diff --git a/tools/aegis4j/.gitignore b/tools/aegis4j/.gitignore deleted file mode 100644 index e687b24141..0000000000 --- a/tools/aegis4j/.gitignore +++ /dev/null @@ -1,7 +0,0 @@ -bin/ -build/ -.gradle/ -.settings/ -.classpath -.project -gradle.properties diff --git a/tools/aegis4j/build.gradle b/tools/aegis4j/build.gradle index 464c8bd176..908e4980d0 100644 --- a/tools/aegis4j/build.gradle +++ b/tools/aegis4j/build.gradle @@ -47,8 +47,10 @@ java { } test { + jvmArgs "-javaagent:${shadowJar.archiveFile.get()}=dynamic" useJUnitPlatform() systemProperty 'jdk.attach.allowAttachSelf', 'true' // tests attach agent to local VM + systemProperty 'aegis4j.projectRoot', "${project.rootDir.toString()}" forkEvery 1 // tests cannot undo class modifications to clean up after themselves testLogging { events 'passed', 'skipped', 'failed' @@ -79,6 +81,7 @@ shadowJar { } tasks.build.dependsOn tasks.shadowJar +tasks.test.dependsOn tasks.shadowJar /* publishing { diff --git a/tools/aegis4j/gradlew b/tools/aegis4j/gradlew deleted file mode 100755 index c53aefaa5f..0000000000 --- a/tools/aegis4j/gradlew +++ /dev/null @@ -1,234 +0,0 @@ -#!/bin/sh - -# -# Copyright © 2015-2021 the original authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# - -############################################################################## -# -# Gradle start up script for POSIX generated by Gradle. -# -# Important for running: -# -# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is -# noncompliant, but you have some other compliant shell such as ksh or -# bash, then to run this script, type that shell name before the whole -# command line, like: -# -# ksh Gradle -# -# Busybox and similar reduced shells will NOT work, because this script -# requires all of these POSIX shell features: -# * functions; -# * expansions «$var», «${var}», «${var:-default}», «${var+SET}», -# «${var#prefix}», «${var%suffix}», and «$( cmd )»; -# * compound commands having a testable exit status, especially «case»; -# * various built-in commands including «command», «set», and «ulimit». -# -# Important for patching: -# -# (2) This script targets any POSIX shell, so it avoids extensions provided -# by Bash, Ksh, etc; in particular arrays are avoided. -# -# The "traditional" practice of packing multiple parameters into a -# space-separated string is a well documented source of bugs and security -# problems, so this is (mostly) avoided, by progressively accumulating -# options in "$@", and eventually passing that to Java. -# -# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS, -# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly; -# see the in-line comments for details. -# -# There are tweaks for specific operating systems such as AIX, CygWin, -# Darwin, MinGW, and NonStop. -# -# (3) This script is generated from the Groovy template -# https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt -# within the Gradle project. -# -# You can find Gradle at https://github.com/gradle/gradle/. -# -############################################################################## - -# Attempt to set APP_HOME - -# Resolve links: $0 may be a link -app_path=$0 - -# Need this for daisy-chained symlinks. -while - APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path - [ -h "$app_path" ] -do - ls=$( ls -ld "$app_path" ) - link=${ls#*' -> '} - case $link in #( - /*) app_path=$link ;; #( - *) app_path=$APP_HOME$link ;; - esac -done - -APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit - -APP_NAME="Gradle" -APP_BASE_NAME=${0##*/} - -# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. -DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' - -# Use the maximum available, or set MAX_FD != -1 to use that value. -MAX_FD=maximum - -warn () { - echo "$*" -} >&2 - -die () { - echo - echo "$*" - echo - exit 1 -} >&2 - -# OS specific support (must be 'true' or 'false'). -cygwin=false -msys=false -darwin=false -nonstop=false -case "$( uname )" in #( - CYGWIN* ) cygwin=true ;; #( - Darwin* ) darwin=true ;; #( - MSYS* | MINGW* ) msys=true ;; #( - NONSTOP* ) nonstop=true ;; -esac - -CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar - - -# Determine the Java command to use to start the JVM. -if [ -n "$JAVA_HOME" ] ; then - if [ -x "$JAVA_HOME/jre/sh/java" ] ; then - # IBM's JDK on AIX uses strange locations for the executables - JAVACMD=$JAVA_HOME/jre/sh/java - else - JAVACMD=$JAVA_HOME/bin/java - fi - if [ ! -x "$JAVACMD" ] ; then - die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME - -Please set the JAVA_HOME variable in your environment to match the -location of your Java installation." - fi -else - JAVACMD=java - which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. - -Please set the JAVA_HOME variable in your environment to match the -location of your Java installation." -fi - -# Increase the maximum file descriptors if we can. -if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then - case $MAX_FD in #( - max*) - MAX_FD=$( ulimit -H -n ) || - warn "Could not query maximum file descriptor limit" - esac - case $MAX_FD in #( - '' | soft) :;; #( - *) - ulimit -n "$MAX_FD" || - warn "Could not set maximum file descriptor limit to $MAX_FD" - esac -fi - -# Collect all arguments for the java command, stacking in reverse order: -# * args from the command line -# * the main class name -# * -classpath -# * -D...appname settings -# * --module-path (only if needed) -# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. - -# For Cygwin or MSYS, switch paths to Windows format before running java -if "$cygwin" || "$msys" ; then - APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) - CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) - - JAVACMD=$( cygpath --unix "$JAVACMD" ) - - # Now convert the arguments - kludge to limit ourselves to /bin/sh - for arg do - if - case $arg in #( - -*) false ;; # don't mess with options #( - /?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath - [ -e "$t" ] ;; #( - *) false ;; - esac - then - arg=$( cygpath --path --ignore --mixed "$arg" ) - fi - # Roll the args list around exactly as many times as the number of - # args, so each arg winds up back in the position where it started, but - # possibly modified. - # - # NB: a `for` loop captures its iteration list before it begins, so - # changing the positional parameters here affects neither the number of - # iterations, nor the values presented in `arg`. - shift # remove old arg - set -- "$@" "$arg" # push replacement arg - done -fi - -# Collect all arguments for the java command; -# * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of -# shell script including quotes and variable substitutions, so put them in -# double quotes to make sure that they get re-expanded; and -# * put everything else in single quotes, so that it's not re-expanded. - -set -- \ - "-Dorg.gradle.appname=$APP_BASE_NAME" \ - -classpath "$CLASSPATH" \ - org.gradle.wrapper.GradleWrapperMain \ - "$@" - -# Use "xargs" to parse quoted args. -# -# With -n1 it outputs one arg per line, with the quotes and backslashes removed. -# -# In Bash we could simply go: -# -# readarray ARGS < <( xargs -n1 <<<"$var" ) && -# set -- "${ARGS[@]}" "$@" -# -# but POSIX shell has neither arrays nor command substitution, so instead we -# post-process each arg (as a line of input to sed) to backslash-escape any -# character that might be a shell metacharacter, then use eval to reverse -# that process (while maintaining the separation between arguments), and wrap -# the whole thing up as a single "set" statement. -# -# This will of course break if any of these variables contains a newline or -# an unmatched quote. -# - -eval "set -- $( - printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | - xargs -n1 | - sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | - tr '\n' ' ' - )" '"$@"' - -exec "$JAVACMD" "$@" diff --git a/tools/aegis4j/gradlew.bat b/tools/aegis4j/gradlew.bat deleted file mode 100755 index 107acd32c4..0000000000 --- a/tools/aegis4j/gradlew.bat +++ /dev/null @@ -1,89 +0,0 @@ -@rem -@rem Copyright 2015 the original author or authors. -@rem -@rem Licensed under the Apache License, Version 2.0 (the "License"); -@rem you may not use this file except in compliance with the License. -@rem You may obtain a copy of the License at -@rem -@rem https://www.apache.org/licenses/LICENSE-2.0 -@rem -@rem Unless required by applicable law or agreed to in writing, software -@rem distributed under the License is distributed on an "AS IS" BASIS, -@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -@rem See the License for the specific language governing permissions and -@rem limitations under the License. -@rem - -@if "%DEBUG%" == "" @echo off -@rem ########################################################################## -@rem -@rem Gradle startup script for Windows -@rem -@rem ########################################################################## - -@rem Set local scope for the variables with windows NT shell -if "%OS%"=="Windows_NT" setlocal - -set DIRNAME=%~dp0 -if "%DIRNAME%" == "" set DIRNAME=. -set APP_BASE_NAME=%~n0 -set APP_HOME=%DIRNAME% - -@rem Resolve any "." and ".." in APP_HOME to make it shorter. -for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi - -@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. -set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" - -@rem Find java.exe -if defined JAVA_HOME goto findJavaFromJavaHome - -set JAVA_EXE=java.exe -%JAVA_EXE% -version >NUL 2>&1 -if "%ERRORLEVEL%" == "0" goto execute - -echo. -echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. -echo. -echo Please set the JAVA_HOME variable in your environment to match the -echo location of your Java installation. - -goto fail - -:findJavaFromJavaHome -set JAVA_HOME=%JAVA_HOME:"=% -set JAVA_EXE=%JAVA_HOME%/bin/java.exe - -if exist "%JAVA_EXE%" goto execute - -echo. -echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% -echo. -echo Please set the JAVA_HOME variable in your environment to match the -echo location of your Java installation. - -goto fail - -:execute -@rem Setup the command line - -set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar - - -@rem Execute Gradle -"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* - -:end -@rem End local scope for the variables with windows NT shell -if "%ERRORLEVEL%"=="0" goto mainEnd - -:fail -rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of -rem the _cmd.exe /c_ return code! -if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 -exit /b 1 - -:mainEnd -if "%OS%"=="Windows_NT" endlocal - -:omega diff --git a/tools/aegis4j/src/main/java/net/gredler/aegis4j/Patcher.java b/tools/aegis4j/src/main/java/net/gredler/aegis4j/Patcher.java index d450c6a02e..636a09af77 100644 --- a/tools/aegis4j/src/main/java/net/gredler/aegis4j/Patcher.java +++ b/tools/aegis4j/src/main/java/net/gredler/aegis4j/Patcher.java @@ -2,6 +2,15 @@ package net.gredler.aegis4j; +import javassist.ByteArrayClassPath; +import javassist.CannotCompileException; +import javassist.ClassPool; +import javassist.CtClass; +import javassist.CtConstructor; +import javassist.CtMethod; +import javassist.LoaderClassPath; +import javassist.NotFoundException; + import java.io.IOException; import java.io.InputStream; import java.lang.instrument.ClassFileTransformer; @@ -17,15 +26,6 @@ import java.util.Set; import java.util.TreeMap; import java.util.stream.Collectors; -import javassist.ByteArrayClassPath; -import javassist.CannotCompileException; -import javassist.ClassPool; -import javassist.CtClass; -import javassist.CtConstructor; -import javassist.CtMethod; -import javassist.LoaderClassPath; -import javassist.NotFoundException; - /** * Disables rarely-used platform features like JNDI and RMI so that they cannot be exploited by attackers. * See the {@code mods.properties} file for the actual class modification configuration. @@ -33,6 +33,7 @@ import javassist.NotFoundException; public final class Patcher implements ClassFileTransformer { private final Map> modifications; // class name -> modifications + private static Patcher patcher; /** * Creates a new class patcher which blocks the specified features. @@ -51,7 +52,8 @@ public final class Patcher implements ClassFileTransformer { */ public static void start(Instrumentation instr, Set block, InputStream inputStream) { System.out.println("Aegis4j patching starting"); - Patcher patcher = new Patcher(block ,inputStream); + if (patcher != null) instr.removeTransformer(patcher); + patcher = new Patcher(block, inputStream); instr.addTransformer(patcher, true); for (String className : patcher.modifications.keySet()) { @@ -87,17 +89,19 @@ public final class Patcher implements ClassFileTransformer { try { CtClass clazz = pool.get(className); for (Modification mod : mods) { - if (mod.isConstructor()) { - for (CtConstructor constructor : clazz.getConstructors()) { - constructor.setBody(mod.newBody); - } - } else { - CtMethod[] methods = mod.isAll() ? clazz.getDeclaredMethods() : clazz.getDeclaredMethods(mod.methodName); - if (methods.length == 0) { - System.err.println("ERROR: Method not found: " + className + "." + mod.methodName); - } - for (CtMethod method : methods) { - method.setBody(mod.newBody); + if (mod.enabled) { + if (mod.isConstructor()) { + for (CtConstructor constructor : clazz.getConstructors()) { + constructor.setBody(mod.newBody); + } + } else { + CtMethod[] methods = mod.isAll() ? clazz.getDeclaredMethods() : clazz.getDeclaredMethods(mod.methodName); + if (methods.length == 0) { + System.err.println("ERROR: Method not found: " + className + "." + mod.methodName); + } + for (CtMethod method : methods) { + method.setBody(mod.newBody); + } } } } @@ -121,13 +125,13 @@ public final class Patcher implements ClassFileTransformer { int first = key.indexOf('.'); int last = key.lastIndexOf('.'); String feature = key.substring(0, first).toLowerCase(); - if (block.contains(feature)) { + //if (block.contains(feature)) { String className = key.substring(first + 1, last); String methodName = key.substring(last + 1); - String newBody = props.getProperty(key); - Modification mod = new Modification(className, methodName, newBody); + String newBody = props.getProperty(key); + Modification mod = new Modification(className, methodName, newBody, block.contains(feature)); mods.add(mod); - } + //} } return Collections.unmodifiableMap(new TreeMap<>( @@ -140,11 +144,13 @@ public final class Patcher implements ClassFileTransformer { public final String className; public final String methodName; public final String newBody; + public final boolean enabled; - public Modification(String className, String methodName, String newBody) { + public Modification(String className, String methodName, String newBody, boolean enabled) { this.className = className; this.methodName = methodName; this.newBody = newBody; + this.enabled = enabled; } public boolean isConstructor() { diff --git a/tools/aegis4j/src/main/resources/net/gredler/aegis4j/mods.properties b/tools/aegis4j/src/main/resources/net/gredler/aegis4j/mods.properties index 81a01729cf..80f1c8971c 100644 --- a/tools/aegis4j/src/main/resources/net/gredler/aegis4j/mods.properties +++ b/tools/aegis4j/src/main/resources/net/gredler/aegis4j/mods.properties @@ -21,7 +21,7 @@ RMI.java.rmi.server.RemoteObject.RemoteObject=throw new java.lang.RuntimeExcepti # need to use these methods for legitimate purposes. PROCESS.java.lang.Runtime.exec=throw new java.io.IOException("Process execution blocked by aegis4j"); PROCESS.java.lang.ProcessBuilder.start=throw new java.io.IOException("Process execution blocked by aegis4j"); -PROCESS.java.lang.ProcessBuilder.startPipeline=throw new java.io.IOException("Process execution blocked by aegis4j"); +#PROCESS.java.lang.ProcessBuilder.startPipeline=throw new java.io.IOException("Process execution blocked by aegis4j"); # JDK HTTP Server # --------------- @@ -52,13 +52,12 @@ SCRIPTING.javax.script.ScriptEngineManager.ScriptEngineManager=throw new java.la SCRIPTING.javax.script.AbstractScriptEngine.AbstractScriptEngine=throw new java.lang.RuntimeException("Scripting blocked by aegis4j"); SCRIPTING.javax.script.SimpleScriptContext.SimpleScriptContext=throw new java.lang.RuntimeException("Scripting blocked by aegis4j"); SCRIPTING.javax.script.CompiledScript.CompiledScript=throw new java.lang.RuntimeException("Scripting blocked by aegis4j"); - # JShell # ------ # Introduced in JDK 9, the Java Shell is intended for rapid prototyping and testing. It is not usually used in production. -JSHELL.jdk.jshell.JShell.JShell=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); -JSHELL.jdk.jshell.JShell.create=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); -JSHELL.jdk.jshell.JShell.builder=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); -JSHELL.jdk.jshell.tool.JavaShellToolBuilder.builder=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); -JSHELL.jdk.jshell.Snippet.Snippet=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); -JSHELL.jdk.jshell.TaskFactory.parse=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); +#JSHELL.jdk.jshell.JShell.JShell=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); +#JSHELL.jdk.jshell.JShell.create=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); +#JSHELL.jdk.jshell.JShell.builder=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); +#JSHELL.jdk.jshell.tool.JavaShellToolBuilder.builder=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); +#JSHELL.jdk.jshell.Snippet.Snippet=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); +#JSHELL.jdk.jshell.TaskFactory.parse=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); diff --git a/tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentCommandLineTest.java b/tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentCommandLineTest.java index ae838eedeb..a6b86f837b 100644 --- a/tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentCommandLineTest.java +++ b/tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentCommandLineTest.java @@ -37,7 +37,7 @@ public class AegisAgentCommandLineTest { testStaticAttach(jar, "foo", "ERROR: unrecognised parameters foo"); testStaticAttach(jar, "dynamic", ""); - Path path = Paths.get(AegisAgent.class.getResource("mods.properties").toURI()); + Path path = Paths.get(System.getProperty("aegis4j.projectRoot") + "/tools/aegis4j/src/main/resources/net/gredler/aegis4j/mods.properties"); testStaticAttach(jar, "path=" + path, "Java serialization blocked by aegis4j"); testStaticAttach(jar, "path=" + path + ";unblock=serialization", ""); testStaticAttach(jar, "path=/foo/bar", "java.io.FileNotFoundException: /foo/bar"); diff --git a/tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentTest.java b/tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentTest.java index 9f3215ae96..8aab39994f 100644 --- a/tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentTest.java +++ b/tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentTest.java @@ -2,26 +2,12 @@ package net.gredler.aegis4j; -import static net.gredler.aegis4j.AegisAgent.toBlockList; -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertInstanceOf; -import static org.junit.jupiter.api.Assertions.assertNotNull; - -import java.io.ByteArrayInputStream; -import java.io.ByteArrayOutputStream; -import java.io.File; -import java.io.IOException; -import java.io.ObjectInputStream; -import java.io.ObjectOutputStream; -import java.lang.reflect.Field; -import java.rmi.StubNotFoundException; -import java.rmi.registry.LocateRegistry; -import java.rmi.server.RMIClientSocketFactory; -import java.rmi.server.RMIServerSocketFactory; -import java.time.LocalDate; -import java.util.Collections; -import java.util.List; -import java.util.Set; +import com.sun.net.httpserver.HttpServer; +import com.sun.net.httpserver.spi.HttpServerProvider; +import org.junit.jupiter.api.AfterAll; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.function.Executable; import javax.naming.InitialContext; import javax.naming.Name; @@ -32,55 +18,62 @@ import javax.script.ScriptContext; import javax.script.ScriptEngine; import javax.script.ScriptEngineManager; import javax.script.SimpleScriptContext; +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.File; +import java.io.IOException; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.rmi.StubNotFoundException; +import java.rmi.registry.LocateRegistry; +import java.rmi.server.RMIClientSocketFactory; +import java.rmi.server.RMIServerSocketFactory; +import java.util.Collections; -import jdk.nashorn.internal.ir.annotations.Ignore; -import org.junit.jupiter.api.BeforeAll; -import org.junit.jupiter.api.Test; -import org.junit.jupiter.api.function.Executable; -import org.springframework.objenesis.SpringObjenesis; - -import com.sun.net.httpserver.HttpServer; -import com.sun.net.httpserver.spi.HttpServerProvider; - -import sun.misc.Unsafe; +import static net.gredler.aegis4j.AegisAgent.toBlockList; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertInstanceOf; +import static org.junit.jupiter.api.Assertions.assertNotNull; /** * Tests {@link AegisAgent}. */ -/* public class AegisAgentTest { @BeforeAll public static void installAgent() throws Exception { - TestUtils.installAgent(null); + TestUtils.installAgent("unblock=unsafe"); + } + + @AfterAll + public static void uninstallAgent() throws Exception { + TestUtils.installAgent("unblock=unsafe,serialization"); } @Test public void testParseBlockList() { + assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "serialization", "unsafe", "scripting"), toBlockList("", null)); + assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "serialization", "unsafe", "scripting"), toBlockList(" ", null)); + assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "unsafe", "scripting"), toBlockList("unblock=serialization", null)); + assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting"), toBlockList("unblock=serialization,process", null)); + assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting"), toBlockList("UNbloCk=SERIALIZATION,Process", null)); + assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting"), toBlockList(" unblock\t= serialization , process\t", null)); + assertEquals(TestUtils.setOf(), toBlockList("unblock=jndi,rmi,process,httpserver,serialization,unsafe,scripting", null)); + assertEquals(TestUtils.setOf("jndi"), toBlockList("block=jndi", null)); + assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("block=jndi,rmi,process", null)); + assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("block = jndi\t, rmi ,\nprocess", null)); + assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("BLOck = JNDI\t, rmi ,\nProcESs", null)); - assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "serialization", "unsafe", "scripting", "jshell"), toBlockList("")); - assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "serialization", "unsafe", "scripting", "jshell"), toBlockList(" ")); - assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "unsafe", "scripting", "jshell"), toBlockList("unblock=serialization")); - assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting", "jshell"), toBlockList("unblock=serialization,process")); - assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting", "jshell"), toBlockList("UNbloCk=SERIALIZATION,Process")); - assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting", "jshell"), toBlockList(" unblock\t= serialization , process\t")); - assertEquals(TestUtils.setOf(), toBlockList("unblock=jndi,rmi,process,httpserver,serialization,unsafe,scripting,jshell")); - assertEquals(TestUtils.setOf("jndi"), toBlockList("block=jndi")); - assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("block=jndi,rmi,process")); - assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("block = jndi\t, rmi ,\nprocess")); - assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("BLOck = JNDI\t, rmi ,\nProcESs")); - - assertThrowsIAE(() -> toBlockList("blahblah"), "ERROR: Invalid agent configuration string"); - assertThrowsIAE(() -> toBlockList("foo=bar"), "ERROR: Unrecognized parameter name (should be one of 'block' or 'unblock'): foo"); - assertThrowsIAE(() -> toBlockList("block=incorrect"), "ERROR: Unrecognized feature name: incorrect"); - assertThrowsIAE(() -> toBlockList("unblock=incorrect"), "ERROR: Unrecognized feature name: incorrect"); - assertThrowsIAE(() -> toBlockList("block=serialization,process,incorrect,jndi"), "ERROR: Unrecognized feature name: incorrect"); - assertThrowsIAE(() -> toBlockList("unblock=serialization,process,incorrect,jndi"), "ERROR: Unrecognized feature name: incorrect"); + assertThrowsIAE(() -> toBlockList("blahblah", null), "Aegis4j ERROR: Invalid agent configuration string"); + assertThrowsIAE(() -> toBlockList("foo=bar", null), "Aegis4j ERROR: Unrecognized parameter name (should be one of 'block' or 'unblock'): foo"); + assertThrowsIAE(() -> toBlockList("block=incorrect", null), "Aegis4j ERROR: Unrecognized feature name: incorrect"); + assertThrowsIAE(() -> toBlockList("unblock=incorrect", null), "Aegis4j ERROR: Unrecognized feature name: incorrect"); + assertThrowsIAE(() -> toBlockList("block=serialization,process,incorrect,jndi", null), "Aegis4j ERROR: Unrecognized feature name: incorrect"); + assertThrowsIAE(() -> toBlockList("unblock=serialization,process,incorrect,jndi", null), "Aegis4j ERROR: Unrecognized feature name: incorrect"); } @Test public void testJndi() throws Exception { - String string = "foo"; Name name = new LdapName("cn=foo"); Object object = new Object(); @@ -116,7 +109,6 @@ public class AegisAgentTest { @Test public void testRmi() { - int integer = 9090; String string = "foo"; RMIClientSocketFactory clientSocketFactory = null; @@ -132,7 +124,6 @@ public class AegisAgentTest { @Test public void testProcess() { - Runtime runtime = Runtime.getRuntime(); String string = "foo"; String[] array = new String[] { "foo" }; @@ -178,6 +169,7 @@ public class AegisAgentTest { assertThrowsRE(() -> new ObjectOutputStream(baos), "Java serialization blocked by aegis4j"); } + /* @Test public void testUnsafe() throws Exception { @@ -283,6 +275,7 @@ public class AegisAgentTest { assertInstanceOf(TestUtils.class, so.newInstance(TestUtils.class)); assertInstanceOf(LocalDate.class, so.newInstance(LocalDate.class)); } + */ private static void assertThrowsNICE(Executable task) { assertThrows(task, NoInitialContextException.class, "JNDI context creation blocked by aegis4j"); @@ -324,4 +317,3 @@ public class AegisAgentTest { return t; } } -*/