1 /*
2  * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4  *
5  * This code is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 only, as
7  * published by the Free Software Foundation.
8  *
9  * This code is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * version 2 for more details (a copy is included in the LICENSE file that
13  * accompanied this code).
14  *
15  * You should have received a copy of the GNU General Public License version
16  * 2 along with this work; if not, write to the Free Software Foundation,
17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20  * or visit www.oracle.com if you need additional information or have any
21  * questions.
22  */
23 
24 import java.io.ByteArrayInputStream;
25 import java.io.ObjectInputStream;
26 import java.security.AccessControlException;
27 
28 import sun.misc.ObjectInputFilter;
29 
30 import org.testng.annotations.BeforeClass;
31 import org.testng.annotations.Test;
32 
33 import static org.testng.Assert.assertFalse;
34 import static org.testng.Assert.assertTrue;
35 
36 /* @test
37  * @build FilterWithSecurityManagerTest SerialFilterTest
38  * @run testng/othervm FilterWithSecurityManagerTest
39  * @run testng/othervm/policy=security.policy.without.globalFilter
40  *          -Djava.security.manager=default FilterWithSecurityManagerTest
41  * @run testng/othervm/policy=security.policy
42  *          -Djava.security.manager=default
43  *          -Djdk.serialFilter=java.lang.Integer FilterWithSecurityManagerTest
44  *
45  * @summary Test that setting specific filter is checked by security manager,
46  *          setting process-wide filter is checked by security manager.
47  */
48 
49 @Test
50 public class FilterWithSecurityManagerTest {
51 
52     byte[] bytes;
53     boolean setSecurityManager;
54     ObjectInputFilter filter;
55 
56     @BeforeClass
setup()57     public void setup() throws Exception {
58         setSecurityManager = System.getSecurityManager() != null;
59         Object toDeserialized = Long.MAX_VALUE;
60         bytes = SerialFilterTest.writeObjects(toDeserialized);
61         filter = ObjectInputFilter.Config.createFilter("java.lang.Long");
62     }
63 
64     /**
65      * Test that setting process-wide filter is checked by security manager.
66      */
67     @Test
testGlobalFilter()68     public void testGlobalFilter() throws Exception {
69         if (ObjectInputFilter.Config.getSerialFilter() == null) {
70             return;
71         }
72         try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
73                 ObjectInputStream ois = new ObjectInputStream(bais)) {
74             ObjectInputFilter.Config.setSerialFilter(filter);
75             assertFalse(setSecurityManager,
76                     "When SecurityManager exists, without "
77                     + "java.security.SerializablePermission(serialFilter) Exception should be thrown");
78             Object o = ois.readObject();
79         } catch (AccessControlException ex) {
80             assertTrue(setSecurityManager);
81             assertTrue(ex.getMessage().contains("java.io.SerializablePermission"));
82             assertTrue(ex.getMessage().contains("serialFilter"));
83         }
84     }
85 
86     /**
87      * Test that setting specific filter is checked by security manager.
88      */
89     @Test(dependsOnMethods = { "testGlobalFilter" })
testSpecificFilter()90     public void testSpecificFilter() throws Exception {
91         try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
92                 ObjectInputStream ois = new ObjectInputStream(bais)) {
93             ObjectInputFilter.Config.setObjectInputFilter(ois, filter);
94             Object o = ois.readObject();
95         } catch (AccessControlException ex) {
96             assertTrue(setSecurityManager);
97             assertTrue(ex.getMessage().contains("java.io.SerializablePermission"));
98             assertTrue(ex.getMessage().contains("serialFilter"));
99         }
100     }
101 }
102