Examples with JavaSerializationFilterConfig com.hazelcast.config.JavaSerializationFilterConfig used on opensource projects

Example 16 with JavaSerializationFilterConfig

use of com.hazelcast.config.JavaSerializationFilterConfig in project hazelcast by hazelcast.

the class ClientDeserializationProtectionTest method testClassWhitelisted.

/**
 * <pre>
 * When: Deserialization filtering is enabled and classname of test object is whitelisted.
 * Then: The deserialization is possible.
 * </pre>
 */
@Test
public void testClassWhitelisted() {
    JavaSerializationFilterConfig filterConfig = new JavaSerializationFilterConfig();
    filterConfig.getWhitelist().addClasses(TestDeserialized.class.getName());
    Config config = new Config();
    config.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance member = hazelcastFactory.newInstances(config, 1)[0];
    ClientConfig clientConfig = new ClientConfig();
    clientConfig.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance client = hazelcastFactory.newHazelcastClient(clientConfig);
    member.getMap("test").put("key", new TestDeserialized());
    assertNotNull(client.getMap("test").get("key"));
    assertTrue(TestDeserialized.isDeserialized);
}

Example 17 with JavaSerializationFilterConfig

use of com.hazelcast.config.JavaSerializationFilterConfig in project hazelcast by hazelcast.

the class ClientDeserializationProtectionTest method testDefaultDeserializationFilter_readOnMember.

/**
 * <pre>
 * When: An untrusted serialized object is stored from client and read from member, the default Whitelist is used.
 * Then: Deserialization fails.
 * </pre>
 */
@Test
public void testDefaultDeserializationFilter_readOnMember() {
    JavaSerializationFilterConfig filterConfig = new JavaSerializationFilterConfig();
    Config config = new Config();
    config.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance member = hazelcastFactory.newInstances(config, 1)[0];
    ClientConfig clientConfig = new ClientConfig();
    clientConfig.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance client = hazelcastFactory.newHazelcastClient(clientConfig);
    client.getMap("test").put("key", new TestDeserialized());
    try {
        member.getMap("test").get("key");
        fail("Deserialization should have failed");
    } catch (HazelcastSerializationException e) {
        assertFalse(TestDeserialized.isDeserialized);
    }
}

Example 18 with JavaSerializationFilterConfig

use of com.hazelcast.config.JavaSerializationFilterConfig in project hazelcast by hazelcast.

the class DeserializationProtectionTest method testClassWhitelisted.

/**
 * <pre>
 * When: Deserialization filtering is enabled and classname of test object is whitelisted.
 * Then: The deserialization is possible.
 * </pre>
 */
@Test
public void testClassWhitelisted() {
    JavaSerializationFilterConfig filterConfig = new JavaSerializationFilterConfig();
    filterConfig.getWhitelist().addClasses(TestDeserialized.class.getName());
    assertDeserializationPass(filterConfig);
}

Example 19 with JavaSerializationFilterConfig

use of com.hazelcast.config.JavaSerializationFilterConfig in project hazelcast by hazelcast.

the class DeserializationProtectionTest method assertDeserializationPass.

private void assertDeserializationPass(JavaSerializationFilterConfig filterConfig) {
    Config config = new Config();
    config.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    TestHazelcastInstanceFactory factory = createHazelcastInstanceFactory(2);
    HazelcastInstance[] instances = factory.newInstances(config);
    instances[0].getMap("test").put("a", new TestDeserialized());
    assertNotNull(instances[1].getMap("test").get("a"));
    assertTrue(TestDeserialized.isDeserialized);
}

Example 20 with JavaSerializationFilterConfig

use of com.hazelcast.config.JavaSerializationFilterConfig in project hazelcast by hazelcast.

the class SerializationClassNameFilterTest method testPackageInWhitelist.

/**
 * <pre>
 * Given: Whitelist is set.
 * When: {@link SerializationClassNameFilter#filter(String)} is called for a class which has whitelisted package.
 * Then: no exception is thrown
 * </pre>
 */
@Test
public void testPackageInWhitelist() {
    JavaSerializationFilterConfig config = new JavaSerializationFilterConfig();
    config.getWhitelist().addPackages("com.whitelisted");
    new SerializationClassNameFilter(config).filter("com.whitelisted.Test2");
}