Examples with ATTest org.jboss.eap.additional.testsuite.annotations.ATTest used on opensource projects

Example 1 with ATTest

use of org.jboss.eap.additional.testsuite.annotations.ATTest in project eap-additional-testsuite by jboss-set.

the class JaxbProviderDeserializationSecurityCheckTestCase method testOpenjpaService.

@ATTest({ "modules/testcases/jdkAll/Wildfly/jaxrs/src/main/java#16.0.0.Beta1", "modules/testcases/jdkAll/WildflyRelease-17.0.0.Final/jaxrs/src/main/java", "modules/testcases/jdkAll/Eap72x/jaxrs/src/main/java#7.2.1", "modules/testcases/jdkAll/Eap72x-Proposed/jaxrs/src/main/java#7.2.1", "modules/testcases/jdkAll/Eap71x/jaxrs/src/main/java#7.1.6", "modules/testcases/jdkAll/Eap71x-Proposed/jaxrs/src/main/java#7.1.6" })
@Test
public void testOpenjpaService() throws Exception {
    String result = performCall("rest/jaxb/openjpa");
    try {
        JNDIManagedRuntime jaxbModel = new ObjectMapper().configure(SerializationFeature.FAIL_ON_EMPTY_BEANS, false).readValue(result, JNDIManagedRuntime.class);
        Assert.fail("Should prevente json deserialization because of security reasons.");
    } catch (JsonMappingException e) {
        Assert.assertTrue("Should prevente json deserialization because of security reasons.", e.getMessage().contains("Illegal type"));
    }
}

Example 2 with ATTest

use of org.jboss.eap.additional.testsuite.annotations.ATTest in project eap-additional-testsuite by jboss-set.

the class SecurityDeserializationTestCase method testSecuirtyDatabind3.

@ATTest({ "modules/testcases/jdkAll/Wildfly/security/src/main/java", "modules/testcases/jdkAll/WildflyRelease-17.0.0.Final/security/src/main/java", "modules/testcases/jdkAll/Eap72x/security/src/main/java", "modules/testcases/jdkAll/Eap72x-Proposed/security/src/main/java", "modules/testcases/jdkAll/Eap7/security/src/main/java", "modules/testcases/jdkAll/Eap72x-Proposed/security/src/main/java", "modules/testcases/jdkAll/Eap72x/security/src/main/java", "modules/testcases/jdkAll/Eap71x-Proposed/security/src/main/java", "modules/testcases/jdkAll/Eap71x/security/src/main/java" })
@Test
public void testSecuirtyDatabind3() throws Exception {
    final String JSON = aposToQuotes("{'v':['java.rmi.server.UnicastRemoteObject','/tmp/foobar.txt']}");
    ObjectMapper mapper = new ObjectMapper();
    mapper.enableDefaultTyping();
    try {
        PolyWrapper sc = mapper.readValue(JSON, PolyWrapper.class);
        fail("Should not be able to deserialize because of security prevention.");
    } catch (JsonMappingException e) {
        assertTrue("Fail because of security issues...", e.getMessage().contains("prevented for security reasons"));
    }
}

Example 3 with ATTest

use of org.jboss.eap.additional.testsuite.annotations.ATTest in project eap-additional-testsuite by jboss-set.

the class SecurityDeserializationTestCase method testSecuirtyDatabind7.

@ATTest({ "modules/testcases/jdkAll/Wildfly/security/src/main/java#16.0.0.Beta1", "modules/testcases/jdkAll/WildflyRelease-17.0.0.Final/security/src/main/java", "modules/testcases/jdkAll/Eap71x-Proposed/security/src/main/java#7.1.6", "modules/testcases/jdkAll/Eap71x/security/src/main/java#7.1.6", "modules/testcases/jdkAll/Eap72x-Proposed/security/src/main/java#7.2.1", "modules/testcases/jdkAll/Eap72x/security/src/main/java#7.2.1" })
@Test
public void testSecuirtyDatabind7() throws Exception {
    final String JSON = aposToQuotes("{'v':['org.apache.axis2.transport.jms.JMSOutTransportInfo','/tmp/foobar.txt']}");
    ObjectMapper mapper = new ObjectMapper();
    mapper.enableDefaultTyping();
    try {
        PolyWrapper sc = mapper.readValue(JSON, PolyWrapper.class);
        fail("Should not be able to deserialize because of security prevention.");
    } catch (JsonMappingException e) {
        assertTrue("Fail because of security issues...", e.getMessage().contains("prevented for security reasons"));
    }
}

Example 4 with ATTest

use of org.jboss.eap.additional.testsuite.annotations.ATTest in project eap-additional-testsuite by jboss-set.

the class SecurityDeserializationTestCase method testSecuirtyDatabind13.

@ATTest({ "modules/testcases/jdkAll/Wildfly/security/src/main/java#19.0.0.Beta1", "modules/testcases/jdkAll/Eap72x-Proposed/security/src/main/java#7.2.6", "modules/testcases/jdkAll/Eap72x/security/src/main/java#7.2.6", "modules/testcases/jdkAll/Eap7/security/src/main/java#7.3.0.GA" })
public void testSecuirtyDatabind13() throws Exception {
    final String JSON = aposToQuotes("{'v':['com.zaxxer.hikari.HikariDataSource']}");
    ObjectMapper mapper = new ObjectMapper();
    mapper.enableDefaultTyping();
    try {
        PolyWrapper sc = mapper.readValue(JSON, PolyWrapper.class);
        fail("Should not be able to deserialize because of security prevention.");
    } catch (JsonMappingException e) {
        assertTrue("Fail because of security issues...", e.getMessage().contains("prevented for security reasons"));
    }
}

Example 5 with ATTest

use of org.jboss.eap.additional.testsuite.annotations.ATTest in project eap-additional-testsuite by jboss-set.

the class SecurityDeserializationTestCase method testSecuirtyDatabind9.

@ATTest({ "modules/testcases/jdkAll/Wildfly/security/src/main/java#17.0.0.Final", "modules/testcases/jdkAll/Eap72x-Proposed/security/src/main/java#7.2.4", "modules/testcases/jdkAll/Eap72x/security/src/main/java#7.2.4", "modules/testcases/jdkAll/Eap7/security/src/main/java#7.3.0.CD17" })
public void testSecuirtyDatabind9() throws Exception {
    final String JSON = aposToQuotes("{'v':['com.mysql.cj.jdbc.admin.MiniAdmin']}");
    ObjectMapper mapper = new ObjectMapper();
    mapper.enableDefaultTyping();
    try {
        PolyWrapper sc = mapper.readValue(JSON, PolyWrapper.class);
        fail("Should not be able to deserialize because of security prevention.");
    } catch (JsonMappingException e) {
        assertTrue("Fail because of security issues...", e.getMessage().contains("prevented for security reasons"));
    }
}