openeuler-ci-bot
Gitee
commit
d08b0c128a
123
0001-Prevent-deserialization-of-void.patch
Normal file
123
0001-Prevent-deserialization-of-void.patch
Normal file
@ -0,0 +1,123 @@
|
||||
From 376175c482a4914c8d288cf663f978dfb5e55849 Mon Sep 17 00:00:00 2001
|
||||
From: Michael Simacek <msimacek@redhat.com>
|
||||
Date: Wed, 12 Apr 2017 12:19:21 +0200
|
||||
Subject: [PATCH] Prevent deserialization of void
|
||||
|
||||
---
|
||||
.../SunLimitedUnsafeReflectionProvider.java | 22 ++++++++++++--------
|
||||
.../xstream/security/PrimitiveTypePermission.java | 5 +++--
|
||||
.../acceptance/SecurityVulnerabilityTest.java | 24 +++++++++++++++++++++-
|
||||
3 files changed, 39 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/xstream/src/java/com/thoughtworks/xstream/converters/reflection/SunLimitedUnsafeReflectionProvider.java b/xstream/src/java/com/thoughtworks/xstream/converters/reflection/SunLimitedUnsafeReflectionProvider.java
|
||||
index 2c569ae..491f0d6 100644
|
||||
--- a/xstream/src/java/com/thoughtworks/xstream/converters/reflection/SunLimitedUnsafeReflectionProvider.java
|
||||
+++ b/xstream/src/java/com/thoughtworks/xstream/converters/reflection/SunLimitedUnsafeReflectionProvider.java
|
||||
@@ -1,6 +1,6 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2005 Joe Walnes.
|
||||
- * Copyright (C) 2006, 2007, 2008, 2011, 2013, 2014, 2016 XStream Committers.
|
||||
+ * Copyright (C) 2006, 2007, 2008, 2011, 2013, 2014, 2016, 2017 XStream Committers.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Created on 08. January 2014 by Joerg Schaible, factored out from SunUnsafeReflectionProvider
|
||||
@@ -78,14 +78,18 @@ public class SunLimitedUnsafeReflectionProvider extends PureJavaReflectionProvid
|
||||
throw ex;
|
||||
}
|
||||
ErrorWritingException ex = null;
|
||||
- try {
|
||||
- return unsafe.allocateInstance(type);
|
||||
- } catch (SecurityException e) {
|
||||
- ex = new ObjectAccessException("Cannot construct type", e);
|
||||
- } catch (InstantiationException e) {
|
||||
- ex = new ConversionException("Cannot construct type", e);
|
||||
- } catch (IllegalArgumentException e) {
|
||||
- ex = new ObjectAccessException("Cannot construct type", e);
|
||||
+ if (type == void.class || type == Void.class) {
|
||||
+ ex = new ConversionException("Type void cannot have an instance");
|
||||
+ } else {
|
||||
+ try {
|
||||
+ return unsafe.allocateInstance(type);
|
||||
+ } catch (SecurityException e) {
|
||||
+ ex = new ObjectAccessException("Cannot construct type", e);
|
||||
+ } catch (InstantiationException e) {
|
||||
+ ex = new ConversionException("Cannot construct type", e);
|
||||
+ } catch (IllegalArgumentException e) {
|
||||
+ ex = new ObjectAccessException("Cannot construct type", e);
|
||||
+ }
|
||||
}
|
||||
ex.add("construction-type", type.getName());
|
||||
throw ex;
|
||||
diff --git a/xstream/src/java/com/thoughtworks/xstream/security/PrimitiveTypePermission.java b/xstream/src/java/com/thoughtworks/xstream/security/PrimitiveTypePermission.java
|
||||
index fb69b95..c3cbad9 100644
|
||||
--- a/xstream/src/java/com/thoughtworks/xstream/security/PrimitiveTypePermission.java
|
||||
+++ b/xstream/src/java/com/thoughtworks/xstream/security/PrimitiveTypePermission.java
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
- * Copyright (C) 2014 XStream Committers.
|
||||
+ * Copyright (C) 2014, 2017 XStream Committers.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Created on 09. January 2014 by Joerg Schaible
|
||||
@@ -8,8 +8,9 @@ package com.thoughtworks.xstream.security;
|
||||
|
||||
import com.thoughtworks.xstream.core.util.Primitives;
|
||||
|
||||
+
|
||||
/**
|
||||
- * Permission for any primitive type and its boxed counterpart (incl. void).
|
||||
+ * Permission for any primitive type and its boxed counterpart (excl. void).
|
||||
*
|
||||
* @author Jörg Schaible
|
||||
* @since 1.4.7
|
||||
diff --git a/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java b/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java
|
||||
index c77b3ce..0180fd7 100644
|
||||
--- a/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java
|
||||
+++ b/xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
- * Copyright (C) 2013, 2014 XStream Committers.
|
||||
+ * Copyright (C) 2013, 2014, 2017 XStream Committers.
|
||||
* All rights reserved.
|
||||
*
|
||||
* The software in this package is published under the terms of the BSD
|
||||
@@ -13,9 +13,12 @@ package com.thoughtworks.acceptance;
|
||||
import java.beans.EventHandler;
|
||||
|
||||
import com.thoughtworks.xstream.XStreamException;
|
||||
+import com.thoughtworks.xstream.converters.ConversionException;
|
||||
import com.thoughtworks.xstream.converters.reflection.ReflectionConverter;
|
||||
+import com.thoughtworks.xstream.security.ForbiddenClassException;
|
||||
import com.thoughtworks.xstream.security.ProxyTypePermission;
|
||||
|
||||
+
|
||||
/**
|
||||
* @author Jörg Schaible
|
||||
*/
|
||||
@@ -80,4 +83,23 @@ public class SecurityVulnerabilityTest extends AbstractAcceptanceTest {
|
||||
BUFFER.append("Executed!");
|
||||
}
|
||||
}
|
||||
+
|
||||
+ public void testDeniedInstanceOfVoid() {
|
||||
+ try {
|
||||
+ xstream.fromXML("<void/>");
|
||||
+ fail("Thrown " + ForbiddenClassException.class.getName() + " expected");
|
||||
+ } catch (final ForbiddenClassException e) {
|
||||
+ // OK
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ public void testAllowedInstanceOfVoid() {
|
||||
+ xstream.allowTypes(void.class, Void.class);
|
||||
+ try {
|
||||
+ xstream.fromXML("<void/>");
|
||||
+ fail("Thrown " + ConversionException.class.getName() + " expected");
|
||||
+ } catch (final ConversionException e) {
|
||||
+ assertEquals("void", e.get("construction-type"));
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
--
|
||||
2.9.3
|
||||
|
||||
36
README.en.md
36
README.en.md
@ -1,36 +0,0 @@
|
||||
# xstream
|
||||
|
||||
#### Description
|
||||
{**When you're done, you can delete the content in this README and update the file with details for others getting started with your repository**}
|
||||
|
||||
#### Software Architecture
|
||||
Software architecture description
|
||||
|
||||
#### Installation
|
||||
|
||||
1. xxxx
|
||||
2. xxxx
|
||||
3. xxxx
|
||||
|
||||
#### Instructions
|
||||
|
||||
1. xxxx
|
||||
2. xxxx
|
||||
3. xxxx
|
||||
|
||||
#### Contribution
|
||||
|
||||
1. Fork the repository
|
||||
2. Create Feat_xxx branch
|
||||
3. Commit your code
|
||||
4. Create Pull Request
|
||||
|
||||
|
||||
#### Gitee Feature
|
||||
|
||||
1. You can use Readme\_XXX.md to support different languages, such as Readme\_en.md, Readme\_zh.md
|
||||
2. Gitee blog [blog.gitee.com](https://blog.gitee.com)
|
||||
3. Explore open source project [https://gitee.com/explore](https://gitee.com/explore)
|
||||
4. The most valuable open source project [GVP](https://gitee.com/gvp)
|
||||
5. The manual of Gitee [https://gitee.com/help](https://gitee.com/help)
|
||||
6. The most popular members [https://gitee.com/gitee-stars/](https://gitee.com/gitee-stars/)
|
||||
39
README.md
39
README.md
@ -1,39 +0,0 @@
|
||||
# xstream
|
||||
|
||||
#### 介绍
|
||||
{**以下是码云平台说明，您可以替换此简介**
|
||||
码云是 OSCHINA 推出的基于 Git 的代码托管平台（同时支持 SVN）。专为开发者提供稳定、高效、安全的云端软件开发协作平台
|
||||
无论是个人、团队、或是企业，都能够用码云实现代码托管、项目管理、协作开发。企业项目请看 [https://gitee.com/enterprises](https://gitee.com/enterprises)}
|
||||
|
||||
#### 软件架构
|
||||
软件架构说明
|
||||
|
||||
|
||||
#### 安装教程
|
||||
|
||||
1. xxxx
|
||||
2. xxxx
|
||||
3. xxxx
|
||||
|
||||
#### 使用说明
|
||||
|
||||
1. xxxx
|
||||
2. xxxx
|
||||
3. xxxx
|
||||
|
||||
#### 参与贡献
|
||||
|
||||
1. Fork 本仓库
|
||||
2. 新建 Feat_xxx 分支
|
||||
3. 提交代码
|
||||
4. 新建 Pull Request
|
||||
|
||||
|
||||
#### 码云特技
|
||||
|
||||
1. 使用 Readme\_XXX.md 来支持不同的语言，例如 Readme\_en.md, Readme\_zh.md
|
||||
2. 码云官方博客 [blog.gitee.com](https://blog.gitee.com)
|
||||
3. 你可以 [https://gitee.com/explore](https://gitee.com/explore) 这个地址来了解码云上的优秀开源项目
|
||||
4. [GVP](https://gitee.com/gvp) 全称是码云最有价值开源项目，是码云综合评定出的优秀开源项目
|
||||
5. 码云官方提供的使用手册 [https://gitee.com/help](https://gitee.com/help)
|
||||
6. 码云封面人物是一档用来展示码云会员风采的栏目 [https://gitee.com/gitee-stars/](https://gitee.com/gitee-stars/)
|
||||
BIN
xstream-distribution-1.4.9-src.zip
Normal file
BIN
xstream-distribution-1.4.9-src.zip
Normal file
Binary file not shown.
108
xstream.spec
Normal file
108
xstream.spec
Normal file
@ -0,0 +1,108 @@
|
||||
Name: xstream
|
||||
Version: 1.4.9
|
||||
Release: 9
|
||||
Summary: A simple library to serialize objects to XML and back again
|
||||
License: BSD
|
||||
URL: http://x-stream.github.io/
|
||||
Source0: https://repo1.maven.org/maven2/com/thoughtworks/%{name}/%{name}-distribution/%{version}/%{name}-distribution-%{version}-src.zip
|
||||
Patch0: 0001-Prevent-deserialization-of-void.patch
|
||||
BuildArch: noarch
|
||||
|
||||
BuildRequires: maven-local, mvn(cglib:cglib), mvn(dom4j:dom4j), mvn(javassist:javassist), mvn(joda-time:joda-time), mvn(org.slf4j:slf4j-simple)
|
||||
BuildRequires: mvn(net.sf.kxml:kxml2), mvn(net.sf.kxml:kxml2-min), mvn(org.apache.felix:maven-bundle-plugin), mvn(stax:stax), mvn(stax:stax-api)
|
||||
BuildRequires: mvn(org.apache.maven.plugins:maven-enforcer-plugin), mvn(org.codehaus.jettison:jettison), mvn(xom:xom), mvn(xpp3:xpp3)
|
||||
BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin), mvn(org.codehaus.woodstox:woodstox-core-asl), mvn(xpp3:xpp3_min)
|
||||
BuildRequires: mvn(org.hibernate:hibernate-core), mvn(org.hibernate:hibernate-envers), mvn(org.jdom:jdom), mvn(org.jdom:jdom2)
|
||||
Provides: %{name}-javadoc%{?_isa} %{name}-javadoc
|
||||
Obsoletes: %{name}-javadoc
|
||||
Provides: %{name}-hibernate%{?_isa} %{name}-hibernate
|
||||
Obsoletes: %{name}-hibernate
|
||||
Provides: %{name}-benchmark%{?_isa} %{name}-benchmark
|
||||
Obsoletes: %{name}-benchmark
|
||||
Provides: %{name}-parent%{?_isa} %{name}-parent
|
||||
Obsoletes: %{name}-parent
|
||||
|
||||
%description
|
||||
XStream is a simple library to serialize objects to XML and back again, which has the following features:
|
||||
Ease of use. A high level facade is supplied that simplifies common use cases.
|
||||
No mappings required. Most objects can be serialized without need for specifying mappings.
|
||||
Performance. Speed and low memory footprint are a crucial part of the design, making it suitable for large
|
||||
object graphs or systems with high message throughput.
|
||||
Clean XML. No information is duplicated that can be obtained via reflection. This results in XML that is
|
||||
easier to read for humans and more compact than native Java serialization.
|
||||
Requires no modifications to objects. Serializes internal fields, including private and final. Supports
|
||||
non-public and inner classes. Classes are not required to have default constructor.
|
||||
Full object graph support. Duplicate references encountered in the object-model will be maintained. Supports
|
||||
circular references.
|
||||
Integrates with other XML APIs. By implementing an interface, XStream can serialize directly to/from any
|
||||
tree structure (not just XML).
|
||||
Customizable conversion strategies. Strategies can be registered allowing customization of how particular
|
||||
types are represented as XML.
|
||||
Security framework. Fine-control about the unmarshalled types to prevent security issues with manipulated input.
|
||||
Error messages. When an exception occurs due to malformed XML, detailed diagnostics are provided to help isolate
|
||||
and fix the problem.
|
||||
Alternative output format. The modular design allows other output formats. XStream ships currently with JSON
|
||||
support and morphing.
|
||||
|
||||
%prep
|
||||
%autosetup -n %{name}-%{version} -p1
|
||||
find . -name "*.jar" -print -delete
|
||||
find . -name "*.class" -print -delete
|
||||
|
||||
%pom_xpath_remove "pom:project/pom:build/pom:extensions"
|
||||
%pom_disable_module xstream-jmh
|
||||
%pom_disable_module xstream-distribution
|
||||
|
||||
%pom_remove_plugin :maven-source-plugin
|
||||
%pom_remove_plugin :maven-eclipse-plugin
|
||||
%pom_remove_plugin :maven-dependency-plugin
|
||||
%pom_remove_plugin :maven-release-plugin
|
||||
%pom_remove_plugin :jxr-maven-plugin
|
||||
%pom_remove_plugin :xsite-maven-plugin
|
||||
|
||||
%pom_xpath_set "pom:dependency[pom:groupId = 'org.codehaus.woodstox' ]/pom:artifactId" \
|
||||
woodstox-core-asl
|
||||
%pom_xpath_set "pom:dependency[pom:groupId = 'org.codehaus.woodstox' ]/pom:artifactId" \
|
||||
woodstox-core-asl xstream
|
||||
%pom_xpath_set "pom:dependency[pom:groupId = 'cglib' ]/pom:artifactId" \
|
||||
cglib
|
||||
%pom_xpath_set "pom:dependency[pom:groupId = 'cglib' ]/pom:artifactId" \
|
||||
cglib xstream
|
||||
|
||||
%pom_change_dep :xmlpull xpp3:xpp3:1.1.4c xstream
|
||||
%pom_remove_plugin :maven-javadoc-plugin xstream
|
||||
%pom_remove_plugin :maven-dependency-plugin xstream
|
||||
%pom_remove_dep javax.activation:activation xstream
|
||||
|
||||
%pom_xpath_set "pom:project/pom:dependencies/pom:dependency[pom:groupId = 'cglib' ]/pom:artifactId" \
|
||||
cglib xstream-hibernate
|
||||
%pom_xpath_inject "pom:project/pom:dependencies/pom:dependency[pom:groupId = 'junit' ]" \
|
||||
"<scope>test</scope>" xstream-hibernate
|
||||
%pom_remove_plugin :maven-dependency-plugin xstream-hibernate
|
||||
%pom_remove_plugin :maven-javadoc-plugin xstream-hibernate
|
||||
|
||||
%pom_xpath_inject "pom:project/pom:dependencies/pom:dependency[pom:groupId = 'junit' ]" \
|
||||
"<scope>test</scope>" xstream-benchmark
|
||||
%pom_remove_plugin :maven-javadoc-plugin xstream-benchmark
|
||||
|
||||
%mvn_file :%{name} %{name}/%{name} %{name}
|
||||
%mvn_file :%{name}-benchmark %{name}/%{name}-benchmark %{name}-benchmark
|
||||
|
||||
%mvn_package :%{name}
|
||||
|
||||
%build
|
||||
%mvn_build -f -s
|
||||
|
||||
%install
|
||||
%mvn_install
|
||||
|
||||
%files -f .mfiles
|
||||
%doc README.txt
|
||||
%license LICENSE.txt
|
||||
%{_javadir}/*
|
||||
%{_javadocdir}/%{name}/*
|
||||
/usr/share/maven*
|
||||
|
||||
%changelog
|
||||
* Mon Dec 9 2019 openEuler Buildteam <buildteam@openeuler.org> - 1.4.9-9
|
||||
- Package init
|
||||
Loading…
x
Reference in New Issue
Block a user