1 /*

     2  * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 /*

    25  * @test

    26  * @summary Verifies security checks are performed before existence checks

    27  *          in pre-defined body processors APIs

    28  * @run testng/othervm SecurityBeforeFile

    29  * @run testng/othervm/java.security.policy=nopermissions.policy SecurityBeforeFile

    30  */

    31 

    32 import java.io.FileNotFoundException;

    33 import java.nio.file.Files;

    34 import java.nio.file.OpenOption;

    35 import java.nio.file.Path;

    36 import java.nio.file.Paths;

    37 import java.net.http.HttpRequest.BodyPublishers;

    38 import java.net.http.HttpResponse.BodyHandlers;

    39 import org.testng.annotations.DataProvider;

    40 import org.testng.annotations.Test;

    41 import static java.lang.System.out;

    42 import static java.nio.file.StandardOpenOption.*;

    43 import static org.testng.Assert.*;

    44 

    45 public class SecurityBeforeFile {

    46 

    47     static final boolean hasSecurityManager = System.getSecurityManager() != null;

    48     static final boolean hasNoSecurityManager = !hasSecurityManager;

    49 

    50     @Test

    51     public void BodyPublishersOfFile() {

    52         Path p = Paths.get("doesNotExist.txt");

    53         if (hasNoSecurityManager && Files.exists(p))

    54             throw new AssertionError("Unexpected " + p);

    55 

    56         try {

    57             BodyPublishers.ofFile(p);

    58             fail("UNEXPECTED, file " + p.toString() + " exists?");

    59         } catch (SecurityException se) {

    60             assertTrue(hasSecurityManager);

    61             out.println("caught expected security exception: " + se);

    62         } catch (FileNotFoundException fnfe) {

    63             assertTrue(hasNoSecurityManager);

    64             out.println("caught expected file not found exception: " + fnfe);

    65         }

    66     }

    67 

    68     @DataProvider(name = "handlerOpenOptions")

    69     public Object[][] handlerOpenOptions() {

    70         return new Object[][] {

    71                 { new OpenOption[] {               } },

    72                 { new OpenOption[] { CREATE        } },

    73                 { new OpenOption[] { CREATE, WRITE } },

    74         };

    75     }

    76 

    77     @Test(dataProvider = "handlerOpenOptions")

    78     public void BodyHandlersOfFileDownload(OpenOption[] openOptions) {

    79         Path p = Paths.get("doesNotExistDir");

    80         if (hasNoSecurityManager && Files.exists(p))

    81             throw new AssertionError("Unexpected " + p);

    82 

    83         try {

    84             BodyHandlers.ofFileDownload(p, openOptions);

    85             fail("UNEXPECTED, file " + p.toString() + " exists?");

    86         } catch (SecurityException se) {

    87             assertTrue(hasSecurityManager);

    88             out.println("caught expected security exception: " + se);

    89         } catch (IllegalArgumentException iae) {

    90             assertTrue(hasNoSecurityManager);

    91             out.println("caught expected illegal argument exception: " + iae);

    92         }

    93     }

    94 }