Fri, 24 Sep 2010 22:42:14 -0700
6891766: Vulnerabilities in use of reflection in CORBA
Reviewed-by: hawtin
1 /*
2 * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25 /*
26 * Licensed Materials - Property of IBM
27 * RMI-IIOP v1.0
28 * Copyright IBM Corp. 1998 1999 All Rights Reserved
29 *
30 */
32 package com.sun.corba.se.impl.orbutil;
34 import javax.rmi.CORBA.Util;
35 import javax.rmi.PortableRemoteObject;
37 import java.util.Hashtable;
38 import java.util.Stack;
39 import java.io.IOException;
40 import java.util.EmptyStackException;
42 import com.sun.corba.se.impl.util.Utility;
43 import com.sun.corba.se.impl.io.IIOPInputStream;
44 import com.sun.corba.se.impl.io.IIOPOutputStream;
45 import com.sun.corba.se.impl.util.RepositoryId;
46 import com.sun.corba.se.impl.util.Utility;
48 import org.omg.CORBA.TCKind;
49 import org.omg.CORBA.MARSHAL;
50 import org.omg.CORBA.CompletionStatus;
51 import org.omg.CORBA.portable.IndirectionException;
52 import com.sun.org.omg.SendingContext.CodeBase;
54 import java.security.AccessController;
55 import java.security.PrivilegedAction;
57 /**
58 * This class overrides behavior of our current ValueHandlerImpl to
59 * provide backwards compatibility with JDK 1.3.0.
60 */
61 public class ValueHandlerImpl_1_3 extends com.sun.corba.se.impl.io.ValueHandlerImpl {
63 public ValueHandlerImpl_1_3(){
64 super();
65 }
67 public ValueHandlerImpl_1_3(boolean isInputStream) {
68 super(isInputStream);
69 }
71 /**
72 * Writes the value to the stream using java semantics.
73 * @param out The stream to write the value to
74 * @param value The value to be written to the stream
75 **/
76 public void writeValue(org.omg.CORBA.portable.OutputStream _out, java.io.Serializable value) {
77 super.writeValue(_out, value);
78 }
80 /**
81 * Reads a value from the stream using java semantics.
82 * @param in The stream to read the value from
83 * @param clazz The type of the value to be read in
84 * @param sender The sending context runtime
85 **/
86 public java.io.Serializable readValue(org.omg.CORBA.portable.InputStream _in,
87 int offset,
88 java.lang.Class clazz,
89 String repositoryID,
90 org.omg.SendingContext.RunTime _sender)
91 {
92 return super.readValue(_in, offset, clazz, repositoryID, _sender);
93 }
95 /**
96 * Returns the repository ID for the given RMI value Class.
97 * @param clz The class to return a repository ID for.
98 * @return the repository ID of the Class.
99 **/
100 public java.lang.String getRMIRepositoryID(java.lang.Class clz) {
101 return RepositoryId_1_3.createForJavaType(clz);
102 }
104 /**
105 * Indicates whether the given Class performs custom or
106 * default marshaling.
107 * @param clz The class to test for custom marshaling.
108 * @return True if the class performs custom marshaling, false
109 * if it does not.
110 **/
111 public boolean isCustomMarshaled(java.lang.Class clz) {
112 return super.isCustomMarshaled(clz);
113 }
115 /**
116 * Returns the CodeBase for this ValueHandler. This is used by
117 * the ORB runtime. The server sends the service context containing
118 * the IOR for this CodeBase on the first GIOP reply. The clients
119 * do the same on the first GIOP request.
120 * @return the SendingContext.CodeBase of this ValueHandler.
121 **/
122 public org.omg.SendingContext.RunTime getRunTimeCodeBase() {
123 return super.getRunTimeCodeBase();
124 }
126 /**
127 * If the value contains a writeReplace method then the result
128 * is returned. Otherwise, the value itself is returned.
129 * @return the true value to marshal on the wire.
130 **/
131 public java.io.Serializable writeReplace(java.io.Serializable value) {
132 return super.writeReplace(value);
133 }
135 // methods supported for backward compatability so that the appropriate
136 // Rep-id calculations take place based on the ORB version
138 /**
139 * Returns a boolean of whether or not RepositoryId indicates
140 * FullValueDescriptor.
141 * used for backward compatability
142 */
144 public boolean useFullValueDescription(Class clazz, String repositoryID)
145 throws IOException
147 {
148 return RepositoryId_1_3.useFullValueDescription(clazz, repositoryID);
149 }
151 public String getClassName(String id)
152 {
153 RepositoryId_1_3 repID = RepositoryId_1_3.cache.getId(id);
154 return repID.getClassName();
155 }
157 public Class getClassFromType(String id)
158 throws ClassNotFoundException
159 {
160 RepositoryId_1_3 repId = RepositoryId_1_3.cache.getId(id);
161 return repId.getClassFromType();
162 }
164 public Class getAnyClassFromType(String id)
165 throws ClassNotFoundException
166 {
167 RepositoryId_1_3 repId = RepositoryId_1_3.cache.getId(id);
168 return repId.getAnyClassFromType();
169 }
171 public String createForAnyType(Class cl)
172 {
173 return RepositoryId_1_3.createForAnyType(cl);
174 }
176 public String getDefinedInId(String id)
177 {
178 RepositoryId_1_3 repId = RepositoryId_1_3.cache.getId(id);
179 return repId.getDefinedInId();
180 }
182 public String getUnqualifiedName(String id)
183 {
184 RepositoryId_1_3 repId = RepositoryId_1_3.cache.getId(id);
185 return repId.getUnqualifiedName();
186 }
188 public String getSerialVersionUID(String id)
189 {
190 RepositoryId_1_3 repId = RepositoryId_1_3.cache.getId(id);
191 return repId.getSerialVersionUID();
192 }
194 public boolean isAbstractBase(Class clazz)
195 {
196 return RepositoryId_1_3.isAbstractBase(clazz);
197 }
199 public boolean isSequence(String id)
200 {
201 RepositoryId_1_3 repId = RepositoryId_1_3.cache.getId(id);
202 return repId.isSequence();
203 }
205 /**
206 * Preserves the incorrect 1.3 behavior which truncates Java chars in
207 * arrays to 8-bit CORBA chars. Bug 4367783. This enables us to
208 * continue interoperating with our legacy ORBs. If this goes into
209 * Ladybird, then Ladybird and Kestrel will interoperate as long as
210 * people don't use chars greater than 8-bits.
211 */
212 protected void writeCharArray(org.omg.CORBA_2_3.portable.OutputStream out,
213 char[] array,
214 int offset,
215 int length)
216 {
217 out.write_char_array(array, offset, length);
218 }
220 /**
221 * Preserves the incorrect 1.3 behavior which truncates Java chars in
222 * arrays to 8-bit CORBA chars. Bug 4367783. This enables us to
223 * continue interoperating with our legacy ORBs. If this goes into
224 * Ladybird, then Ladybird and Kestrel will interoperate as long as
225 * people don't use chars greater than 8-bits.
226 */
227 protected void readCharArray(org.omg.CORBA_2_3.portable.InputStream in,
228 char[] array,
229 int offset,
230 int length)
231 {
232 in.read_char_array(array, offset, length);
233 }
235 protected final String getOutputStreamClassName() {
236 return "com.sun.corba.se.impl.orbutil.IIOPOutputStream_1_3";
237 }
239 protected final String getInputStreamClassName() {
240 return "com.sun.corba.se.impl.orbutil.IIOPInputStream_1_3";
241 }
243 /**
244 * Our JDK 1.3 and JDK 1.3.1 behavior subclasses override this.
245 * The correct behavior is for a Java char to map to a CORBA wchar,
246 * but our older code mapped it to a CORBA char.
247 */
248 protected TCKind getJavaCharTCKind() {
249 return TCKind.tk_char;
250 }
251 }