Mercurial > jdk8-mips64-public > nashorn / changeset

     1.1 --- a/src/jdk/nashorn/internal/runtime/Context.java	Fri Feb 14 19:02:02 2014 +0530
     1.2 +++ b/src/jdk/nashorn/internal/runtime/Context.java	Fri Feb 07 18:47:46 2014 +0530
     1.3 @@ -957,7 +957,7 @@
     1.4  
     1.5          final URL          url    = source.getURL();
     1.6          final ScriptLoader loader = env._loader_per_compile ? createNewLoader() : scriptLoader;
     1.7 -        final CodeSource   cs     = url == null ? null : new CodeSource(url, (CodeSigner[])null);
     1.8 +        final CodeSource   cs     = new CodeSource(url, (CodeSigner[])null);
     1.9          final CodeInstaller<ScriptEnvironment> installer = new ContextCodeInstaller(this, loader, cs);
    1.10  
    1.11          final Compiler compiler = new Compiler(installer, strict);

     2.1 --- a/src/jdk/nashorn/internal/runtime/ScriptLoader.java	Fri Feb 14 19:02:02 2014 +0530
     2.2 +++ b/src/jdk/nashorn/internal/runtime/ScriptLoader.java	Fri Feb 07 18:47:46 2014 +0530
     2.3 @@ -70,9 +70,8 @@
     2.4       * @return Installed class.
     2.5       */
     2.6      synchronized Class<?> installClass(final String name, final byte[] data, final CodeSource cs) {
     2.7 -        if (cs == null) {
     2.8 -            return defineClass(name, data, 0, data.length, new ProtectionDomain(null, getPermissions(null)));
     2.9 -        }
    2.10 +        // null check
    2.11 +        cs.getClass();
    2.12          return defineClass(name, data, 0, data.length, cs);
    2.13      }
    2.14  }

     3.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     3.2 +++ b/test/script/sandbox/safeprops.js	Fri Feb 07 18:47:46 2014 +0530
     3.3 @@ -0,0 +1,65 @@
     3.4 +/*
     3.5 + * Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
     3.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     3.7 + *
     3.8 + * This code is free software; you can redistribute it and/or modify it
     3.9 + * under the terms of the GNU General Public License version 2 only, as
    3.10 + * published by the Free Software Foundation.
    3.11 + *
    3.12 + * This code is distributed in the hope that it will be useful, but WITHOUT
    3.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    3.14 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
    3.15 + * version 2 for more details (a copy is included in the LICENSE file that
    3.16 + * accompanied this code).
    3.17 + *
    3.18 + * You should have received a copy of the GNU General Public License version
    3.19 + * 2 along with this work; if not, write to the Free Software Foundation,
    3.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
    3.21 + *
    3.22 + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
    3.23 + * or visit www.oracle.com if you need additional information or have any
    3.24 + * questions.
    3.25 + */
    3.26 +
    3.27 +/**
    3.28 + * Try to access System properties safe to read for any code.
    3.29 + * No security exception expected.
    3.30 + *
    3.31 + * @test
    3.32 + * @security
    3.33 + * @run
    3.34 + * @bug 8033924: Default permissions are not given for eval code
    3.35 + */
    3.36 +
    3.37 +var propNames = [
    3.38 +   "java.version",
    3.39 +   "java.vendor",
    3.40 +   "java.vendor.url",
    3.41 +   "java.class.version",
    3.42 +   "os.name",
    3.43 +   "os.version",
    3.44 +   "os.arch",
    3.45 +   "file.separator",
    3.46 +   "path.separator",
    3.47 +   "line.separator",
    3.48 +   "java.specification.version",
    3.49 +   "java.specification.vendor",
    3.50 +   "java.specification.name",
    3.51 +   "java.vm.specification.version",
    3.52 +   "java.vm.specification.vendor",
    3.53 +   "java.vm.specification.name",
    3.54 +   "java.vm.version",
    3.55 +   "java.vm.vendor",
    3.56 +   "java.vm.name"
    3.57 +];
    3.58 +
    3.59 +// no security exception expected
    3.60 +for (var p in propNames) {
    3.61 +    java.lang.System.getProperty(propNames[p]);
    3.62 +}
    3.63 +
    3.64 +// no security exception expected
    3.65 +for (var p in propNames) {
    3.66 +    var name = propNames[p];
    3.67 +    eval('java.lang.System.getProperty(name)');
    3.68 +}

     4.1 --- a/test/src/jdk/nashorn/api/scripting/ScriptEngineTest.java	Fri Feb 14 19:02:02 2014 +0530
     4.2 +++ b/test/src/jdk/nashorn/api/scripting/ScriptEngineTest.java	Fri Feb 07 18:47:46 2014 +0530
     4.3 @@ -560,6 +560,47 @@
     4.4          assertTrue(reached[0]);
     4.5      }
     4.6  
     4.7 +    // properties that can be read by any code
     4.8 +    private static String[] propNames = {
     4.9 +        "java.version",
    4.10 +        "java.vendor",
    4.11 +        "java.vendor.url",
    4.12 +        "java.class.version",
    4.13 +        "os.name",
    4.14 +        "os.version",
    4.15 +        "os.arch",
    4.16 +        "file.separator",
    4.17 +        "path.separator",
    4.18 +        "line.separator",
    4.19 +        "java.specification.version",
    4.20 +        "java.specification.vendor",
    4.21 +        "java.specification.name",
    4.22 +        "java.vm.specification.version",
    4.23 +        "java.vm.specification.vendor",
    4.24 +        "java.vm.specification.name",
    4.25 +        "java.vm.version",
    4.26 +        "java.vm.vendor",
    4.27 +        "java.vm.name"
    4.28 +    };
    4.29 +
    4.30 +    // @bug 8033924: Default permissions are not given for eval code
    4.31 +    @Test
    4.32 +    public void checkPropertyReadPermissions() throws ScriptException {
    4.33 +        final ScriptEngineManager m = new ScriptEngineManager();
    4.34 +        final ScriptEngine e = m.getEngineByName("nashorn");
    4.35 +
    4.36 +        for (final String name : propNames) {
    4.37 +            checkProperty(e, name);
    4.38 +        }
    4.39 +    }
    4.40 +
    4.41 +    private static void checkProperty(final ScriptEngine e, final String name)
    4.42 +        throws ScriptException {
    4.43 +        String value = System.getProperty(name);
    4.44 +        e.put("name", name);
    4.45 +        assertEquals(value, e.eval("java.lang.System.getProperty(name)"));
    4.46 +    }
    4.47 +
    4.48      private static final String LINE_SEPARATOR = System.getProperty("line.separator");
    4.49  
    4.50      // Returns String that would be the result of calling PrintWriter.println