Spring/spring-integration
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Replace whitelist with allowlist

Browse Source
This commit is contained in:
Artem Bilan
2020-06-11 18:04:28 -04:00
committed by Gary Russell
parent 7ec1f5cc4b
commit 2419c03b25
18 changed files with 377 additions and 189 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-integration-core/src/test/java/org/springframework/integration/config/xml/PayloadDeserializingTransformerParserTests-context.xml
View File

@@ -20,7 +20,7 @@
</channel>
<payload-deserializing-transformer id="direct" input-channel="directInput" output-channel="output"
white-list="*" />
allow-list="*" />
<payload-deserializing-transformer input-channel="queueInput" output-channel="output">
<poller fixed-delay="10000"/>

37
spring-integration-core/src/test/java/org/springframework/integration/config/xml/PayloadDeserializingTransformerParserTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
package org.springframework.integration.config.xml;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
@@ -24,10 +25,10 @@ import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.nio.charset.StandardCharsets;
import java.util.Set;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
@@ -39,15 +40,14 @@ import org.springframework.messaging.MessageChannel;
import org.springframework.messaging.MessageHandler;
import org.springframework.messaging.PollableChannel;
import org.springframework.messaging.support.GenericMessage;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
import org.springframework.util.FileCopyUtils;
/**
* @author Mark Fisher
* @author Artem Bilan
*/
@ContextConfiguration
@RunWith(SpringJUnit4ClassRunner.class)
@SpringJUnitConfig
public class PayloadDeserializingTransformerParserTests {
@Autowired
@@ -75,8 +75,8 @@ public class PayloadDeserializingTransformerParserTests {
assertThat(result).isNotNull();
assertThat(result.getPayload() instanceof String).isTrue();
assertThat(result.getPayload()).isEqualTo("foo");
Set<?> patterns = TestUtils.getPropertyValue(this.handler, "transformer.converter.whiteListPatterns",
Set.class);
Set<?> patterns =
TestUtils.getPropertyValue(this.handler, "transformer.converter.allowedPatterns", Set.class);
assertThat(patterns.size()).isEqualTo(1);
assertThat(patterns.iterator().next()).isEqualTo("*");
}
@@ -84,7 +84,7 @@ public class PayloadDeserializingTransformerParserTests {
@Test
public void queueChannelWithSerializedStringMessage() throws Exception {
byte[] bytes = serialize("foo");
queueInput.send(new GenericMessage<byte[]>(bytes));
queueInput.send(new GenericMessage<>(bytes));
Message<?> result = output.receive(10000);
assertThat(result).isNotNull();
assertThat(result.getPayload() instanceof String).isTrue();
@@ -94,7 +94,7 @@ public class PayloadDeserializingTransformerParserTests {
@Test
public void directChannelWithSerializedObjectMessage() throws Exception {
byte[] bytes = serialize(new TestBean());
directInput.send(new GenericMessage<byte[]>(bytes));
directInput.send(new GenericMessage<>(bytes));
Message<?> result = output.receive(10000);
assertThat(result).isNotNull();
assertThat(result.getPayload().getClass()).isEqualTo(TestBean.class);
@@ -104,22 +104,23 @@ public class PayloadDeserializingTransformerParserTests {
@Test
public void queueChannelWithSerializedObjectMessage() throws Exception {
byte[] bytes = serialize(new TestBean());
queueInput.send(new GenericMessage<byte[]>(bytes));
queueInput.send(new GenericMessage<>(bytes));
Message<?> result = output.receive(10000);
assertThat(result).isNotNull();
assertThat(result.getPayload().getClass()).isEqualTo(TestBean.class);
assertThat(((TestBean) result.getPayload()).name).isEqualTo("test");
}
@Test(expected = MessageTransformationException.class)
@Test
public void invalidPayload() {
byte[] bytes = new byte[] { 1, 2, 3 };
directInput.send(new GenericMessage<byte[]>(bytes));
byte[] bytes = {1, 2, 3};
assertThatExceptionOfType(MessageTransformationException.class)
.isThrownBy(() -> directInput.send(new GenericMessage<>(bytes)));
}
@Test
public void customDeserializer() throws Exception {
customDeserializerInput.send(new GenericMessage<byte[]>("test".getBytes("UTF-8")));
public void customDeserializer() {
customDeserializerInput.send(new GenericMessage<>("test".getBytes(StandardCharsets.UTF_8)));
Message<?> result = output.receive(10000);
assertThat(result).isNotNull();
assertThat(result.getPayload().getClass()).isEqualTo(String.class);
@@ -151,7 +152,7 @@ public class PayloadDeserializingTransformerParserTests {
@Override
public Object deserialize(InputStream source) throws IOException {
return FileCopyUtils.copyToString(new InputStreamReader(source, "UTF-8")).toUpperCase();
return FileCopyUtils.copyToString(new InputStreamReader(source, StandardCharsets.UTF_8)).toUpperCase();
}
}

28
spring-integration-core/src/test/java/org/springframework/integration/transformer/PayloadDeserializingTransformerTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,13 +17,14 @@
package org.springframework.integration.transformer;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.assertj.core.api.Assertions.fail;
import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import org.junit.Test;
import org.junit.jupiter.api.Test;
import org.springframework.integration.support.MessageBuilder;
import org.springframework.messaging.Message;
@@ -31,6 +32,7 @@ import org.springframework.messaging.support.GenericMessage;
/**
* @author Mark Fisher
* @author Artem Bilan
*/
public class PayloadDeserializingTransformerTests {
@@ -41,7 +43,7 @@ public class PayloadDeserializingTransformerTests {
objectStream.writeObject("foo");
byte[] serialized = byteStream.toByteArray();
PayloadDeserializingTransformer transformer = new PayloadDeserializingTransformer();
Message<?> result = transformer.transform(new GenericMessage<byte[]>(serialized));
Message<?> result = transformer.transform(new GenericMessage<>(serialized));
Object payload = result.getPayload();
assertThat(payload).isNotNull();
assertThat(payload.getClass()).isEqualTo(String.class);
@@ -56,7 +58,7 @@ public class PayloadDeserializingTransformerTests {
objectStream.writeObject(testBean);
byte[] serialized = byteStream.toByteArray();
PayloadDeserializingTransformer transformer = new PayloadDeserializingTransformer();
Message<?> result = transformer.transform(new GenericMessage<byte[]>(serialized));
Message<?> result = transformer.transform(new GenericMessage<>(serialized));
Object payload = result.getPayload();
assertThat(payload).isNotNull();
assertThat(payload.getClass()).isEqualTo(TestBean.class);
@@ -64,35 +66,36 @@ public class PayloadDeserializingTransformerTests {
}
@Test
public void deserializeObjectWhiteList() throws Exception {
public void deserializeObjectAllowList() throws Exception {
TestBean testBean = new TestBean("test");
ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
ObjectOutputStream objectStream = new ObjectOutputStream(byteStream);
objectStream.writeObject(testBean);
byte[] serialized = byteStream.toByteArray();
PayloadDeserializingTransformer transformer = new PayloadDeserializingTransformer();
transformer.setWhiteListPatterns("com.*");
transformer.setAllowedPatterns("com.*");
try {
transformer.transform(new GenericMessage<byte[]>(serialized));
transformer.transform(new GenericMessage<>(serialized));
fail("expected security exception");
}
catch (MessageTransformationException e) {
assertThat(e.getCause().getCause()).isInstanceOf(SecurityException.class);
assertThat(e.getCause().getCause().getMessage()).startsWith("Attempt to deserialize unauthorized");
}
transformer.setWhiteListPatterns("org.*");
Message<?> result = transformer.transform(new GenericMessage<byte[]>(serialized));
transformer.setAllowedPatterns("org.*");
Message<?> result = transformer.transform(new GenericMessage<>(serialized));
Object payload = result.getPayload();
assertThat(payload).isNotNull();
assertThat(payload.getClass()).isEqualTo(TestBean.class);
assertThat(((TestBean) payload).name).isEqualTo(testBean.name);
}
@Test(expected = MessageTransformationException.class)
@Test
public void invalidPayload() {
byte[] bytes = new byte[] { 1, 2, 3 };
byte[] bytes = {1, 2, 3};
PayloadDeserializingTransformer transformer = new PayloadDeserializingTransformer();
transformer.transform(new GenericMessage<byte[]>(bytes));
assertThatExceptionOfType(MessageTransformationException.class)
.isThrownBy(() -> transformer.transform(new GenericMessage<>(bytes)));
}
@Test
@@ -111,6 +114,7 @@ public class PayloadDeserializingTransformerTests {
TestBean(String name) {
this.name = name;
}
}
}