Skip to content

Commit 7765942

Browse files
AlekseiEfimovAlekseiEfimov
committed
8290367: Update default value and extend the scope of com.sun.jndi.ldap.object.trustSerialData system property
Reviewed-by: dfuchs, jpai
1 parent 11e7d53 commit 7765942

File tree

13 files changed

+262
-52
lines changed

13 files changed

+262
-52
lines changed

‎src/java.naming/share/classes/com/sun/jndi/ldap/Obj.java

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1999, 2021, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1999, 2022, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -239,6 +239,10 @@ static Object decodeObject(Attributes attrs)
239239
ClassLoader cl = helper.getURLClassLoader(codebases);
240240
return deserializeObject((byte[])attr.get(), cl);
241241
} else if ((attr = attrs.get(JAVA_ATTRIBUTES[REMOTE_LOC])) != null) {
242+
// javaRemoteLocation attribute (RMI stub will be created)
243+
if (!VersionHelper.isSerialDataAllowed()) {
244+
throw new NamingException("Object deserialization is not allowed");
245+
}
242246
// For backward compatibility only
243247
return decodeRmiObject(
244248
(String)attrs.get(JAVA_ATTRIBUTES[CLASSNAME]).get(),

‎src/java.naming/share/classes/com/sun/jndi/ldap/VersionHelper.java

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1999, 2021, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1999, 2022, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -44,8 +44,8 @@ public final class VersionHelper {
4444
private static final boolean trustURLCodebase;
4545

4646
/**
47-
* Determines whether objects may be deserialized from the content of
48-
* 'javaSerializedData' attribute.
47+
* Determines whether objects may be deserialized or reconstructed from a content of
48+
* 'javaSerializedData', 'javaRemoteLocation' or 'javaReferenceAddress' LDAP attributes.
4949
*/
5050
private static final boolean trustSerialData;
5151

@@ -56,10 +56,10 @@ public final class VersionHelper {
5656
"com.sun.jndi.ldap.object.trustURLCodebase", "false");
5757
trustURLCodebase = "true".equalsIgnoreCase(trust);
5858

59-
// System property to control whether classes is allowed to be loaded from
60-
// 'javaSerializedData' attribute
59+
// System property to control whether classes are allowed to be loaded from
60+
// 'javaSerializedData', 'javaRemoteLocation' or 'javaReferenceAddress' attributes.
6161
String trustSerialDataSp = getPrivilegedProperty(
62-
"com.sun.jndi.ldap.object.trustSerialData", "true");
62+
"com.sun.jndi.ldap.object.trustSerialData", "false");
6363
trustSerialData = "true".equalsIgnoreCase(trustSerialDataSp);
6464
}
6565

@@ -81,8 +81,9 @@ static VersionHelper getVersionHelper() {
8181
}
8282

8383
/**
84-
* Returns true if deserialization of objects from 'javaSerializedData'
85-
* and 'javaReferenceAddress' LDAP attributes is allowed.
84+
* Returns true if deserialization or reconstruction of objects from
85+
* 'javaSerializedData', 'javaRemoteLocation' and 'javaReferenceAddress'
86+
* LDAP attributes is allowed.
8687
*
8788
* @return true if deserialization is allowed; false - otherwise
8889
*/

‎src/java.naming/share/classes/module-info.java

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,16 @@
7979
* <ul>
8080
* <li>{@systemProperty com.sun.jndi.ldap.object.trustSerialData}:
8181
* <br>The value of this system property is the string representation of a boolean value
82-
* which allows to control the deserialization of java objects from the 'javaSerializedData'
83-
* LDAP attribute. To prevent the deserialization of java objects from the 'javaSerializedData'
84-
* attribute, the system property value can be set to 'false'.
85-
* <br>If the property is not specified then the deserialization of java objects
86-
* from the 'javaSerializedData' attribute is allowed.
82+
* that controls the deserialization of java objects from the {@code javaSerializedData} LDAP
83+
* attribute, reconstruction of RMI references from the {@code javaRemoteLocation} LDAP attribute, and
84+
* reconstruction of {@linkplain javax.naming.BinaryRefAddr binary reference addresses} from
85+
* the {@code javaReferenceAddress} LDAP attribute.
86+
* To allow the deserialization or reconstruction of java objects from {@code javaSerializedData},
87+
* {@code javaRemoteLocation} or {@code javaReferenceAddress} attributes, the system property value
88+
* can be set to {@code true} (case insensitive).
89+
* <br>If the property is not specified the deserialization of java objects
90+
* from the {@code javaSerializedData}, the {@code javaRemoteLocation}, or {@code javaReferenceAddress}
91+
* attributes is not allowed.
8792
* </li>
8893
* <li>{@systemProperty jdk.jndi.object.factoriesFilter}:
8994
* <br>The value of this system property defines a filter used by

‎test/jdk/com/sun/jndi/ldap/objects/RemoteLocationAttributeTest.java

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
/*
2+
* Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
import java.net.InetAddress;
25+
import java.net.InetSocketAddress;
26+
import java.net.ServerSocket;
27+
import java.net.SocketAddress;
28+
import java.util.Hashtable;
29+
import javax.naming.CommunicationException;
30+
import javax.naming.NamingException;
31+
import javax.naming.ServiceUnavailableException;
32+
import javax.naming.directory.DirContext;
33+
import javax.naming.directory.InitialDirContext;
34+
35+
import jdk.test.lib.net.URIBuilder;
36+
37+
/**
38+
* @test
39+
* @bug 8290367
40+
* @summary Check if com.sun.jndi.ldap.object.trustSerialData covers the creation
41+
* of RMI remote objects from the 'javaRemoteLocation' LDAP attribute.
42+
* @modules java.naming/com.sun.jndi.ldap
43+
* @library /test/lib ../lib /javax/naming/module/src/test/test/
44+
* @build LDAPServer LDAPTestUtils
45+
*
46+
* @run main/othervm RemoteLocationAttributeTest
47+
* @run main/othervm -Dcom.sun.jndi.ldap.object.trustSerialData
48+
* RemoteLocationAttributeTest
49+
* @run main/othervm -Dcom.sun.jndi.ldap.object.trustSerialData=false
50+
* RemoteLocationAttributeTest
51+
* @run main/othervm -Dcom.sun.jndi.ldap.object.trustSerialData=true
52+
* RemoteLocationAttributeTest
53+
* @run main/othervm -Dcom.sun.jndi.ldap.object.trustSerialData=TrUe
54+
* RemoteLocationAttributeTest
55+
*/
56+
57+
public class RemoteLocationAttributeTest {
58+
59+
public static void main(String[] args) throws Exception {
60+
// Create unbound server socket
61+
ServerSocket serverSocket = new ServerSocket();
62+
63+
// Bind it to the loopback address
64+
SocketAddress sockAddr = new InetSocketAddress(
65+
InetAddress.getLoopbackAddress(), 0);
66+
serverSocket.bind(sockAddr);
67+
68+
// Construct the provider URL for LDAPTestUtils
69+
String providerURL = URIBuilder.newBuilder()
70+
.scheme("ldap")
71+
.loopback()
72+
.port(serverSocket.getLocalPort())
73+
.buildUnchecked().toString();
74+
75+
Hashtable<Object, Object> env;
76+
77+
// Initialize test environment variables
78+
env = LDAPTestUtils.initEnv(serverSocket, providerURL,
79+
RemoteLocationAttributeTest.class.getName(), args, false);
80+
81+
DirContext ctx = null;
82+
try (serverSocket) {
83+
System.err.println(env);
84+
// connect to server
85+
ctx = new InitialDirContext(env);
86+
Object lookupResult = ctx.lookup("Test");
87+
System.err.println("Lookup result:" + lookupResult);
88+
// Test doesn't provide RMI registry running at 127.0.0.1:1097, but if
89+
// there is one running on test host successful result is valid for
90+
// cases when reconstruction allowed.
91+
if (!RECONSTRUCTION_ALLOWED) {
92+
throw new AssertionError("Unexpected successful lookup");
93+
}
94+
} catch (ServiceUnavailableException | CommunicationException connectionException) {
95+
// The remote location was properly reconstructed but connection to
96+
// RMI endpoint failed:
97+
// ServiceUnavailableException - no open socket on 127.0.0.1:1097
98+
// CommunicationException - 127.0.0.1:1097 is open, but it is not RMI registry
99+
System.err.println("Got one of connection exceptions:" + connectionException);
100+
if (!RECONSTRUCTION_ALLOWED) {
101+
throw new AssertionError("Reconstruction not blocked, as expected");
102+
}
103+
} catch (NamingException ne) {
104+
String message = ne.getMessage();
105+
System.err.printf("Got NamingException with message: '%s'%n", message);
106+
if (RECONSTRUCTION_ALLOWED && EXPECTED_NAMING_EXCEPTION_MESSAGE.equals(message)) {
107+
throw new AssertionError("Reconstruction unexpectedly blocked");
108+
}
109+
if (!RECONSTRUCTION_ALLOWED && !EXPECTED_NAMING_EXCEPTION_MESSAGE.equals(message)) {
110+
throw new AssertionError("Reconstruction not blocked");
111+
}
112+
} finally {
113+
LDAPTestUtils.cleanup(ctx);
114+
}
115+
}
116+
117+
// Reconstruction of RMI remote objects is allowed if 'com.sun.jndi.ldap.object.trustSerialData'
118+
// is set to "true". If the system property is not specified it implies default "false" value
119+
private static final boolean RECONSTRUCTION_ALLOWED =
120+
Boolean.getBoolean("com.sun.jndi.ldap.object.trustSerialData");
121+
122+
// NamingException message when reconstruction is not allowed
123+
private static final String EXPECTED_NAMING_EXCEPTION_MESSAGE = "Object deserialization is not allowed";
124+
}

‎test/jdk/com/sun/jndi/ldap/objects/RemoteLocationAttributeTest.ldap

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#
2+
# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
3+
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
#
5+
# This code is free software; you can redistribute it and/or modify it
6+
# under the terms of the GNU General Public License version 2 only, as
7+
# published by the Free Software Foundation.
8+
#
9+
# This code is distributed in the hope that it will be useful, but WITHOUT
10+
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
# version 2 for more details (a copy is included in the LICENSE file that
13+
# accompanied this code).
14+
#
15+
# You should have received a copy of the GNU General Public License version
16+
# 2 along with this work; if not, write to the Free Software Foundation,
17+
# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
#
19+
# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
# or visit www.oracle.com if you need additional information or have any
21+
# questions.
22+
#
23+
24+
################################################################################
25+
# Capture file for RemoteLocationAttributeTest.java
26+
#
27+
# NOTE: This hexadecimal dump of LDAP protocol messages was generated by
28+
# running the RemoteLocationAttributeTest application program against
29+
# a real LDAP server and setting the JNDI/LDAP environment property:
30+
# com.sun.jndi.ldap.trace.ber to activate LDAP message tracing.
31+
#
32+
################################################################################
33+
34+
# LDAP BindRequest
35+
0000: 30 0C 02 01 01 60 07 02 01 03 04 00 80 00 0....`........
36+
37+
# LDAP BindResponse
38+
0000: 30 0C 02 01 01 61 07 0A 01 00 04 00 04 00 0....a........
39+
40+
# LDAP SearchRequest
41+
0000: 30 46 02 01 02 63 24 04 04 54 65 73 74 0A 01 00 0F...c$..Test...
42+
0010: 0A 01 03 02 01 00 02 01 00 01 01 00 87 0B 6F 62 ..............ob
43+
0020: 6A 65 63 74 43 6C 61 73 73 30 00 A0 1B 30 19 04 jectClass0...0..
44+
0030: 17 32 2E 31 36 2E 38 34 30 2E 31 2E 31 31 33 37 .2.16.840.1.1137
45+
0040: 33 30 2E 33 2E 34 2E 32 30.3.4.2
46+
47+
# LDAP SearchResultEntry
48+
0000: 30 5E 02 01 02 64 59 04 04 54 65 73 74 30 51 30 0^...dY..Test0Q0
49+
0010: 16 04 0D 6A 61 76 61 43 6C 61 73 73 4E 61 6D 65 ...javaClassName
50+
0020: 31 05 04 03 66 6F 6F 30 37 04 12 6A 61 76 61 52 1...foo07..javaR
51+
0030: 65 6D 6F 74 65 4C 6F 63 61 74 69 6F 6E 31 21 04 emoteLocation1!.
52+
0040: 1F 72 6D 69 3A 2F 2F 31 32 37 2E 30 2E 30 2E 31 .rmi://127.0.0.1
53+
0050: 3A 31 30 39 37 2F 54 65 73 74 52 65 6D 6F 74 65 :1097/TestRemote
54+
55+
# LDAP SearchResultDone
56+
0000: 30 0C 02 01 02 65 07 0A 01 00 04 00 04 00 0....e........
57+
58+
# LDAP UnbindRequest
59+
0000: 30 22 02 01 03 42 00 A0 1B 30 19 04 17 32 2E 31 0"...B...0...2.1
60+
0010: 36 2E 38 34 30 2E 31 2E 31 31 33 37 33 30 2E 33 6.840.1.113730.3
61+
0020: 2E 34 2E 32 .4.2

‎test/jdk/javax/naming/module/RunBasic.java

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2015, 2022, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -31,6 +31,7 @@
3131
import java.nio.file.Files;
3232
import java.nio.file.Path;
3333
import java.time.Duration;
34+
import java.util.ArrayList;
3435
import java.util.Collection;
3536
import java.util.Collections;
3637
import java.util.List;
@@ -92,10 +93,14 @@ public static void main(String[] args) throws Throwable {
9293
System.out.println("Hostname: [" + HOST_NAME + "]");
9394

9495
// run tests
95-
runTest("java.desktop", "test.StoreObject");
96-
runTest("person", "test.StorePerson");
97-
runTest("fruit", "test.StoreFruit");
98-
runTest("hello", "test.StoreRemote");
96+
runTest("java.desktop", "test.StoreObject",
97+
"-Dcom.sun.jndi.ldap.object.trustSerialData=true");
98+
runTest("person", "test.StorePerson",
99+
"-Dcom.sun.jndi.ldap.object.trustSerialData=true");
100+
runTest("fruit", "test.StoreFruit",
101+
"-Dcom.sun.jndi.ldap.object.trustSerialData=true");
102+
runTest("hello", "test.StoreRemote",
103+
"-Dcom.sun.jndi.ldap.object.trustSerialData=true");
99104
runTest("foo", "test.ConnectWithFoo");
100105
runTest("authz", "test.ConnectWithAuthzId");
101106
runTest("ldapv4", "test.ReadByUrl");
@@ -117,10 +122,19 @@ private static void makeDir(String first, String... more)
117122
Files.createDirectories(Path.of(first, more));
118123
}
119124

120-
private static void runTest(String desc, String clsName) throws Throwable {
125+
private static void runTest(String desc, String clsName, String... additionalVmOpts) throws Throwable {
126+
List<String> opts = new ArrayList<>();
127+
opts.add("-Dtest.src=" + TEST_SRC);
128+
for (String opt : additionalVmOpts) {
129+
opts.add(opt);
130+
}
131+
opts.add("-p");
132+
opts.add("mods");
133+
opts.add("-m");
134+
opts.add("test/" + clsName);
135+
opts.add("ldap://" + HOST_NAME + "/dc=ie,dc=oracle,dc=com");
121136
System.out.println("Running with the '" + desc + "' module...");
122-
runJava("-Dtest.src=" + TEST_SRC, "-p", "mods", "-m", "test/" + clsName,
123-
"ldap://" + HOST_NAME + "/dc=ie,dc=oracle,dc=com");
137+
runJava(opts.toArray(String[]::new));
124138
}
125139

126140
private static void runJava(String... opts) throws Throwable {

‎test/jdk/javax/naming/module/src/test/test/ConnectWithAuthzId.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2015, 2022, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -33,7 +33,6 @@
3333
import java.net.*;
3434
import java.util.*;
3535
import javax.naming.*;
36-
import javax.naming.directory.*;
3736
import javax.naming.ldap.*;
3837

3938
import org.example.authz.AuthzIdRequestControl;
@@ -68,7 +67,7 @@ public static void main(String[] args) throws Exception {
6867
System.err.println(" <ldapurl> is the LDAP URL of the parent entry\n");
6968
System.err.println("example:");
7069
System.err.println(" java ConnectWithAuthzId ldap://oasis/o=airius.com");
71-
return;
70+
throw new IllegalArgumentException();
7271
}
7372

7473
/*
@@ -134,6 +133,7 @@ public void run() {
134133
}
135134
} catch (NamingException e) {
136135
System.err.println("ConnectWithAuthzId: error connecting " + e);
136+
throw e;
137137
} finally {
138138
if (ctx != null) {
139139
ctx.close();

‎test/jdk/javax/naming/module/src/test/test/ConnectWithFoo.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2015, 2022, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -65,7 +65,7 @@ public static void main(String[] args) throws Exception {
6565
System.err.println(" <ldapurl> is the LDAP URL of the parent entry\n");
6666
System.err.println("example:");
6767
System.err.println(" java ConnectWithFoo ldap://oasis/o=airius.com");
68-
return;
68+
throw new IllegalArgumentException();
6969
}
7070

7171
/*
@@ -112,6 +112,7 @@ public void run() {
112112
System.out.println("ConnectWithFoo: connected");
113113
} catch (NamingException e) {
114114
System.err.println("ConnectWithFoo: error connecting " + e);
115+
throw e;
115116
} finally {
116117
if (ctx != null) {
117118
ctx.close();

0 commit comments

Comments
 (0)