Examples with TestDeserialized example.serialization.TestDeserialized used on opensource projects

Example 6 with TestDeserialized

use of example.serialization.TestDeserialized in project hazelcast by hazelcast.

the class ClientDeserializationProtectionTest method testNoDeserializationFilter.

/**
 * <pre>
 * When: Deserialization filtering is not explicitly enabled and object is read from client.
 * Then: Untrusted deserialization is possible.
 * </pre>
 */
@Test
public void testNoDeserializationFilter() {
    Config config = new Config();
    HazelcastInstance member = hazelcastFactory.newInstances(config, 1)[0];
    ClientConfig clientConfig = new ClientConfig();
    HazelcastInstance client = hazelcastFactory.newHazelcastClient(clientConfig);
    member.getMap("test").put("key", new TestDeserialized());
    assertNotNull(client.getMap("test").get("key"));
    assertTrue(TestDeserialized.isDeserialized);
}

Example 7 with TestDeserialized

use of example.serialization.TestDeserialized in project hazelcast by hazelcast.

the class ClientDeserializationProtectionTest method testDefaultDeserializationFilter_readOnClient.

/**
 * <pre>
 * When: An untrusted serialized object is stored by member and read from client, the default Whitelist is used.
 * Then: Deserialization fails.
 * </pre>
 */
@Test
public void testDefaultDeserializationFilter_readOnClient() {
    JavaSerializationFilterConfig filterConfig = new JavaSerializationFilterConfig();
    Config config = new Config();
    config.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance member = hazelcastFactory.newInstances(config, 1)[0];
    ClientConfig clientConfig = new ClientConfig();
    clientConfig.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance client = hazelcastFactory.newHazelcastClient(clientConfig);
    member.getMap("test").put("key", new TestDeserialized());
    try {
        client.getMap("test").get("key");
        fail("Deserialization should have failed");
    } catch (HazelcastSerializationException e) {
        assertFalse(TestDeserialized.isDeserialized);
    }
}

Example 8 with TestDeserialized

use of example.serialization.TestDeserialized in project hazelcast by hazelcast.

the class ClientDeserializationProtectionTest method testClassWhitelisted.

/**
 * <pre>
 * When: Deserialization filtering is enabled and classname of test object is whitelisted.
 * Then: The deserialization is possible.
 * </pre>
 */
@Test
public void testClassWhitelisted() {
    JavaSerializationFilterConfig filterConfig = new JavaSerializationFilterConfig();
    filterConfig.getWhitelist().addClasses(TestDeserialized.class.getName());
    Config config = new Config();
    config.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance member = hazelcastFactory.newInstances(config, 1)[0];
    ClientConfig clientConfig = new ClientConfig();
    clientConfig.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance client = hazelcastFactory.newHazelcastClient(clientConfig);
    member.getMap("test").put("key", new TestDeserialized());
    assertNotNull(client.getMap("test").get("key"));
    assertTrue(TestDeserialized.isDeserialized);
}

Example 9 with TestDeserialized

use of example.serialization.TestDeserialized in project hazelcast by hazelcast.

the class ClientDeserializationProtectionTest method testDefaultDeserializationFilter_readOnMember.

/**
 * <pre>
 * When: An untrusted serialized object is stored from client and read from member, the default Whitelist is used.
 * Then: Deserialization fails.
 * </pre>
 */
@Test
public void testDefaultDeserializationFilter_readOnMember() {
    JavaSerializationFilterConfig filterConfig = new JavaSerializationFilterConfig();
    Config config = new Config();
    config.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance member = hazelcastFactory.newInstances(config, 1)[0];
    ClientConfig clientConfig = new ClientConfig();
    clientConfig.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    HazelcastInstance client = hazelcastFactory.newHazelcastClient(clientConfig);
    client.getMap("test").put("key", new TestDeserialized());
    try {
        member.getMap("test").get("key");
        fail("Deserialization should have failed");
    } catch (HazelcastSerializationException e) {
        assertFalse(TestDeserialized.isDeserialized);
    }
}

Example 10 with TestDeserialized

use of example.serialization.TestDeserialized in project hazelcast by hazelcast.

the class DeserializationProtectionTest method assertDeserializationPass.

private void assertDeserializationPass(JavaSerializationFilterConfig filterConfig) {
    Config config = new Config();
    config.getSerializationConfig().setJavaSerializationFilterConfig(filterConfig);
    TestHazelcastInstanceFactory factory = createHazelcastInstanceFactory(2);
    HazelcastInstance[] instances = factory.newInstances(config);
    instances[0].getMap("test").put("a", new TestDeserialized());
    assertNotNull(instances[1].getMap("test").get("a"));
    assertTrue(TestDeserialized.isDeserialized);
}