View Javadoc
1   package ch.qos.logback.core.net;
2   
3   import static org.junit.Assert.assertEquals;
4   
5   import java.io.ByteArrayInputStream;
6   import java.io.ByteArrayOutputStream;
7   import java.io.IOException;
8   import java.io.ObjectOutputStream;
9   
10  import org.junit.After;
11  import org.junit.Before;
12  import org.junit.Test;
13  
14  public class HardenedObjectInputStreamTest {
15  
16      ByteArrayOutputStream bos;
17      ObjectOutputStream oos;
18      HardenedObjectInputStream inputStream;
19      String[] whitelist = new String[] { Innocent.class.getName() };
20  
21      @Before
22      public void setUp() throws Exception {
23          bos = new ByteArrayOutputStream();
24          oos = new ObjectOutputStream(bos);
25      }
26  
27      @After
28      public void tearDown() throws Exception {
29      }
30  
31      @Test
32      public void smoke() throws ClassNotFoundException, IOException {
33          Innocent innocent = new Innocent();
34          innocent.setAnInt(1);
35          innocent.setAnInteger(2);
36          innocent.setaString("smoke");
37          Innocent back = writeAndRead(innocent);
38          assertEquals(innocent, back);
39      }
40  
41      private Innocent writeAndRead(Innocent innocent) throws IOException, ClassNotFoundException {
42          writeObject(oos, innocent);
43          ByteArrayInputStream bis = new ByteArrayInputStream(bos.toByteArray());
44          inputStream = new HardenedObjectInputStream(bis, whitelist);
45          Innocent fooBack = (Innocent) inputStream.readObject();
46          inputStream.close();
47          return fooBack;
48      }
49  
50      private void writeObject(ObjectOutputStream oos, Object o) throws IOException {
51          oos.writeObject(o);
52          oos.flush();
53          oos.close();
54      }
55  
56  //    @Ignore
57  //    @Test
58  //    public void denialOfService() throws ClassNotFoundException, IOException {
59  //        ByteArrayInputStream bis = new ByteArrayInputStream(payload());
60  //        inputStream = new HardenedObjectInputStream(bis, whitelist);
61  //        try {
62  //            Set set = (Set) inputStream.readObject();
63  //            assertNotNull(set);
64  //        } finally {
65  //            inputStream.close();
66  //        }
67  //    }
68  //
69  //    private byte[] payload() throws IOException {
70  //        Set root = buildEvilHashset();
71  //        return serialize(root);
72  //    }
73  //
74  //    private Set buildEvilHashset() {
75  //        Set root = new HashSet();
76  //        Set s1 = root;
77  //        Set s2 = new HashSet();
78  //        for (int i = 0; i < 100; i++) {
79  //            Set t1 = new HashSet();
80  //            Set t2 = new HashSet();
81  //            t1.add("foo"); // make it not equal to t2
82  //            s1.add(t1);
83  //            s1.add(t2);
84  //            s2.add(t1);
85  //            s2.add(t2);
86  //            s1 = t1;
87  //            s2 = t2;
88  //        }
89  //        return root;
90  //    }
91  }