(innerClass, name, expected);
}
}
static void assertClassFlags(ClassModel classFile, String name, int expected) {
int mask = ClassFile.ACC_PUBLIC | ClassFile.ACC_FINAL | ClassFile.ACC_INTERFACE | ClassFile.ACC_ABSTRACT |
ClassFile.ACC_SYNTHETIC | ClassFile.ACC_ANNOTATION | ClassFile.ACC_ENUM;
int classExpected = (expected & mask) | ClassFile.ACC_SUPER;
int classActual = classFile.flags().flagsMask();
if (classActual != classExpected) {
throw new AssertionError("Incorrect access_flags for class " + name +
": expected=" + classExpected + ", actual=" + classActual);
}
}
static void assertInnerFlags(ClassModel classFile, String name, int expected) {
int innerActual = lookupInnerFlags(classFile, name);
if (innerActual != expected) {
throw new AssertionError("Incorrect inner_class_access_flags for class " + name +
" in class " + classFile.thisClass().asInternalName() +
": expected=" + expected + ", actual=" + innerActual);
}
}
private static int lookupInnerFlags(ClassModel classFile, String innerName) {
InnerClassesAttribute inners = classFile.findAttribute(Attributes.innerClasses()).orElse(null);
if (inners == null) {
throw new AssertionError("InnerClasses attribute missing in class " + classFile.thisClass().asInternalName());
}
for (InnerClassInfo info: inners.classes()) {
String entryName = info.innerClass().asInternalName();
if (innerName.equals(entryName)) {
return info.flagsMask();
}
}
throw new AssertionError("No InnerClasses entry in class " + classFile.thisClass().asInternalName() + " for class " + innerName);
}
}

67
test/langtools/tools/javac/AnonymousClass/AnonymousCtorExceptionTest.java Normal file
View file

@ -0,0 +1,67 @@
/*
* Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8166367
* @summary Missing ExceptionTable attribute in anonymous class constructors
* @library /tools/lib
* @modules jdk.compiler/com.sun.tools.javac.api
* jdk.compiler/com.sun.tools.javac.main
* jdk.jdeps/com.sun.tools.javap
* @build toolbox.ToolBox toolbox.JavapTask
* @run compile -g AnonymousCtorExceptionTest.java
* @run main AnonymousCtorExceptionTest
*/
import java.io.IOException;
import java.nio.file.Path;
import java.nio.file.Paths;
import toolbox.JavapTask;
import toolbox.Task;
import toolbox.ToolBox;
public class AnonymousCtorExceptionTest {
AnonymousCtorExceptionTest() throws IOException {
}
public static void main(String args[]) throws Exception {
new AnonymousCtorExceptionTest() {
};
ToolBox tb = new ToolBox();
Path classPath = Paths.get(ToolBox.testClasses, "AnonymousCtorExceptionTest$1.class");
String javapOut = new JavapTask(tb)
.options("-v", "-p")
.classes(classPath.toString())
.run()
.getOutput(Task.OutputKind.DIRECT);
if (!javapOut.contains("AnonymousCtorExceptionTest$1() throws java.io.IOException;"))
throw new AssertionError("Unexpected output " + javapOut);
if (!javapOut.contains("Exceptions:"))
throw new AssertionError("Unexpected output " + javapOut);
}
}

27
test/langtools/tools/javac/AnonymousClass/AnonymousInSuperCallNegTest.java Normal file
View file

@ -0,0 +1,27 @@
/*
* @test /nodynamiccopyright/
* @bug 8166108
* @summary Verify that a program cannot access instance state before construction
* @compile/fail/ref=AnonymousInSuperCallNegTest.out -XDrawDiagnostics AnonymousInSuperCallNegTest.java
*/
public class AnonymousInSuperCallNegTest {
static class Base {
Base(Object o) {}
}
static class Outer {
class Inner {}
}
public static class JavacBug extends Base {
int x;
JavacBug() {
super(new Outer().new Inner() {
void foo() {
System.out.println("x = " + x);
}
}); }
}
}

2
test/langtools/tools/javac/AnonymousClass/AnonymousInSuperCallNegTest.out Normal file
View file

@ -0,0 +1,2 @@
AnonymousInSuperCallNegTest.java:23:49: compiler.err.cant.ref.before.ctor.called: x
1 error

48
test/langtools/tools/javac/AnonymousClass/AnonymousInSuperCallTest.java Normal file
View file

@ -0,0 +1,48 @@
/*
* Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8166108
* @summary Verify that javac skips outer this to anonymous inner classes in super type constructor calls
*
*/
public class AnonymousInSuperCallTest {
static class Base {
Base(Object o) {}
}
static class Outer {
class Inner {}
}
public static class JavacBug extends Base {
JavacBug() { super(new Outer().new Inner() {}); }
}
public static void main(String[] args) {
new JavacBug();
}
}

45
test/langtools/tools/javac/AnonymousClass/CtorAccessBypassTest.java Normal file
View file

@ -0,0 +1,45 @@
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8075799
*
* @summary Extraneous access checks implemented by javac
* @compile CtorAccessBypassTest.java
* @run main CtorAccessBypassTest
*
*/
public class CtorAccessBypassTest {
public static void main(String[] args) {
new CtorAccessBypassTest_01<Object>(null) {};
new CtorAccessBypassTest_01<>(null) {};
}
}
class CtorAccessBypassTest_01<T> {
private class Private {}
CtorAccessBypassTest_01(Private p) {
}
}