ISPN-14196 Correctly parse serialization allow list in YAML and JSON

infinispan · Oct 14, 2022 · 241dc59 · 241dc59
1 parent 965dc6d
commit 241dc59
Show file tree

Hide file tree

Showing 7 changed files with 109 additions and 2 deletions.
diff --git a/core/src/main/java/org/infinispan/configuration/global/AllowListConfigurationBuilder.java b/core/src/main/java/org/infinispan/configuration/global/AllowListConfigurationBuilder.java
@@ -40,6 +40,15 @@ public <T> AllowListConfigurationBuilder addClass(String clazz) {
       return this;
    }
 
+   /**
+    * Helper method that allows for registration of classes to the {@link ClassAllowList}.
+    */
+   public <T> AllowListConfigurationBuilder addClasses(String... classes) {
+      List<String> classNames = Arrays.asList(classes);
+      this.classes.addAll(classNames);
+      return this;
+   }
+
    /**
     * Helper method that allows for registration of classes to the {@link ClassAllowList}.
     */

diff --git a/core/src/main/java/org/infinispan/configuration/parsing/Attribute.java b/core/src/main/java/org/infinispan/configuration/parsing/Attribute.java
@@ -220,7 +220,8 @@ public enum Attribute {
     INVALIDATION_THRESHOLD,
     CONTEXT_INITIALIZERS,
     GROUPER,
-    ACCURATE_SIZE;
+    ACCURATE_SIZE,
+    REGEX;
 
     private final String name;
 

diff --git a/core/src/main/java/org/infinispan/configuration/parsing/Parser.java b/core/src/main/java/org/infinispan/configuration/parsing/Parser.java
@@ -202,7 +202,22 @@ private void parseSerializationContextInitializer(final ConfigurationReader read
    }
 
    private void parseAllowList(final ConfigurationReader reader, final AllowListConfigurationBuilder builder, Element outerElement) {
-      while (reader.inTag(outerElement)) {
+      for(int i = 0; i < reader.getAttributeCount(); i++) { // JSON/YAML
+         String[] values = reader.getListAttributeValue(i);
+         Attribute attribute = Attribute.forName(reader.getAttributeName(i));
+         switch (attribute) {
+            case CLASS:
+               builder.addClasses(values);
+               break;
+            case REGEX:
+               builder.addRegexps(values);
+               break;
+            default: {
+               throw ParseUtils.unexpectedElement(reader);
+            }
+         }
+      }
+      while (reader.inTag(outerElement)) { // XML
          Element element = Element.forName(reader.getLocalName());
          switch (element) {
             case CLASS: {

diff --git a/core/src/test/java/org/infinispan/configuration/JsonParsingTest.java b/core/src/test/java/org/infinispan/configuration/JsonParsingTest.java
@@ -0,0 +1,26 @@
+package org.infinispan.configuration;
+
+import static org.testng.AssertJUnit.assertEquals;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Set;
+
+import org.infinispan.configuration.global.GlobalConfiguration;
+import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
+import org.infinispan.configuration.parsing.ParserRegistry;
+import org.infinispan.test.AbstractInfinispanTest;
+import org.testng.annotations.Test;
+
+@Test(groups = "unit", testName = "configuration.JsonParsingTest")
+public class JsonParsingTest extends AbstractInfinispanTest {
+   public void testSerializationAllowList() throws IOException {
+      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), true, System.getProperties());
+      ConfigurationBuilderHolder holder = parserRegistry.parseFile("configs/serialization-test.json");
+      GlobalConfiguration globalConfiguration = holder.getGlobalConfigurationBuilder().build();
+      Set<String> classes = globalConfiguration.serialization().allowList().getClasses();
+      assertEquals(3, classes.size());
+      List<String> regexps = globalConfiguration.serialization().allowList().getRegexps();
+      assertEquals(2, regexps.size());
+   }
+}
diff --git a/core/src/test/java/org/infinispan/configuration/YamlParsingTest.java b/core/src/test/java/org/infinispan/configuration/YamlParsingTest.java
@@ -0,0 +1,26 @@
+package org.infinispan.configuration;
+
+import static org.testng.AssertJUnit.assertEquals;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Set;
+
+import org.infinispan.configuration.global.GlobalConfiguration;
+import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
+import org.infinispan.configuration.parsing.ParserRegistry;
+import org.infinispan.test.AbstractInfinispanTest;
+import org.testng.annotations.Test;
+
+@Test(groups = "unit", testName = "configuration.YamlParsingTest")
+public class YamlParsingTest extends AbstractInfinispanTest {
+   public void testSerializationAllowList() throws IOException {
+      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), true, System.getProperties());
+      ConfigurationBuilderHolder holder = parserRegistry.parseFile("configs/serialization-test.yaml");
+      GlobalConfiguration globalConfiguration = holder.getGlobalConfigurationBuilder().build();
+      Set<String> classes = globalConfiguration.serialization().allowList().getClasses();
+      assertEquals(3, classes.size());
+      List<String> regexps = globalConfiguration.serialization().allowList().getRegexps();
+      assertEquals(2, regexps.size());
+   }
+}
diff --git a/core/src/test/resources/configs/serialization-test.json b/core/src/test/resources/configs/serialization-test.json
@@ -0,0 +1,19 @@
+{
+  "infinispan": {
+    "cache-container": {
+      "serialization": {
+        "allow-list": {
+          "class": [
+            "org.infinispan.test.data.Rock",
+            "org.infinispan.test.data.Paper",
+            "org.infinispan.test.data.Scissors"
+          ],
+          "regex": [
+            "org.infinispan.test.model.*",
+            "org.infinispan.test.types.*"
+          ]
+        }
+      }
+    }
+  }
+}
diff --git a/core/src/test/resources/configs/serialization-test.yaml b/core/src/test/resources/configs/serialization-test.yaml
@@ -0,0 +1,11 @@
+infinispan:
+  cacheContainer:
+    serialization:
+      allowList:
+        class:
+          - "org.infinispan.test.data.Rock"
+          - "org.infinispan.test.data.Paper"
+          - "org.infinispan.test.data.Scissors"
+        regex:
+          - "org.infinispan.test.model.*"
+          - "org.infinispan.test.types.*"