ExternalVendorCode/corda
1
0
Fork 0
mirror of https://github.com/corda/corda.git synced 2025-01-04 12:14:17 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Some tests

Browse Source
This commit is contained in:
rick.parker 2023-04-04 22:11:53 +01:00
parent fbc006dd78
commit 6bf1587cf6
8 changed files with 89 additions and 419 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
tools/aegis4j/.gitignore vendored
View File

@ -1,7 +0,0 @@
bin/
build/
.gradle/
.settings/
.classpath
.project
gradle.properties

3
tools/aegis4j/build.gradle
View File

@ -47,8 +47,10 @@ java {
} }
test { test {
jvmArgs "-javaagent:${shadowJar.archiveFile.get()}=dynamic"
useJUnitPlatform() useJUnitPlatform()
systemProperty 'jdk.attach.allowAttachSelf', 'true' // tests attach agent to local VM systemProperty 'jdk.attach.allowAttachSelf', 'true' // tests attach agent to local VM
systemProperty 'aegis4j.projectRoot', "${project.rootDir.toString()}"
forkEvery 1 // tests cannot undo class modifications to clean up after themselves forkEvery 1 // tests cannot undo class modifications to clean up after themselves
testLogging { testLogging {
events 'passed', 'skipped', 'failed' events 'passed', 'skipped', 'failed'
@ -79,6 +81,7 @@ shadowJar {
} }
tasks.build.dependsOn tasks.shadowJar tasks.build.dependsOn tasks.shadowJar
tasks.test.dependsOn tasks.shadowJar
/* /*
publishing { publishing {

234
tools/aegis4j/gradlew vendored
View File

@ -1,234 +0,0 @@
#!/bin/sh
#
# Copyright © 2015-2021 the original authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
##############################################################################
#
# Gradle start up script for POSIX generated by Gradle.
#
# Important for running:
#
# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
# noncompliant, but you have some other compliant shell such as ksh or
# bash, then to run this script, type that shell name before the whole
# command line, like:
#
# ksh Gradle
#
# Busybox and similar reduced shells will NOT work, because this script
# requires all of these POSIX shell features:
# * functions;
# * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
# «${var#prefix}», «${var%suffix}», and «$( cmd )»;
# * compound commands having a testable exit status, especially «case»;
# * various built-in commands including «command», «set», and «ulimit».
#
# Important for patching:
#
# (2) This script targets any POSIX shell, so it avoids extensions provided
# by Bash, Ksh, etc; in particular arrays are avoided.
#
# The "traditional" practice of packing multiple parameters into a
# space-separated string is a well documented source of bugs and security
# problems, so this is (mostly) avoided, by progressively accumulating
# options in "$@", and eventually passing that to Java.
#
# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
# see the in-line comments for details.
#
# There are tweaks for specific operating systems such as AIX, CygWin,
# Darwin, MinGW, and NonStop.
#
# (3) This script is generated from the Groovy template
# https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
# within the Gradle project.
#
# You can find Gradle at https://github.com/gradle/gradle/.
#
##############################################################################
# Attempt to set APP_HOME
# Resolve links: $0 may be a link
app_path=$0
# Need this for daisy-chained symlinks.
while
APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path
[ -h "$app_path" ]
do
ls=$( ls -ld "$app_path" )
link=${ls#*' -> '}
case $link in #(
/*) app_path=$link ;; #(
*) app_path=$APP_HOME$link ;;
esac
done
APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
APP_NAME="Gradle"
APP_BASE_NAME=${0##*/}
# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
# Use the maximum available, or set MAX_FD != -1 to use that value.
MAX_FD=maximum
warn () {
echo "$*"
} >&2
die () {
echo
echo "$*"
echo
exit 1
} >&2
# OS specific support (must be 'true' or 'false').
cygwin=false
msys=false
darwin=false
nonstop=false
case "$( uname )" in #(
CYGWIN* ) cygwin=true ;; #(
Darwin* ) darwin=true ;; #(
MSYS* | MINGW* ) msys=true ;; #(
NONSTOP* ) nonstop=true ;;
esac
CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
# Determine the Java command to use to start the JVM.
if [ -n "$JAVA_HOME" ] ; then
if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
# IBM's JDK on AIX uses strange locations for the executables
JAVACMD=$JAVA_HOME/jre/sh/java
else
JAVACMD=$JAVA_HOME/bin/java
fi
if [ ! -x "$JAVACMD" ] ; then
die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
Please set the JAVA_HOME variable in your environment to match the
location of your Java installation."
fi
else
JAVACMD=java
which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
Please set the JAVA_HOME variable in your environment to match the
location of your Java installation."
fi
# Increase the maximum file descriptors if we can.
if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
case $MAX_FD in #(
max*)
MAX_FD=$( ulimit -H -n ) ||
warn "Could not query maximum file descriptor limit"
esac
case $MAX_FD in #(
'' | soft) :;; #(
*)
ulimit -n "$MAX_FD" ||
warn "Could not set maximum file descriptor limit to $MAX_FD"
esac
fi
# Collect all arguments for the java command, stacking in reverse order:
# * args from the command line
# * the main class name
# * -classpath
# * -D...appname settings
# * --module-path (only if needed)
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
# For Cygwin or MSYS, switch paths to Windows format before running java
if "$cygwin" || "$msys" ; then
APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
JAVACMD=$( cygpath --unix "$JAVACMD" )
# Now convert the arguments - kludge to limit ourselves to /bin/sh
for arg do
if
case $arg in #(
-*) false ;; # don't mess with options #(
/?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath
[ -e "$t" ] ;; #(
*) false ;;
esac
then
arg=$( cygpath --path --ignore --mixed "$arg" )
fi
# Roll the args list around exactly as many times as the number of
# args, so each arg winds up back in the position where it started, but
# possibly modified.
#
# NB: a `for` loop captures its iteration list before it begins, so
# changing the positional parameters here affects neither the number of
# iterations, nor the values presented in `arg`.
shift # remove old arg
set -- "$@" "$arg" # push replacement arg
done
fi
# Collect all arguments for the java command;
# * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
# shell script including quotes and variable substitutions, so put them in
# double quotes to make sure that they get re-expanded; and
# * put everything else in single quotes, so that it's not re-expanded.
set -- \
"-Dorg.gradle.appname=$APP_BASE_NAME" \
-classpath "$CLASSPATH" \
org.gradle.wrapper.GradleWrapperMain \
"$@"
# Use "xargs" to parse quoted args.
#
# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
#
# In Bash we could simply go:
#
# readarray ARGS < <( xargs -n1 <<<"$var" ) &&
# set -- "${ARGS[@]}" "$@"
#
# but POSIX shell has neither arrays nor command substitution, so instead we
# post-process each arg (as a line of input to sed) to backslash-escape any
# character that might be a shell metacharacter, then use eval to reverse
# that process (while maintaining the separation between arguments), and wrap
# the whole thing up as a single "set" statement.
#
# This will of course break if any of these variables contains a newline or
# an unmatched quote.
#
eval "set -- $(
printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
xargs -n1 |
sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
tr '\n' ' '
)" '"$@"'
exec "$JAVACMD" "$@"

89
tools/aegis4j/gradlew.bat vendored
View File

@ -1,89 +0,0 @@
@rem
@rem Copyright 2015 the original author or authors.
@rem
@rem Licensed under the Apache License, Version 2.0 (the "License");
@rem you may not use this file except in compliance with the License.
@rem You may obtain a copy of the License at
@rem
@rem https://www.apache.org/licenses/LICENSE-2.0
@rem
@rem Unless required by applicable law or agreed to in writing, software
@rem distributed under the License is distributed on an "AS IS" BASIS,
@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@rem See the License for the specific language governing permissions and
@rem limitations under the License.
@rem
@if "%DEBUG%" == "" @echo off
@rem ##########################################################################
@rem
@rem Gradle startup script for Windows
@rem
@rem ##########################################################################
@rem Set local scope for the variables with windows NT shell
if "%OS%"=="Windows_NT" setlocal
set DIRNAME=%~dp0
if "%DIRNAME%" == "" set DIRNAME=.
set APP_BASE_NAME=%~n0
set APP_HOME=%DIRNAME%
@rem Resolve any "." and ".." in APP_HOME to make it shorter.
for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
@rem Find java.exe
if defined JAVA_HOME goto findJavaFromJavaHome
set JAVA_EXE=java.exe
%JAVA_EXE% -version >NUL 2>&1
if "%ERRORLEVEL%" == "0" goto execute
echo.
echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
echo.
echo Please set the JAVA_HOME variable in your environment to match the
echo location of your Java installation.
goto fail
:findJavaFromJavaHome
set JAVA_HOME=%JAVA_HOME:"=%
set JAVA_EXE=%JAVA_HOME%/bin/java.exe
if exist "%JAVA_EXE%" goto execute
echo.
echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
echo.
echo Please set the JAVA_HOME variable in your environment to match the
echo location of your Java installation.
goto fail
:execute
@rem Setup the command line
set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
@rem Execute Gradle
"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
:end
@rem End local scope for the variables with windows NT shell
if "%ERRORLEVEL%"=="0" goto mainEnd
:fail
rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
rem the _cmd.exe /c_ return code!
if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
exit /b 1
:mainEnd
if "%OS%"=="Windows_NT" endlocal
:omega

58
tools/aegis4j/src/main/java/net/gredler/aegis4j/Patcher.java
View File

@ -2,6 +2,15 @@
package net.gredler.aegis4j; package net.gredler.aegis4j;
import javassist.ByteArrayClassPath;
import javassist.CannotCompileException;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import javassist.CtMethod;
import javassist.LoaderClassPath;
import javassist.NotFoundException;
import java.io.IOException; import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.lang.instrument.ClassFileTransformer; import java.lang.instrument.ClassFileTransformer;
@ -17,15 +26,6 @@ import java.util.Set;
import java.util.TreeMap; import java.util.TreeMap;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import javassist.ByteArrayClassPath;
import javassist.CannotCompileException;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtConstructor;
import javassist.CtMethod;
import javassist.LoaderClassPath;
import javassist.NotFoundException;
/** /**
* Disables rarely-used platform features like JNDI and RMI so that they cannot be exploited by attackers. * Disables rarely-used platform features like JNDI and RMI so that they cannot be exploited by attackers.
* See the {@code mods.properties} file for the actual class modification configuration. * See the {@code mods.properties} file for the actual class modification configuration.
@ -33,6 +33,7 @@ import javassist.NotFoundException;
public final class Patcher implements ClassFileTransformer { public final class Patcher implements ClassFileTransformer {
private final Map<String, List<Modification>> modifications; // class name -> modifications private final Map<String, List<Modification>> modifications; // class name -> modifications
private static Patcher patcher;
/** /**
* Creates a new class patcher which blocks the specified features. * Creates a new class patcher which blocks the specified features.
@ -51,7 +52,8 @@ public final class Patcher implements ClassFileTransformer {
*/ */
public static void start(Instrumentation instr, Set<String> block, InputStream inputStream) { public static void start(Instrumentation instr, Set<String> block, InputStream inputStream) {
System.out.println("Aegis4j patching starting"); System.out.println("Aegis4j patching starting");
Patcher patcher = new Patcher(block ,inputStream); if (patcher != null) instr.removeTransformer(patcher);
patcher = new Patcher(block, inputStream);
instr.addTransformer(patcher, true); instr.addTransformer(patcher, true);
for (String className : patcher.modifications.keySet()) { for (String className : patcher.modifications.keySet()) {
@ -87,17 +89,19 @@ public final class Patcher implements ClassFileTransformer {
try { try {
CtClass clazz = pool.get(className); CtClass clazz = pool.get(className);
for (Modification mod : mods) { for (Modification mod : mods) {
if (mod.isConstructor()) { if (mod.enabled) {
for (CtConstructor constructor : clazz.getConstructors()) { if (mod.isConstructor()) {
constructor.setBody(mod.newBody); for (CtConstructor constructor : clazz.getConstructors()) {
} constructor.setBody(mod.newBody);
} else { }
CtMethod[] methods = mod.isAll() ? clazz.getDeclaredMethods() : clazz.getDeclaredMethods(mod.methodName); } else {
if (methods.length == 0) { CtMethod[] methods = mod.isAll() ? clazz.getDeclaredMethods() : clazz.getDeclaredMethods(mod.methodName);
System.err.println("ERROR: Method not found: " + className + "." + mod.methodName); if (methods.length == 0) {
} System.err.println("ERROR: Method not found: " + className + "." + mod.methodName);
for (CtMethod method : methods) { }
method.setBody(mod.newBody); for (CtMethod method : methods) {
method.setBody(mod.newBody);
}
} }
} }
} }
@ -121,13 +125,13 @@ public final class Patcher implements ClassFileTransformer {
int first = key.indexOf('.'); int first = key.indexOf('.');
int last = key.lastIndexOf('.'); int last = key.lastIndexOf('.');
String feature = key.substring(0, first).toLowerCase(); String feature = key.substring(0, first).toLowerCase();
if (block.contains(feature)) { //if (block.contains(feature)) {
String className = key.substring(first + 1, last); String className = key.substring(first + 1, last);
String methodName = key.substring(last + 1); String methodName = key.substring(last + 1);
String newBody = props.getProperty(key); String newBody = props.getProperty(key);
Modification mod = new Modification(className, methodName, newBody); Modification mod = new Modification(className, methodName, newBody, block.contains(feature));
mods.add(mod); mods.add(mod);
} //}
} }
return Collections.unmodifiableMap(new TreeMap<>( return Collections.unmodifiableMap(new TreeMap<>(
@ -140,11 +144,13 @@ public final class Patcher implements ClassFileTransformer {
public final String className; public final String className;
public final String methodName; public final String methodName;
public final String newBody; public final String newBody;
public final boolean enabled;
public Modification(String className, String methodName, String newBody) { public Modification(String className, String methodName, String newBody, boolean enabled) {
this.className = className; this.className = className;
this.methodName = methodName; this.methodName = methodName;
this.newBody = newBody; this.newBody = newBody;
this.enabled = enabled;
} }
public boolean isConstructor() { public boolean isConstructor() {

15
tools/aegis4j/src/main/resources/net/gredler/aegis4j/mods.properties
View File

@ -21,7 +21,7 @@ RMI.java.rmi.server.RemoteObject.RemoteObject=throw new java.lang.RuntimeExcepti
# need to use these methods for legitimate purposes. # need to use these methods for legitimate purposes.
PROCESS.java.lang.Runtime.exec=throw new java.io.IOException("Process execution blocked by aegis4j"); PROCESS.java.lang.Runtime.exec=throw new java.io.IOException("Process execution blocked by aegis4j");
PROCESS.java.lang.ProcessBuilder.start=throw new java.io.IOException("Process execution blocked by aegis4j"); PROCESS.java.lang.ProcessBuilder.start=throw new java.io.IOException("Process execution blocked by aegis4j");
PROCESS.java.lang.ProcessBuilder.startPipeline=throw new java.io.IOException("Process execution blocked by aegis4j"); #PROCESS.java.lang.ProcessBuilder.startPipeline=throw new java.io.IOException("Process execution blocked by aegis4j");
# JDK HTTP Server # JDK HTTP Server
# --------------- # ---------------
@ -52,13 +52,12 @@ SCRIPTING.javax.script.ScriptEngineManager.ScriptEngineManager=throw new java.la
SCRIPTING.javax.script.AbstractScriptEngine.AbstractScriptEngine=throw new java.lang.RuntimeException("Scripting blocked by aegis4j"); SCRIPTING.javax.script.AbstractScriptEngine.AbstractScriptEngine=throw new java.lang.RuntimeException("Scripting blocked by aegis4j");
SCRIPTING.javax.script.SimpleScriptContext.SimpleScriptContext=throw new java.lang.RuntimeException("Scripting blocked by aegis4j"); SCRIPTING.javax.script.SimpleScriptContext.SimpleScriptContext=throw new java.lang.RuntimeException("Scripting blocked by aegis4j");
SCRIPTING.javax.script.CompiledScript.CompiledScript=throw new java.lang.RuntimeException("Scripting blocked by aegis4j"); SCRIPTING.javax.script.CompiledScript.CompiledScript=throw new java.lang.RuntimeException("Scripting blocked by aegis4j");
# JShell # JShell
# ------ # ------
# Introduced in JDK 9, the Java Shell is intended for rapid prototyping and testing. It is not usually used in production. # Introduced in JDK 9, the Java Shell is intended for rapid prototyping and testing. It is not usually used in production.
JSHELL.jdk.jshell.JShell.JShell=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); #JSHELL.jdk.jshell.JShell.JShell=throw new java.lang.RuntimeException("JShell blocked by aegis4j");
JSHELL.jdk.jshell.JShell.create=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); #JSHELL.jdk.jshell.JShell.create=throw new java.lang.RuntimeException("JShell blocked by aegis4j");
JSHELL.jdk.jshell.JShell.builder=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); #JSHELL.jdk.jshell.JShell.builder=throw new java.lang.RuntimeException("JShell blocked by aegis4j");
JSHELL.jdk.jshell.tool.JavaShellToolBuilder.builder=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); #JSHELL.jdk.jshell.tool.JavaShellToolBuilder.builder=throw new java.lang.RuntimeException("JShell blocked by aegis4j");
JSHELL.jdk.jshell.Snippet.Snippet=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); #JSHELL.jdk.jshell.Snippet.Snippet=throw new java.lang.RuntimeException("JShell blocked by aegis4j");
JSHELL.jdk.jshell.TaskFactory.parse=throw new java.lang.RuntimeException("JShell blocked by aegis4j"); #JSHELL.jdk.jshell.TaskFactory.parse=throw new java.lang.RuntimeException("JShell blocked by aegis4j");

2
tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentCommandLineTest.java
View File

@ -37,7 +37,7 @@ public class AegisAgentCommandLineTest {
testStaticAttach(jar, "foo", "ERROR: unrecognised parameters foo"); testStaticAttach(jar, "foo", "ERROR: unrecognised parameters foo");
testStaticAttach(jar, "dynamic", ""); testStaticAttach(jar, "dynamic", "");
Path path = Paths.get(AegisAgent.class.getResource("mods.properties").toURI()); Path path = Paths.get(System.getProperty("aegis4j.projectRoot") + "/tools/aegis4j/src/main/resources/net/gredler/aegis4j/mods.properties");
testStaticAttach(jar, "path=" + path, "Java serialization blocked by aegis4j"); testStaticAttach(jar, "path=" + path, "Java serialization blocked by aegis4j");
testStaticAttach(jar, "path=" + path + ";unblock=serialization", ""); testStaticAttach(jar, "path=" + path + ";unblock=serialization", "");
testStaticAttach(jar, "path=/foo/bar", "java.io.FileNotFoundException: /foo/bar"); testStaticAttach(jar, "path=/foo/bar", "java.io.FileNotFoundException: /foo/bar");

100
tools/aegis4j/src/test/java/net/gredler/aegis4j/AegisAgentTest.java
View File

@ -2,26 +2,12 @@
package net.gredler.aegis4j; package net.gredler.aegis4j;
import static net.gredler.aegis4j.AegisAgent.toBlockList; import com.sun.net.httpserver.HttpServer;
import static org.junit.jupiter.api.Assertions.assertEquals; import com.sun.net.httpserver.spi.HttpServerProvider;
import static org.junit.jupiter.api.Assertions.assertInstanceOf; import org.junit.jupiter.api.AfterAll;
import static org.junit.jupiter.api.Assertions.assertNotNull; import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import java.io.ByteArrayInputStream; import org.junit.jupiter.api.function.Executable;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.rmi.StubNotFoundException;
import java.rmi.registry.LocateRegistry;
import java.rmi.server.RMIClientSocketFactory;
import java.rmi.server.RMIServerSocketFactory;
import java.time.LocalDate;
import java.util.Collections;
import java.util.List;
import java.util.Set;
import javax.naming.InitialContext; import javax.naming.InitialContext;
import javax.naming.Name; import javax.naming.Name;
@ -32,55 +18,62 @@ import javax.script.ScriptContext;
import javax.script.ScriptEngine; import javax.script.ScriptEngine;
import javax.script.ScriptEngineManager; import javax.script.ScriptEngineManager;
import javax.script.SimpleScriptContext; import javax.script.SimpleScriptContext;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.rmi.StubNotFoundException;
import java.rmi.registry.LocateRegistry;
import java.rmi.server.RMIClientSocketFactory;
import java.rmi.server.RMIServerSocketFactory;
import java.util.Collections;
import jdk.nashorn.internal.ir.annotations.Ignore; import static net.gredler.aegis4j.AegisAgent.toBlockList;
import org.junit.jupiter.api.BeforeAll; import static org.junit.jupiter.api.Assertions.assertEquals;
import org.junit.jupiter.api.Test; import static org.junit.jupiter.api.Assertions.assertInstanceOf;
import org.junit.jupiter.api.function.Executable; import static org.junit.jupiter.api.Assertions.assertNotNull;
import org.springframework.objenesis.SpringObjenesis;
import com.sun.net.httpserver.HttpServer;
import com.sun.net.httpserver.spi.HttpServerProvider;
import sun.misc.Unsafe;
/** /**
* Tests {@link AegisAgent}. * Tests {@link AegisAgent}.
*/ */
/*
public class AegisAgentTest { public class AegisAgentTest {
@BeforeAll @BeforeAll
public static void installAgent() throws Exception { public static void installAgent() throws Exception {
TestUtils.installAgent(null); TestUtils.installAgent("unblock=unsafe");
}
@AfterAll
public static void uninstallAgent() throws Exception {
TestUtils.installAgent("unblock=unsafe,serialization");
} }
@Test @Test
public void testParseBlockList() { public void testParseBlockList() {
assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "serialization", "unsafe", "scripting"), toBlockList("", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "serialization", "unsafe", "scripting"), toBlockList(" ", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "unsafe", "scripting"), toBlockList("unblock=serialization", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting"), toBlockList("unblock=serialization,process", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting"), toBlockList("UNbloCk=SERIALIZATION,Process", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting"), toBlockList(" unblock\t= serialization , process\t", null));
assertEquals(TestUtils.setOf(), toBlockList("unblock=jndi,rmi,process,httpserver,serialization,unsafe,scripting", null));
assertEquals(TestUtils.setOf("jndi"), toBlockList("block=jndi", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("block=jndi,rmi,process", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("block = jndi\t, rmi ,\nprocess", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("BLOck = JNDI\t, rmi ,\nProcESs", null));
assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "serialization", "unsafe", "scripting", "jshell"), toBlockList("")); assertThrowsIAE(() -> toBlockList("blahblah", null), "Aegis4j ERROR: Invalid agent configuration string");
assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "serialization", "unsafe", "scripting", "jshell"), toBlockList(" ")); assertThrowsIAE(() -> toBlockList("foo=bar", null), "Aegis4j ERROR: Unrecognized parameter name (should be one of 'block' or 'unblock'): foo");
assertEquals(TestUtils.setOf("jndi", "rmi", "process", "httpserver", "unsafe", "scripting", "jshell"), toBlockList("unblock=serialization")); assertThrowsIAE(() -> toBlockList("block=incorrect", null), "Aegis4j ERROR: Unrecognized feature name: incorrect");
assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting", "jshell"), toBlockList("unblock=serialization,process")); assertThrowsIAE(() -> toBlockList("unblock=incorrect", null), "Aegis4j ERROR: Unrecognized feature name: incorrect");
assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting", "jshell"), toBlockList("UNbloCk=SERIALIZATION,Process")); assertThrowsIAE(() -> toBlockList("block=serialization,process,incorrect,jndi", null), "Aegis4j ERROR: Unrecognized feature name: incorrect");
assertEquals(TestUtils.setOf("jndi", "rmi", "httpserver", "unsafe", "scripting", "jshell"), toBlockList(" unblock\t= serialization , process\t")); assertThrowsIAE(() -> toBlockList("unblock=serialization,process,incorrect,jndi", null), "Aegis4j ERROR: Unrecognized feature name: incorrect");
assertEquals(TestUtils.setOf(), toBlockList("unblock=jndi,rmi,process,httpserver,serialization,unsafe,scripting,jshell"));
assertEquals(TestUtils.setOf("jndi"), toBlockList("block=jndi"));
assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("block=jndi,rmi,process"));
assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("block = jndi\t, rmi ,\nprocess"));
assertEquals(TestUtils.setOf("jndi", "rmi", "process"), toBlockList("BLOck = JNDI\t, rmi ,\nProcESs"));
assertThrowsIAE(() -> toBlockList("blahblah"), "ERROR: Invalid agent configuration string");
assertThrowsIAE(() -> toBlockList("foo=bar"), "ERROR: Unrecognized parameter name (should be one of 'block' or 'unblock'): foo");
assertThrowsIAE(() -> toBlockList("block=incorrect"), "ERROR: Unrecognized feature name: incorrect");
assertThrowsIAE(() -> toBlockList("unblock=incorrect"), "ERROR: Unrecognized feature name: incorrect");
assertThrowsIAE(() -> toBlockList("block=serialization,process,incorrect,jndi"), "ERROR: Unrecognized feature name: incorrect");
assertThrowsIAE(() -> toBlockList("unblock=serialization,process,incorrect,jndi"), "ERROR: Unrecognized feature name: incorrect");
} }
@Test @Test
public void testJndi() throws Exception { public void testJndi() throws Exception {
String string = "foo"; String string = "foo";
Name name = new LdapName("cn=foo"); Name name = new LdapName("cn=foo");
Object object = new Object(); Object object = new Object();
@ -116,7 +109,6 @@ public class AegisAgentTest {
@Test @Test
public void testRmi() { public void testRmi() {
int integer = 9090; int integer = 9090;
String string = "foo"; String string = "foo";
RMIClientSocketFactory clientSocketFactory = null; RMIClientSocketFactory clientSocketFactory = null;
@ -132,7 +124,6 @@ public class AegisAgentTest {
@Test @Test
public void testProcess() { public void testProcess() {
Runtime runtime = Runtime.getRuntime(); Runtime runtime = Runtime.getRuntime();
String string = "foo"; String string = "foo";
String[] array = new String[] { "foo" }; String[] array = new String[] { "foo" };
@ -178,6 +169,7 @@ public class AegisAgentTest {
assertThrowsRE(() -> new ObjectOutputStream(baos), "Java serialization blocked by aegis4j"); assertThrowsRE(() -> new ObjectOutputStream(baos), "Java serialization blocked by aegis4j");
} }
/*
@Test @Test
public void testUnsafe() throws Exception { public void testUnsafe() throws Exception {
@ -283,6 +275,7 @@ public class AegisAgentTest {
assertInstanceOf(TestUtils.class, so.newInstance(TestUtils.class)); assertInstanceOf(TestUtils.class, so.newInstance(TestUtils.class));
assertInstanceOf(LocalDate.class, so.newInstance(LocalDate.class)); assertInstanceOf(LocalDate.class, so.newInstance(LocalDate.class));
} }
*/
private static void assertThrowsNICE(Executable task) { private static void assertThrowsNICE(Executable task) {
assertThrows(task, NoInitialContextException.class, "JNDI context creation blocked by aegis4j"); assertThrows(task, NoInitialContextException.class, "JNDI context creation blocked by aegis4j");
@ -324,4 +317,3 @@ public class AegisAgentTest {
return t; return t;
} }
} }
*/