Skip to content

Commit

Permalink
Fix format.
Browse files Browse the repository at this point in the history
  • Loading branch information
@joehni
joehni committed May 16, 2024
1 parent bcc0a9f commit 8472df8
Showing 1 changed file with 106 additions and 106 deletions.
212 changes: 106 additions & 106 deletions xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import java.util.Set;

import com.thoughtworks.xstream.converters.ConversionException;
import com.thoughtworks.xstream.core.JVM;
import com.thoughtworks.xstream.security.AnyTypePermission;
import com.thoughtworks.xstream.security.ForbiddenClassException;
import com.thoughtworks.xstream.security.InputManipulationException;
Expand Down Expand Up @@ -93,23 +94,23 @@ public void testExplicitlyConvertEventHandler() {
public void testExplicitlyConvertImageIOContainsFilter() {
final String xml = ""
+ "<string class='javax.imageio.spi.FilterIterator'>\n"
+ " <iter class='java.util.ArrayList$Itr'>\n"
+ " <cursor>0</cursor>\n"
+ " <lastRet>1</lastRet>\n"
+ " <expectedModCount>1</expectedModCount>\n"
+ " <outer-class>\n"
+ " <com.thoughtworks.acceptance.SecurityVulnerabilityTest_-Exec/>\n"
+ " </outer-class>\n"
+ " </iter>\n"
+ " <filter class='javax.imageio.ImageIO$ContainsFilter'>\n"
+ " <method>\n"
+ " <class>com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec</class>\n"
+ " <name>exec</name>\n"
+ " <parameter-types/>\n"
+ " </method>\n"
+ " <name>exec</name>\n"
+ " </filter>\n"
+ " <next/>\n"
+ " <iter class='java.util.ArrayList$Itr'>\n"
+ " <cursor>0</cursor>\n"
+ " <lastRet>1</lastRet>\n"
+ " <expectedModCount>1</expectedModCount>\n"
+ " <outer-class>\n"
+ " <com.thoughtworks.acceptance.SecurityVulnerabilityTest_-Exec/>\n"
+ " </outer-class>\n"
+ " </iter>\n"
+ " <filter class='javax.imageio.ImageIO$ContainsFilter'>\n"
+ " <method>\n"
+ " <class>com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec</class>\n"
+ " <name>exec</name>\n"
+ " <parameter-types/>\n"
+ " </method>\n"
+ " <name>exec</name>\n"
+ " </filter>\n"
+ " <next/>\n"
+ "</string>";

xstream.allowTypes("javax.imageio.ImageIO$ContainsFilter");
Expand All @@ -122,93 +123,92 @@ public void testExplicitlyConvertImageIOContainsFilter() {
}

public void testExplicitlyConvertSwingUIDefaults() {
final String xml = ""
+ "<hashtable>\n"
+ " <entry>\n"
+ " <javax.swing.UIDefaults_-TextAndMnemonicHashMap serialization=\"custom\">\n"
+ " <unserializable-parents/>\n"
+ " <map>\n"
+ " <default>\n"
+ " <loadFactor>1.0</loadFactor>\n"
+ " <threshold>12</threshold>\n"
+ " </default>\n"
+ " <int>16</int>\n"
+ " <int>1</int>\n"
+ " <javax.activation.MimeTypeParameterList>\n"
+ " <parameters class=\"javax.swing.UIDefaults\" serialization=\"custom\">\n"
+ " <unserializable-parents/>\n"
+ " <hashtable>\n"
+ " <default>\n"
+ " <loadFactor>0.75</loadFactor>\n"
+ " <threshold>525</threshold>\n"
+ " </default>\n"
+ " <int>700</int>\n"
+ " <int>1</int>\n"
+ " <string>1</string>\n"
+ " <javax.swing.UIDefaults_-ProxyLazyValue>\n"
+ " <className>sun.reflect.misc.MethodUtil</className>\n"
+ " <methodName>invoke</methodName>\n"
+ " <args>\n"
+ " <method>\n"
+ " <class>sun.reflect.misc.MethodUtil</class>\n"
+ " <name>invoke</name>\n"
+ " <parameter-types>\n"
+ " <class>java.lang.reflect.Method</class>\n"
+ " <class>java.lang.Object</class>\n"
+ " <class>[Ljava.lang.Object;</class>\n"
+ " </parameter-types>\n"
+ " </method>\n"
+ " <object/>\n"
+ " <object-array>\n"
+ " <method>\n"
+ " <class>com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec</class>\n"
+ " <name>exec</name>\n"
+ " <parameter-types/>\n"
+ " </method>\n"
+ " <com.thoughtworks.acceptance.SecurityVulnerabilityTest_-Exec/>\n"
+ " <object-array/>\n"
+ " </object-array>\n"
+ " </args>\n"
+ " </javax.swing.UIDefaults_-ProxyLazyValue>\n"
+ " </hashtable>\n"
+ " <javax.swing.UIDefaults>\n"
+ " <default>\n"
+ " <defaultLocale>zh_CN</defaultLocale>\n"
+ " <resourceCache/>\n"
+ " </default>\n"
+ " </javax.swing.UIDefaults>\n"
+ " </parameters>\n"
+ " </javax.activation.MimeTypeParameterList>\n"
+ " <null/>\n"
+ " </map>\n"
+ " </javax.swing.UIDefaults_-TextAndMnemonicHashMap>\n"
+ " <int>1</int>\n"
+ " </entry>\n"
+ " <entry>\n"
+ " <javax.swing.UIDefaults_-TextAndMnemonicHashMap serialization=\"custom\">\n"
+ " <unserializable-parents/>\n"
+ " <map>\n"
+ " <default>\n"
+ " <loadFactor>1.0</loadFactor>\n"
+ " <threshold>12</threshold>\n"
+ " </default>\n"
+ " <int>16</int>\n"
+ " <int>1</int>\n"
+ " <javax.activation.MimeTypeParameterList reference=\"../../../../entry/javax.swing.UIDefaults_-TextAndMnemonicHashMap/map/javax.activation.MimeTypeParameterList\"/>\n"
+ " <null/>\n"
+ " </map>\n"
+ " </javax.swing.UIDefaults_-TextAndMnemonicHashMap>\n"
+ " <int>1</int>\n"
+ " </entry>\n"
+ "</hashtable>";

xstream.allowTypes(
"javax.activation.MimeTypeParameterList", "javax.swing.UIDefaults$ProxyLazyValue");

assertEquals(0, BUFFER.length());
final Hashtable<?,?> hashtable = xstream.fromXML(xml);
assertEquals("Executed!", BUFFER.toString());
assertNotNull(hashtable);
final String xml = ""
+ "<hashtable>\n"
+ " <entry>\n"
+ " <javax.swing.UIDefaults_-TextAndMnemonicHashMap serialization=\"custom\">\n"
+ " <unserializable-parents/>\n"
+ " <map>\n"
+ " <default>\n"
+ " <loadFactor>1.0</loadFactor>\n"
+ " <threshold>12</threshold>\n"
+ " </default>\n"
+ " <int>16</int>\n"
+ " <int>1</int>\n"
+ " <javax.activation.MimeTypeParameterList>\n"
+ " <parameters class=\"javax.swing.UIDefaults\" serialization=\"custom\">\n"
+ " <unserializable-parents/>\n"
+ " <hashtable>\n"
+ " <default>\n"
+ " <loadFactor>0.75</loadFactor>\n"
+ " <threshold>525</threshold>\n"
+ " </default>\n"
+ " <int>700</int>\n"
+ " <int>1</int>\n"
+ " <string>1</string>\n"
+ " <javax.swing.UIDefaults_-ProxyLazyValue>\n"
+ " <className>sun.reflect.misc.MethodUtil</className>\n"
+ " <methodName>invoke</methodName>\n"
+ " <args>\n"
+ " <method>\n"
+ " <class>sun.reflect.misc.MethodUtil</class>\n"
+ " <name>invoke</name>\n"
+ " <parameter-types>\n"
+ " <class>java.lang.reflect.Method</class>\n"
+ " <class>java.lang.Object</class>\n"
+ " <class>[Ljava.lang.Object;</class>\n"
+ " </parameter-types>\n"
+ " </method>\n"
+ " <object/>\n"
+ " <object-array>\n"
+ " <method>\n"
+ " <class>com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec</class>\n"
+ " <name>exec</name>\n"
+ " <parameter-types/>\n"
+ " </method>\n"
+ " <com.thoughtworks.acceptance.SecurityVulnerabilityTest_-Exec/>\n"
+ " <object-array/>\n"
+ " </object-array>\n"
+ " </args>\n"
+ " </javax.swing.UIDefaults_-ProxyLazyValue>\n"
+ " </hashtable>\n"
+ " <javax.swing.UIDefaults>\n"
+ " <default>\n"
+ " <defaultLocale>zh_CN</defaultLocale>\n"
+ " <resourceCache/>\n"
+ " </default>\n"
+ " </javax.swing.UIDefaults>\n"
+ " </parameters>\n"
+ " </javax.activation.MimeTypeParameterList>\n"
+ " <null/>\n"
+ " </map>\n"
+ " </javax.swing.UIDefaults_-TextAndMnemonicHashMap>\n"
+ " <int>1</int>\n"
+ " </entry>\n"
+ " <entry>\n"
+ " <javax.swing.UIDefaults_-TextAndMnemonicHashMap serialization=\"custom\">\n"
+ " <unserializable-parents/>\n"
+ " <map>\n"
+ " <default>\n"
+ " <loadFactor>1.0</loadFactor>\n"
+ " <threshold>12</threshold>\n"
+ " </default>\n"
+ " <int>16</int>\n"
+ " <int>1</int>\n"
+ " <javax.activation.MimeTypeParameterList reference=\"../../../../entry/javax.swing.UIDefaults_-TextAndMnemonicHashMap/map/javax.activation.MimeTypeParameterList\"/>\n"
+ " <null/>\n"
+ " </map>\n"
+ " </javax.swing.UIDefaults_-TextAndMnemonicHashMap>\n"
+ " <int>1</int>\n"
+ " </entry>\n"
+ "</hashtable>";

xstream.allowTypes("javax.activation.MimeTypeParameterList", "javax.swing.UIDefaults$ProxyLazyValue");

assertEquals(0, BUFFER.length());
final Hashtable<?, ?> hashtable = xstream.fromXML(xml);
assertEquals(JVM.isVersion(16) ? "" : "Executed!", BUFFER.toString());
assertNotNull(hashtable);
}

public static class Exec {
Expand Down Expand Up @@ -519,10 +519,10 @@ public void testStackOverflowWithRecursiveHashSet() {
public void testStackOverflowWithDeeplyNestedStructure() {
final StringBuffer xml = new StringBuffer();
int i = 0;
for( ; i < 10000; ++i) {
for (; i < 10000; ++i) {
xml.append("<set>");
}
for( ; i > 0; --i) {
for (; i > 0; --i) {
xml.append("</set>");
}

Expand Down

0 comments on commit 8472df8

Please sign in to comment.