diff --git a/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java b/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java index 5b4b6c149..db15e99b9 100644 --- a/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java +++ b/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java @@ -27,6 +27,7 @@ import java.util.Set; import com.thoughtworks.xstream.converters.ConversionException; +import com.thoughtworks.xstream.core.JVM; import com.thoughtworks.xstream.security.AnyTypePermission; import com.thoughtworks.xstream.security.ForbiddenClassException; import com.thoughtworks.xstream.security.InputManipulationException; @@ -93,23 +94,23 @@ public void testExplicitlyConvertEventHandler() { public void testExplicitlyConvertImageIOContainsFilter() { final String xml = "" + "\n" - + " \n" - + " 0\n" - + " 1\n" - + " 1\n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec\n" - + " exec\n" - + " \n" - + " \n" - + " exec\n" - + " \n" - + " \n" + + " \n" + + " 0\n" + + " 1\n" + + " 1\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec\n" + + " exec\n" + + " \n" + + " \n" + + " exec\n" + + " \n" + + " \n" + ""; xstream.allowTypes("javax.imageio.ImageIO$ContainsFilter"); @@ -122,93 +123,92 @@ public void testExplicitlyConvertImageIOContainsFilter() { } public void testExplicitlyConvertSwingUIDefaults() { - final String xml = "" - + "\n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " 1.0\n" - + " 12\n" - + " \n" - + " 16\n" - + " 1\n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " 0.75\n" - + " 525\n" - + " \n" - + " 700\n" - + " 1\n" - + " 1\n" - + " \n" - + " sun.reflect.misc.MethodUtil\n" - + " invoke\n" - + " \n" - + " \n" - + " sun.reflect.misc.MethodUtil\n" - + " invoke\n" - + " \n" - + " java.lang.reflect.Method\n" - + " java.lang.Object\n" - + " [Ljava.lang.Object;\n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec\n" - + " exec\n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " zh_CN\n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " 1\n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " \n" - + " 1.0\n" - + " 12\n" - + " \n" - + " 16\n" - + " 1\n" - + " \n" - + " \n" - + " \n" - + " \n" - + " 1\n" - + " \n" - + ""; - - xstream.allowTypes( - "javax.activation.MimeTypeParameterList", "javax.swing.UIDefaults$ProxyLazyValue"); - - assertEquals(0, BUFFER.length()); - final Hashtable hashtable = xstream.fromXML(xml); - assertEquals("Executed!", BUFFER.toString()); - assertNotNull(hashtable); + final String xml = "" + + "\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " 1.0\n" + + " 12\n" + + " \n" + + " 16\n" + + " 1\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " 0.75\n" + + " 525\n" + + " \n" + + " 700\n" + + " 1\n" + + " 1\n" + + " \n" + + " sun.reflect.misc.MethodUtil\n" + + " invoke\n" + + " \n" + + " \n" + + " sun.reflect.misc.MethodUtil\n" + + " invoke\n" + + " \n" + + " java.lang.reflect.Method\n" + + " java.lang.Object\n" + + " [Ljava.lang.Object;\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " com.thoughtworks.acceptance.SecurityVulnerabilityTest$Exec\n" + + " exec\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " zh_CN\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " 1\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " \n" + + " 1.0\n" + + " 12\n" + + " \n" + + " 16\n" + + " 1\n" + + " \n" + + " \n" + + " \n" + + " \n" + + " 1\n" + + " \n" + + ""; + + xstream.allowTypes("javax.activation.MimeTypeParameterList", "javax.swing.UIDefaults$ProxyLazyValue"); + + assertEquals(0, BUFFER.length()); + final Hashtable hashtable = xstream.fromXML(xml); + assertEquals(JVM.isVersion(16) ? "" : "Executed!", BUFFER.toString()); + assertNotNull(hashtable); } public static class Exec { @@ -519,10 +519,10 @@ public void testStackOverflowWithRecursiveHashSet() { public void testStackOverflowWithDeeplyNestedStructure() { final StringBuffer xml = new StringBuffer(); int i = 0; - for( ; i < 10000; ++i) { + for (; i < 10000; ++i) { xml.append(""); } - for( ; i > 0; --i) { + for (; i > 0; --i) { xml.append(""); }