Fri, 24 Sep 2010 22:42:14 -0700
6891766: Vulnerabilities in use of reflection in CORBA
Reviewed-by: hawtin
1 /*
2 * Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
26 package com.sun.corba.se.impl.orb ;
28 import org.omg.CORBA.INITIALIZE ;
30 import java.util.Properties ;
31 import java.util.List ;
32 import java.util.LinkedList ;
33 import java.util.Iterator ;
35 import java.lang.reflect.Array ;
37 import com.sun.corba.se.spi.orb.Operation ;
38 import com.sun.corba.se.spi.orb.StringPair ;
39 import com.sun.corba.se.spi.logging.CORBALogDomains ;
41 import com.sun.corba.se.impl.orbutil.ObjectUtility ;
42 import com.sun.corba.se.impl.logging.ORBUtilSystemException ;
44 public class PrefixParserAction extends ParserActionBase {
45 private Class componentType ;
46 private ORBUtilSystemException wrapper ;
48 public PrefixParserAction( String propertyName,
49 Operation operation, String fieldName, Class componentType )
50 {
51 super( propertyName, true, operation, fieldName ) ;
52 this.componentType = componentType ;
53 this.wrapper = ORBUtilSystemException.get(
54 CORBALogDomains.ORB_LIFECYCLE ) ;
55 }
57 /** For each String s that matches the prefix given by getPropertyName(),
58 * apply getOperation() to { suffix( s ), value }
59 * and add the result to an Object[]
60 * which forms the result of apply. Returns null if there are no
61 * matches.
62 */
63 public Object apply( Properties props )
64 {
65 String prefix = getPropertyName() ;
66 int prefixLength = prefix.length() ;
67 if (prefix.charAt( prefixLength - 1 ) != '.') {
68 prefix += '.' ;
69 prefixLength++ ;
70 }
72 List matches = new LinkedList() ;
74 // Find all keys in props that start with propertyName
75 Iterator iter = props.keySet().iterator() ;
76 while (iter.hasNext()) {
77 String key = (String)(iter.next()) ;
78 if (key.startsWith( prefix )) {
79 String suffix = key.substring( prefixLength ) ;
80 String value = props.getProperty( key ) ;
81 StringPair data = new StringPair( suffix, value ) ;
82 Object result = getOperation().operate( data ) ;
83 matches.add( result ) ;
84 }
85 }
87 int size = matches.size() ;
88 if (size > 0) {
89 // Convert the list into an array of the proper type.
90 // An Object[] as a result does NOT work. Also report
91 // any errors carefully, as errors here or in parsers that
92 // use this Operation often show up at ORB.init().
93 Object result = null ;
94 try {
95 result = Array.newInstance( componentType, size ) ;
96 } catch (Throwable thr) {
97 throw wrapper.couldNotCreateArray( thr,
98 getPropertyName(), componentType,
99 new Integer( size ) ) ;
100 }
102 Iterator iter2 = matches.iterator() ;
103 int ctr = 0 ;
104 while (iter2.hasNext()) {
105 Object obj = iter2.next() ;
107 try {
108 Array.set( result, ctr, obj ) ;
109 } catch (Throwable thr) {
110 throw wrapper.couldNotSetArray( thr,
111 getPropertyName(), new Integer(ctr),
112 componentType, new Integer(size),
113 obj.toString() ) ;
114 }
115 ctr++ ;
116 }
118 return result ;
119 } else
120 return null ;
121 }
122 }