From 454348715467e9c62f301ea5b42e0aa1182f1405 Mon Sep 17 00:00:00 2001 From: Chris Frohoff Date: Mon, 26 Nov 2018 06:54:00 -0800 Subject: [PATCH 1/3] assembly to include tests in jar --- assembly.xml | 28 ++++ pom.xml | 13 +- src/main/java/ysoserial/payloads/C3P0.java | 2 +- .../payloads/CommonsCollections5.java | 1 - .../java/ysoserial/payloads/FileUpload1.java | 2 +- .../java/ysoserial/payloads/Hibernate2.java | 2 +- .../java/ysoserial/payloads/JRMPClient.java | 2 +- .../java/ysoserial/payloads/Myfaces2.java | 2 +- src/main/java/ysoserial/payloads/Wicket1.java | 2 +- .../{ => test}/CustomDeserializer.java | 4 +- .../{ => test}/CustomPayloadArgs.java | 6 +- .../java/ysoserial/{ => test}/CustomTest.java | 2 +- .../ysoserial/{ => test}/WrappedTest.java | 4 +- .../exploit/RMIRegistryExploitTest.java | 2 +- .../{ => test}/payloads/CommandExecTest.java | 8 +- .../{ => test}/payloads/FileUploadTest.java | 6 +- .../payloads/JRMPReverseConnectSMTest.java | 16 +-- .../payloads/JRMPReverseConnectTest.java | 6 +- .../{ => test}/payloads/MyfacesTest.java | 24 ++-- .../{ => test}/payloads/PayloadsTest.java | 121 +++++++++++++++--- .../payloads/RemoteClassLoadingTest.java | 10 +- .../{ => test}/payloads/TestHarnessTest.java | 3 +- .../ysoserial/{ => test}/util/Callables.java | 2 +- .../java/ysoserial/{ => test}/util/Files.java | 2 +- .../java/ysoserial/{ => test}/util/OS.java | 2 +- .../ysoserial/{ => test}/util/Throwables.java | 2 +- 26 files changed, 197 insertions(+), 77 deletions(-) create mode 100644 assembly.xml rename src/test/java/ysoserial/{ => test}/CustomDeserializer.java (82%) rename src/test/java/ysoserial/{ => test}/CustomPayloadArgs.java (78%) rename src/test/java/ysoserial/{ => test}/CustomTest.java (88%) rename src/test/java/ysoserial/{ => test}/WrappedTest.java (89%) rename src/test/java/ysoserial/{ => test}/exploit/RMIRegistryExploitTest.java (94%) rename src/test/java/ysoserial/{ => test}/payloads/CommandExecTest.java (89%) rename src/test/java/ysoserial/{ => test}/payloads/FileUploadTest.java (95%) rename src/test/java/ysoserial/{ => test}/payloads/JRMPReverseConnectSMTest.java (88%) rename src/test/java/ysoserial/{ => test}/payloads/JRMPReverseConnectTest.java (93%) rename src/test/java/ysoserial/{ => test}/payloads/MyfacesTest.java (97%) rename src/test/java/ysoserial/{ => test}/payloads/PayloadsTest.java (67%) rename src/test/java/ysoserial/{ => test}/payloads/RemoteClassLoadingTest.java (97%) rename src/test/java/ysoserial/{ => test}/payloads/TestHarnessTest.java (96%) rename src/test/java/ysoserial/{ => test}/util/Callables.java (96%) rename src/test/java/ysoserial/{ => test}/util/Files.java (91%) rename src/test/java/ysoserial/{ => test}/util/OS.java (95%) rename src/test/java/ysoserial/{ => test}/util/Throwables.java (87%) diff --git a/assembly.xml b/assembly.xml new file mode 100644 index 0000000..8320b9a --- /dev/null +++ b/assembly.xml @@ -0,0 +1,28 @@ + + fat-tests + + jar + + false + + + / + true + true + test + + + + + ${project.build.directory}/test-classes + / + + **/*.class + + true + + + diff --git a/pom.xml b/pom.xml index b2cf1b0..15278be 100644 --- a/pom.xml +++ b/pom.xml @@ -39,10 +39,8 @@ ysoserial.GeneratePayload - - jar-with-dependencies - - + assembly.xml + make-assembly @@ -115,7 +113,7 @@ org.jboss.shrinkwrap.resolver shrinkwrap-resolver-depchain - 2.1.1 + 2.2.6 pom @@ -303,6 +301,11 @@ slf4j-api 1.7.21 + + org.slf4j + slf4j-jdk14 + 1.7.21 + org.clojure clojure diff --git a/src/main/java/ysoserial/payloads/C3P0.java b/src/main/java/ysoserial/payloads/C3P0.java index 3b2d290..3b673eb 100644 --- a/src/main/java/ysoserial/payloads/C3P0.java +++ b/src/main/java/ysoserial/payloads/C3P0.java @@ -38,7 +38,7 @@ import ysoserial.payloads.util.Reflections; * @author mbechler * */ -@PayloadTest ( harness = "ysoserial.payloads.RemoteClassLoadingTest" ) +@PayloadTest ( harness="ysoserial.test.payloads.RemoteClassLoadingTest" ) @Dependencies( { "com.mchange:c3p0:0.9.5.2" ,"com.mchange:mchange-commons-java:0.2.11"} ) @Authors({ Authors.MBECHLER }) public class C3P0 implements ObjectPayload { diff --git a/src/main/java/ysoserial/payloads/CommonsCollections5.java b/src/main/java/ysoserial/payloads/CommonsCollections5.java index bc322d6..652a413 100644 --- a/src/main/java/ysoserial/payloads/CommonsCollections5.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections5.java @@ -49,7 +49,6 @@ This only works in JDK 8u76 and WITHOUT a security manager https://github.com/JetBrains/jdk8u_jdk/commit/af2361ee2878302012214299036b3a8b4ed36974#diff-f89b1641c408b60efe29ee513b3d22ffR70 */ -//@PayloadTest(skip="need more robust way to detect Runtime.exec() without SecurityManager()") @SuppressWarnings({"rawtypes", "unchecked"}) @PayloadTest ( precondition = "isApplicableJavaVersion") @Dependencies({"commons-collections:commons-collections:3.1"}) diff --git a/src/main/java/ysoserial/payloads/FileUpload1.java b/src/main/java/ysoserial/payloads/FileUpload1.java index df21a29..3d14bbb 100644 --- a/src/main/java/ysoserial/payloads/FileUpload1.java +++ b/src/main/java/ysoserial/payloads/FileUpload1.java @@ -41,7 +41,7 @@ import ysoserial.payloads.util.Reflections; "commons-fileupload:commons-fileupload:1.3.1", "commons-io:commons-io:2.4" } ) -@PayloadTest(harness="ysoserial.payloads.FileUploadTest", precondition = "isApplicableJavaVersion") +@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion") @Authors({ Authors.MBECHLER }) public class FileUpload1 implements ReleaseableObjectPayload { public static boolean isApplicableJavaVersion() { diff --git a/src/main/java/ysoserial/payloads/Hibernate2.java b/src/main/java/ysoserial/payloads/Hibernate2.java index 455cee6..96d4488 100644 --- a/src/main/java/ysoserial/payloads/Hibernate2.java +++ b/src/main/java/ysoserial/payloads/Hibernate2.java @@ -42,7 +42,7 @@ import com.sun.rowset.JdbcRowSetImpl; @SuppressWarnings ( { "restriction" } ) -@PayloadTest(harness = "ysoserial.payloads.JRMPReverseConnectTest", precondition = "isApplicableJavaVersion") +@PayloadTest(harness="ysoserial.test.payloads.JRMPReverseConnectTest", precondition = "isApplicableJavaVersion") @Authors({ Authors.MBECHLER }) public class Hibernate2 implements ObjectPayload, DynamicDependencies { public static boolean isApplicableJavaVersion() { diff --git a/src/main/java/ysoserial/payloads/JRMPClient.java b/src/main/java/ysoserial/payloads/JRMPClient.java index 41bf0f8..d477beb 100644 --- a/src/main/java/ysoserial/payloads/JRMPClient.java +++ b/src/main/java/ysoserial/payloads/JRMPClient.java @@ -49,7 +49,7 @@ import ysoserial.payloads.util.PayloadRunner; @SuppressWarnings ( { "restriction" } ) -@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest") +@PayloadTest( harness="ysoserial.test.payloads.JRMPReverseConnectSMTest") @Authors({ Authors.MBECHLER }) public class JRMPClient extends PayloadRunner implements ObjectPayload { diff --git a/src/main/java/ysoserial/payloads/Myfaces2.java b/src/main/java/ysoserial/payloads/Myfaces2.java index 72c828e..57668e9 100644 --- a/src/main/java/ysoserial/payloads/Myfaces2.java +++ b/src/main/java/ysoserial/payloads/Myfaces2.java @@ -29,7 +29,7 @@ import ysoserial.payloads.util.PayloadRunner; * * @author mbechler */ -@PayloadTest(harness = "ysoserial.payloads.MyfacesTest", precondition = "isApplicableJavaVersion") +@PayloadTest(harness="ysoserial.test.payloads.MyfacesTest", precondition = "isApplicableJavaVersion") @Authors({ Authors.MBECHLER }) public class Myfaces2 implements ObjectPayload, DynamicDependencies { public static boolean isApplicableJavaVersion() { diff --git a/src/main/java/ysoserial/payloads/Wicket1.java b/src/main/java/ysoserial/payloads/Wicket1.java index 29e5d9b..d1100b2 100644 --- a/src/main/java/ysoserial/payloads/Wicket1.java +++ b/src/main/java/ysoserial/payloads/Wicket1.java @@ -46,7 +46,7 @@ import ysoserial.payloads.util.Reflections; * $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp * blue lobster */ -@PayloadTest(harness = "ysoserial.payloads.FileUploadTest", flaky="possible race condition") +@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", flaky="possible race condition") @Dependencies({"org.apache.wicket:wicket-util:6.23.0", "org.slf4j:slf4j-api:1.6.4"}) @Authors({ Authors.JACOBAINES }) public class Wicket1 implements ReleaseableObjectPayload { diff --git a/src/test/java/ysoserial/CustomDeserializer.java b/src/test/java/ysoserial/test/CustomDeserializer.java similarity index 82% rename from src/test/java/ysoserial/CustomDeserializer.java rename to src/test/java/ysoserial/test/CustomDeserializer.java index 67e212f..e37fa27 100644 --- a/src/test/java/ysoserial/CustomDeserializer.java +++ b/src/test/java/ysoserial/test/CustomDeserializer.java @@ -1,4 +1,4 @@ -package ysoserial; +package ysoserial.test; /** @@ -7,7 +7,7 @@ package ysoserial; */ public interface CustomDeserializer { - + Class getCustomDeserializer (); } diff --git a/src/test/java/ysoserial/CustomPayloadArgs.java b/src/test/java/ysoserial/test/CustomPayloadArgs.java similarity index 78% rename from src/test/java/ysoserial/CustomPayloadArgs.java rename to src/test/java/ysoserial/test/CustomPayloadArgs.java index b78e6af..e43f25d 100644 --- a/src/test/java/ysoserial/CustomPayloadArgs.java +++ b/src/test/java/ysoserial/test/CustomPayloadArgs.java @@ -1,4 +1,4 @@ -package ysoserial; +package ysoserial.test; /** @@ -7,7 +7,7 @@ package ysoserial; */ public interface CustomPayloadArgs { - + String getPayloadArgs (); - + } diff --git a/src/test/java/ysoserial/CustomTest.java b/src/test/java/ysoserial/test/CustomTest.java similarity index 88% rename from src/test/java/ysoserial/CustomTest.java rename to src/test/java/ysoserial/test/CustomTest.java index c3fac94..c894346 100644 --- a/src/test/java/ysoserial/CustomTest.java +++ b/src/test/java/ysoserial/test/CustomTest.java @@ -1,4 +1,4 @@ -package ysoserial; +package ysoserial.test; import java.util.concurrent.Callable; diff --git a/src/test/java/ysoserial/WrappedTest.java b/src/test/java/ysoserial/test/WrappedTest.java similarity index 89% rename from src/test/java/ysoserial/WrappedTest.java rename to src/test/java/ysoserial/test/WrappedTest.java index 7abce37..9213066 100644 --- a/src/test/java/ysoserial/WrappedTest.java +++ b/src/test/java/ysoserial/test/WrappedTest.java @@ -1,4 +1,4 @@ -package ysoserial; +package ysoserial.test; import java.util.concurrent.Callable; @@ -9,5 +9,5 @@ import java.util.concurrent.Callable; public interface WrappedTest extends CustomPayloadArgs { Callable createCallable ( Callable innerCallable ); - + } diff --git a/src/test/java/ysoserial/exploit/RMIRegistryExploitTest.java b/src/test/java/ysoserial/test/exploit/RMIRegistryExploitTest.java similarity index 94% rename from src/test/java/ysoserial/exploit/RMIRegistryExploitTest.java rename to src/test/java/ysoserial/test/exploit/RMIRegistryExploitTest.java index 8b90f19..4c51163 100755 --- a/src/test/java/ysoserial/exploit/RMIRegistryExploitTest.java +++ b/src/test/java/ysoserial/test/exploit/RMIRegistryExploitTest.java @@ -1,4 +1,4 @@ -package ysoserial.exploit; +package ysoserial.test.exploit; import java.rmi.RemoteException; import java.rmi.registry.LocateRegistry; diff --git a/src/test/java/ysoserial/payloads/CommandExecTest.java b/src/test/java/ysoserial/test/payloads/CommandExecTest.java similarity index 89% rename from src/test/java/ysoserial/payloads/CommandExecTest.java rename to src/test/java/ysoserial/test/payloads/CommandExecTest.java index b0dc051..50b44b5 100644 --- a/src/test/java/ysoserial/payloads/CommandExecTest.java +++ b/src/test/java/ysoserial/test/payloads/CommandExecTest.java @@ -1,9 +1,9 @@ -package ysoserial.payloads; +package ysoserial.test.payloads; import org.junit.Assert; -import ysoserial.CustomTest; -import ysoserial.util.Files; -import ysoserial.util.OS; +import ysoserial.test.CustomTest; +import ysoserial.test.util.Files; +import ysoserial.test.util.OS; import java.io.File; import java.util.UUID; diff --git a/src/test/java/ysoserial/payloads/FileUploadTest.java b/src/test/java/ysoserial/test/payloads/FileUploadTest.java similarity index 95% rename from src/test/java/ysoserial/payloads/FileUploadTest.java rename to src/test/java/ysoserial/test/payloads/FileUploadTest.java index ee186ec..7701cb0 100644 --- a/src/test/java/ysoserial/payloads/FileUploadTest.java +++ b/src/test/java/ysoserial/test/payloads/FileUploadTest.java @@ -1,4 +1,4 @@ -package ysoserial.payloads; +package ysoserial.test.payloads; import java.io.File; import java.io.IOException; @@ -9,8 +9,8 @@ import org.junit.Assert; import com.google.common.io.Files; -import ysoserial.CustomTest; -import ysoserial.util.OS; +import ysoserial.test.CustomTest; +import ysoserial.test.util.OS; /** * @author mbechler diff --git a/src/test/java/ysoserial/payloads/JRMPReverseConnectSMTest.java b/src/test/java/ysoserial/test/payloads/JRMPReverseConnectSMTest.java similarity index 88% rename from src/test/java/ysoserial/payloads/JRMPReverseConnectSMTest.java rename to src/test/java/ysoserial/test/payloads/JRMPReverseConnectSMTest.java index fb60bbc..f8846ae 100644 --- a/src/test/java/ysoserial/payloads/JRMPReverseConnectSMTest.java +++ b/src/test/java/ysoserial/test/payloads/JRMPReverseConnectSMTest.java @@ -1,10 +1,10 @@ -package ysoserial.payloads; +package ysoserial.test.payloads; import java.net.URL; import java.util.concurrent.Callable; -import ysoserial.WrappedTest; +import ysoserial.test.WrappedTest; import ysoserial.exploit.JRMPListener; @@ -22,15 +22,15 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements // some payloads cannot specify the port jrmpPort = 1099; } - - + + /** * {@inheritDoc} * - * @see ysoserial.payloads.RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable) + * @see RemoteClassLoadingTest#createCallable(java.util.concurrent.Callable) */ @Override public Callable createCallable ( final Callable innerCallable ) { @@ -58,7 +58,7 @@ public class JRMPReverseConnectSMTest extends RemoteClassLoadingTest implements return "localhost:" + jrmpPort; } - - - + + + } diff --git a/src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java b/src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java similarity index 93% rename from src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java rename to src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java index 577a7b3..a1523af 100644 --- a/src/test/java/ysoserial/payloads/JRMPReverseConnectTest.java +++ b/src/test/java/ysoserial/test/payloads/JRMPReverseConnectTest.java @@ -1,4 +1,4 @@ -package ysoserial.payloads; +package ysoserial.test.payloads; import java.util.concurrent.Callable; @@ -7,7 +7,7 @@ import javax.management.BadAttributeValueExpException; import org.junit.Assert; -import ysoserial.CustomTest; +import ysoserial.test.CustomTest; import ysoserial.exploit.JRMPListener; @@ -21,7 +21,7 @@ public class JRMPReverseConnectTest implements CustomTest { /** - * + * */ public JRMPReverseConnectTest () { // some payloads cannot specify the port diff --git a/src/test/java/ysoserial/payloads/MyfacesTest.java b/src/test/java/ysoserial/test/payloads/MyfacesTest.java similarity index 97% rename from src/test/java/ysoserial/payloads/MyfacesTest.java rename to src/test/java/ysoserial/test/payloads/MyfacesTest.java index 817e549..4d439d7 100644 --- a/src/test/java/ysoserial/payloads/MyfacesTest.java +++ b/src/test/java/ysoserial/test/payloads/MyfacesTest.java @@ -1,4 +1,4 @@ -package ysoserial.payloads; +package ysoserial.test.payloads; import java.beans.FeatureDescriptor; @@ -23,7 +23,7 @@ import org.mockito.Mockito; import org.mockito.invocation.InvocationOnMock; import org.mockito.stubbing.Answer; -import ysoserial.CustomDeserializer; +import ysoserial.test.CustomDeserializer; import ysoserial.Deserializer; @@ -46,7 +46,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria /** * need to use a custom deserializer so that the faces context gets set in the isolated class - * + * * @author mbechler * */ @@ -79,10 +79,10 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria private static class MockELResolver extends ELResolver { - + private ServletRequest request; - - + + public MockELResolver (ServletRequest req) { this.request = req; } @@ -94,7 +94,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria context.setPropertyResolved(true); return this.request; } - + return null; } @@ -108,10 +108,10 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria return null; } - + @Override public void setValue ( ELContext context, Object base, Object property, Object value ) { - + } @@ -126,14 +126,14 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria return null; } - + @Override public Class getCommonPropertyType ( ELContext context, Object base ) { return null; } - + } - + public MyfacesDeserializer ( byte[] bytes ) { super(bytes); } diff --git a/src/test/java/ysoserial/payloads/PayloadsTest.java b/src/test/java/ysoserial/test/payloads/PayloadsTest.java similarity index 67% rename from src/test/java/ysoserial/payloads/PayloadsTest.java rename to src/test/java/ysoserial/test/payloads/PayloadsTest.java index 8613c5f..b71c14a 100644 --- a/src/test/java/ysoserial/payloads/PayloadsTest.java +++ b/src/test/java/ysoserial/test/payloads/PayloadsTest.java @@ -1,32 +1,44 @@ -package ysoserial.payloads; +package ysoserial.test.payloads; +import java.io.ByteArrayOutputStream; import java.io.File; +import java.io.PrintStream; import java.lang.reflect.InvocationTargetException; import java.lang.reflect.Method; import java.net.URL; import java.net.URLClassLoader; import java.util.Arrays; +import java.util.HashMap; +import java.util.Map; import java.util.Set; import java.util.concurrent.Callable; import org.jboss.shrinkwrap.resolver.api.maven.Maven; -import org.junit.Assert; import org.junit.Assume; import org.junit.Test; +import org.junit.internal.TextListener; +import org.junit.runner.Description; +import org.junit.runner.JUnitCore; +import org.junit.runner.Result; import org.junit.runner.RunWith; +import org.junit.runner.notification.Failure; +import org.junit.runner.notification.RunListener; import org.junit.runners.Parameterized; import org.junit.runners.Parameterized.Parameters; import ysoserial.*; -import ysoserial.util.Throwables; -import ysoserial.payloads.TestHarnessTest.ExecMockPayload; -import ysoserial.payloads.TestHarnessTest.NoopMockPayload; +import ysoserial.payloads.DynamicDependencies; +import ysoserial.payloads.ObjectPayload; +import ysoserial.test.CustomTest; +import ysoserial.test.CustomDeserializer; +import ysoserial.test.CustomPayloadArgs; +import ysoserial.test.WrappedTest; +import ysoserial.test.payloads.TestHarnessTest.ExecMockPayload; +import ysoserial.test.payloads.TestHarnessTest.NoopMockPayload; import ysoserial.payloads.annotation.Dependencies; import ysoserial.payloads.annotation.PayloadTest; import ysoserial.payloads.util.ClassFiles; -import ysoserial.secmgr.ExecCheckingSecurityManager; -import ysoserial.secmgr.ExecCheckingSecurityManager.ExecException; /* @@ -65,18 +77,22 @@ public class PayloadsTest { public static void testPayload ( final Class> payloadClass, final Class[] addlClassesForClassLoader ) throws Exception { + System.out.println("Testing payload: " + payloadClass.getName()); + String command = "hostname"; PayloadTest t = payloadClass.getAnnotation(PayloadTest.class); int tries = 1; if ( t != null ) { - if ( !t.skip().isEmpty() ) { - Assume.assumeTrue(t.skip(), false); - } + if (System.getProperty("forceTests") == null) { + if ( !t.skip().isEmpty() ) { + Assume.assumeTrue(t.skip(), false); + } - if ( !t.precondition().isEmpty() ) { - Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition())); + if ( !t.precondition().isEmpty() ) { + Assume.assumeTrue("Precondition: " + t.precondition(), checkPrecondition(payloadClass, t.precondition())); + } } if (! t.flaky().isEmpty()) { @@ -99,18 +115,18 @@ public class PayloadsTest { testHarness = new CommandExecTest(); // default } - if ( testHarness instanceof CustomPayloadArgs ) { + if ( testHarness instanceof CustomPayloadArgs) { payloadCommand = ( (CustomPayloadArgs) testHarness ).getPayloadArgs(); } - if ( testHarness instanceof CustomDeserializer ) { + if ( testHarness instanceof CustomDeserializer) { customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer(); } // TODO per-thread secmgr to enforce no detonation during deserialization final byte[] serialized = makeSerializeCallable(payloadClass, payloadCommand).call(); Callable callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer); - if ( testHarness instanceof WrappedTest ) { + if ( testHarness instanceof WrappedTest) { callable = ( (WrappedTest) testHarness ).createCallable(callable); } @@ -184,7 +200,12 @@ public class PayloadsTest { static Object deserializeWithDependencies ( byte[] serialized, final String[] dependencies, final Class[] classDependencies, final Class customDeserializer ) throws Exception { - File[] jars = dependencies.length > 0 ? Maven.resolver().resolve(dependencies).withoutTransitivity().asFile() : new File[0]; + File[] jars = dependencies.length > 0 + ? Maven.configureResolver() + .withMavenCentralRepo(true) + .withRemoteRepo("jenkins", "http://repo.jenkins-ci.org/public/", "default") + .resolve(dependencies).withoutTransitivity().asFile() + : new File[0]; URL[] urls = new URL[jars.length]; for ( int i = 0; i < jars.length; i++ ) { urls[ i ] = jars[ i ].toURI().toURL(); @@ -230,4 +251,72 @@ public class PayloadsTest { Thread.currentThread().setContextClassLoader(ccl); } } + + public static void main(String[] args) { + JUnitCore junit = new JUnitCore(); + PayloadListener listener = new PayloadListener(); + junit.addListener(listener); + Result result = junit.run(PayloadsTest.class); + System.exit(result.wasSuccessful() ? 0 : 1); + } + + public static class PayloadListener extends RunListener { + private static PrintStream realOut = System.out; + private static PrintStream realErr = System.err; + + private Map outs = new HashMap(); + //private Map errs = new HashMap(); + + @Override + public void testStarted(Description description) throws Exception { + ByteArrayOutputStream out = new ByteArrayOutputStream(); + //ByteArrayOutputStream err = new ByteArrayOutputStream(); + + outs.put(description, out); + //errs.put(description, err); + + setStreams(new PrintStream(out), new PrintStream(out)); + //System.setErr(new PrintStream((err))); + } + + @Override + public void testFinished(Description description) throws Exception { + outs.get(description).close(); + //errs.get(description).close(); + + restoreStreams(); + } + + private void restoreStreams() { + setStreams(realOut, realErr); + } + + private void setStreams(PrintStream realOut, PrintStream realErr) { + System.setOut(realOut); + System.setErr(realErr); + } + + @Override + public void testFailure(Failure failure) throws Exception { + restoreStreams(); + System.out.println(failure.getDescription().getDisplayName() + ": TEST-FAILED"); + System.err.println(outs.get(failure.getDescription()).toString()); + } + + @Override + public void testAssumptionFailure(Failure failure) { + restoreStreams(); + System.out.println(failure.getDescription().getDisplayName() + ": ASSUMPTION-FAILED"); + } + + @Override + public void testIgnored(Description description) throws Exception { + restoreStreams(); + System.out.println(description.getDisplayName() + ": TEST-IGNORED"); + } + + + } + + } diff --git a/src/test/java/ysoserial/payloads/RemoteClassLoadingTest.java b/src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java similarity index 97% rename from src/test/java/ysoserial/payloads/RemoteClassLoadingTest.java rename to src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java index 0e83b62..8dd1604 100644 --- a/src/test/java/ysoserial/payloads/RemoteClassLoadingTest.java +++ b/src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java @@ -1,4 +1,4 @@ -package ysoserial.payloads; +package ysoserial.test.payloads; import java.io.ByteArrayInputStream; @@ -12,7 +12,7 @@ import fi.iki.elonen.NanoHTTPD.Response.Status; import javassist.ClassClassPath; import javassist.ClassPool; import javassist.CtClass; -import ysoserial.WrappedTest; +import ysoserial.test.WrappedTest; /** @@ -76,8 +76,8 @@ public class RemoteClassLoadingTest implements WrappedTest { this.innerCallable = innerCallable; } - - + + public void waitFor() throws InterruptedException { synchronized ( this.waitLock ) { this.waitLock.wait(1000); @@ -121,7 +121,7 @@ public class RemoteClassLoadingTest implements WrappedTest { } - + public static class Exploit implements Serializable { diff --git a/src/test/java/ysoserial/payloads/TestHarnessTest.java b/src/test/java/ysoserial/test/payloads/TestHarnessTest.java similarity index 96% rename from src/test/java/ysoserial/payloads/TestHarnessTest.java rename to src/test/java/ysoserial/test/payloads/TestHarnessTest.java index 09df5dc..7a5be42 100755 --- a/src/test/java/ysoserial/payloads/TestHarnessTest.java +++ b/src/test/java/ysoserial/test/payloads/TestHarnessTest.java @@ -1,4 +1,4 @@ -package ysoserial.payloads; +package ysoserial.test.payloads; import java.io.IOException; import java.io.ObjectInputStream; @@ -7,6 +7,7 @@ import java.io.Serializable; import org.hamcrest.CoreMatchers; import org.junit.Assert; import org.junit.Test; +import ysoserial.payloads.ObjectPayload; public class TestHarnessTest { // make sure test harness fails properly diff --git a/src/test/java/ysoserial/util/Callables.java b/src/test/java/ysoserial/test/util/Callables.java similarity index 96% rename from src/test/java/ysoserial/util/Callables.java rename to src/test/java/ysoserial/test/util/Callables.java index af61d1f..8ea73e2 100644 --- a/src/test/java/ysoserial/util/Callables.java +++ b/src/test/java/ysoserial/test/util/Callables.java @@ -1,4 +1,4 @@ -package ysoserial.util; +package ysoserial.test.util; import java.util.concurrent.Callable; diff --git a/src/test/java/ysoserial/util/Files.java b/src/test/java/ysoserial/test/util/Files.java similarity index 91% rename from src/test/java/ysoserial/util/Files.java rename to src/test/java/ysoserial/test/util/Files.java index e8227e8..b1b44f0 100644 --- a/src/test/java/ysoserial/util/Files.java +++ b/src/test/java/ysoserial/test/util/Files.java @@ -1,4 +1,4 @@ -package ysoserial.util; +package ysoserial.test.util; import java.io.File; diff --git a/src/test/java/ysoserial/util/OS.java b/src/test/java/ysoserial/test/util/OS.java similarity index 95% rename from src/test/java/ysoserial/util/OS.java rename to src/test/java/ysoserial/test/util/OS.java index bfcdc0d..033745a 100644 --- a/src/test/java/ysoserial/util/OS.java +++ b/src/test/java/ysoserial/test/util/OS.java @@ -1,4 +1,4 @@ -package ysoserial.util; +package ysoserial.test.util; public enum OS { WINDOWS, diff --git a/src/test/java/ysoserial/util/Throwables.java b/src/test/java/ysoserial/test/util/Throwables.java similarity index 87% rename from src/test/java/ysoserial/util/Throwables.java rename to src/test/java/ysoserial/test/util/Throwables.java index c90f050..964a907 100644 --- a/src/test/java/ysoserial/util/Throwables.java +++ b/src/test/java/ysoserial/test/util/Throwables.java @@ -1,4 +1,4 @@ -package ysoserial.util; +package ysoserial.test.util; public class Throwables { public static Throwable getInnermostCause(final Throwable t) { From 7adb3cfe638228ae0bd2baf7584dc7d3f2831f17 Mon Sep 17 00:00:00 2001 From: Chris Frohoff Date: Fri, 30 Nov 2018 17:18:18 -0800 Subject: [PATCH 2/3] refactors --- .../ysoserial/test/payloads/PayloadsTest.java | 80 ++++++++++++------- 1 file changed, 50 insertions(+), 30 deletions(-) diff --git a/src/test/java/ysoserial/test/payloads/PayloadsTest.java b/src/test/java/ysoserial/test/payloads/PayloadsTest.java index b71c14a..53e6bcd 100644 --- a/src/test/java/ysoserial/test/payloads/PayloadsTest.java +++ b/src/test/java/ysoserial/test/payloads/PayloadsTest.java @@ -3,6 +3,7 @@ package ysoserial.test.payloads; import java.io.ByteArrayOutputStream; import java.io.File; +import java.io.OutputStream; import java.io.PrintStream; import java.lang.reflect.InvocationTargetException; import java.lang.reflect.Method; @@ -17,7 +18,6 @@ import java.util.concurrent.Callable; import org.jboss.shrinkwrap.resolver.api.maven.Maven; import org.junit.Assume; import org.junit.Test; -import org.junit.internal.TextListener; import org.junit.runner.Description; import org.junit.runner.JUnitCore; import org.junit.runner.Result; @@ -253,6 +253,7 @@ public class PayloadsTest { } public static void main(String[] args) { + JUnitCore junit = new JUnitCore(); PayloadListener listener = new PayloadListener(); junit.addListener(listener); @@ -260,23 +261,53 @@ public class PayloadsTest { System.exit(result.wasSuccessful() ? 0 : 1); } + public static class StdIo { + + private static final PrintStream realOut = System.out; + private static final PrintStream realErr = System.err; + + public static void restoreStreams() { + setStreams(realOut, realErr); + } + + public static void setStreams(PrintStream out, PrintStream err) { + System.setOut(out); + System.setErr(err); + } + + public static void setStreams(OutputStream out, OutputStream err) { + setStreams(new PrintStream(out), new PrintStream(err)); + } + } + public static class PayloadListener extends RunListener { - private static PrintStream realOut = System.out; - private static PrintStream realErr = System.err; + public enum Status { + SUCCESS, + FAILURE, + IGNORE, + ASSUMPTION_FAILURE + } private Map outs = new HashMap(); - //private Map errs = new HashMap(); + private Map errs = new HashMap(); + + private Map statuses = new HashMap(); + + private Map failures = new HashMap(); @Override public void testStarted(Description description) throws Exception { + System.out.println(getPayload(description.getDisplayName()) + ": STARTED"); + + statuses.put(description, Status.SUCCESS); + ByteArrayOutputStream out = new ByteArrayOutputStream(); - //ByteArrayOutputStream err = new ByteArrayOutputStream(); +// ByteArrayOutputStream err = new ByteArrayOutputStream(); outs.put(description, out); - //errs.put(description, err); +// errs.put(description, err); - setStreams(new PrintStream(out), new PrintStream(out)); - //System.setErr(new PrintStream((err))); + StdIo.setStreams(out, out); } @Override @@ -284,39 +315,28 @@ public class PayloadsTest { outs.get(description).close(); //errs.get(description).close(); - restoreStreams(); - } + StdIo.restoreStreams(); - private void restoreStreams() { - setStreams(realOut, realErr); - } - - private void setStreams(PrintStream realOut, PrintStream realErr) { - System.setOut(realOut); - System.setErr(realErr); + Status status = statuses.get(description); + System.out.println(getPayload(description.getDisplayName()) + ": " + status); + if (status == Status.FAILURE) System.err.println(outs.get(description).toString()); } @Override public void testFailure(Failure failure) throws Exception { - restoreStreams(); - System.out.println(failure.getDescription().getDisplayName() + ": TEST-FAILED"); - System.err.println(outs.get(failure.getDescription()).toString()); + statuses.put(failure.getDescription(), Status.FAILURE); + failures.put(failure.getDescription(), failure); } @Override public void testAssumptionFailure(Failure failure) { - restoreStreams(); - System.out.println(failure.getDescription().getDisplayName() + ": ASSUMPTION-FAILED"); + statuses.put(failure.getDescription(), Status.ASSUMPTION_FAILURE); + failures.put(failure.getDescription(), failure); } - @Override - public void testIgnored(Description description) throws Exception { - restoreStreams(); - System.out.println(description.getDisplayName() + ": TEST-IGNORED"); + // testPayload[payloadClass: class ysoserial.payloads.JavassistWeld1](ysoserial.test.payloads.PayloadsTest) + public static String getPayload(String displayName) { + return displayName.replaceAll(".*\\[\\S+: class (\\w+\\.)+(\\w+)\\].*", "$2"); } - - } - - } From eb1c49eae7bbd2481242a5e7280b3767769ed556 Mon Sep 17 00:00:00 2001 From: Chris Frohoff Date: Thu, 25 Apr 2019 08:34:51 -0700 Subject: [PATCH 3/3] fix travis config --- .travis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.travis.yml b/.travis.yml index 2893dfc..fd601fc 100644 --- a/.travis.yml +++ b/.travis.yml @@ -22,7 +22,7 @@ before_install: after_script: - > # print more detailed info about test results - cat target/surefire-reports/TEST-ysoserial.payloads.PayloadsTest.xml | + cat target/surefire-reports/TEST-ysoserial.test.payloads.PayloadsTest.xml | grep testcase -A1 | grep -B1 -E 'failure|error|skipped' | grep -v -- -- matrix: