1/*
2 * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 */
23
24import java.io.ByteArrayInputStream;
25import java.io.ObjectInputFilter;
26import java.io.ObjectInputStream;
27import java.security.AccessControlException;
28
29import org.testng.annotations.BeforeClass;
30import org.testng.annotations.Test;
31import org.testng.Assert;
32
33import static org.testng.Assert.assertFalse;
34import static org.testng.Assert.assertTrue;
35
36/* @test
37 * @build FilterWithSecurityManagerTest SerialFilterTest
38 * @run testng/othervm FilterWithSecurityManagerTest
39 * @run testng/othervm/policy=security.policy.without.globalFilter
40 *          -Djava.security.manager=default FilterWithSecurityManagerTest
41 * @run testng/othervm/policy=security.policy
42 *          -Djava.security.manager=default
43 *          -Djdk.serialFilter=java.lang.Integer FilterWithSecurityManagerTest
44 *
45 * @summary Test that setting specific filter is checked by security manager,
46 *          setting process-wide filter is checked by security manager.
47 */
48
49@Test
50public class FilterWithSecurityManagerTest {
51
52    byte[] bytes;
53    boolean setSecurityManager;
54    ObjectInputFilter filter;
55
56    @BeforeClass
57    public void setup() throws Exception {
58        setSecurityManager = System.getSecurityManager() != null;
59        Object toDeserialized = Long.MAX_VALUE;
60        bytes = SerialFilterTest.writeObjects(toDeserialized);
61        filter = ObjectInputFilter.Config.createFilter("java.lang.Long");
62    }
63
64    /**
65     * Test that setting process-wide filter is checked by security manager.
66     */
67    @Test
68    public void testGlobalFilter() throws Exception {
69        ObjectInputFilter global = ObjectInputFilter.Config.getSerialFilter();
70
71        try  {
72            ObjectInputFilter.Config.setSerialFilter(filter);
73            assertFalse(setSecurityManager,
74                    "When SecurityManager exists, without "
75                    + "java.io.SerializablePermission(serialFilter) "
76                    + "IllegalStateException should be thrown");
77        } catch (AccessControlException ex) {
78            assertTrue(setSecurityManager);
79            assertTrue(ex.getMessage().contains("java.io.SerializablePermission"));
80            assertTrue(ex.getMessage().contains("serialFilter"));
81        } catch (IllegalStateException ise) {
82            // ISE should occur only if global filter already set
83            Assert.assertNotNull(global, "Global filter should be non-null");
84        }
85    }
86
87    /**
88     * Test that setting specific filter is checked by security manager.
89     */
90    @Test(dependsOnMethods = { "testGlobalFilter" })
91    public void testSpecificFilter() throws Exception {
92        try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
93                ObjectInputStream ois = new ObjectInputStream(bais)) {
94            ois.setObjectInputFilter(filter);
95            Object o = ois.readObject();
96        } catch (AccessControlException ex) {
97            assertTrue(setSecurityManager);
98            assertTrue(ex.getMessage().contains("java.io.SerializablePermission"));
99            assertTrue(ex.getMessage().contains("serialFilter"));
100        }
101    }
102}
103