Search in sources :

Example 16 with KieFileSystem

use of org.kie.api.builder.KieFileSystem in project drools by kiegroup.

the class SecurityPolicyTest method testAccumulateFunctionMVEL.

@Test
public void testAccumulateFunctionMVEL() throws Exception {
    String drl = "package org.foo.bar\n" + "import " + MaliciousExitHelper.class.getName().replace('$', '.') + " \n" + "rule testRule dialect \"mvel\" \n" + "    when\n" + "        Number() from accumulate(Object(), " + "               sum(MaliciousExitHelper.exit()))\n" + "    then\n" + "end";
    try {
        KieServices ks = KieServices.Factory.get();
        KieFileSystem kfs = ks.newKieFileSystem().write(ResourceFactory.newByteArrayResource(drl.getBytes()).setSourcePath("org/foo/bar/r1.drl"));
        ks.newKieBuilder(kfs).buildAll();
        ReleaseId releaseId = ks.getRepository().getDefaultReleaseId();
        KieContainer kc = ks.newKieContainer(releaseId);
        KieSession ksession = kc.newKieSession();
        ksession.insert("foo");
        ksession.fireAllRules();
        Assert.fail("The security policy for the rule should have prevented this from executing...");
    } catch (PropertyAccessException e) {
        // weak way of testing but couldn't find a better way
        if (e.toString().contains("The security policy should have prevented")) {
            Assert.fail("The security policy for the rule should have prevented this from executing...");
        } else {
        // test succeeded
        }
    } catch (Exception e) {
        if (e.toString().contains("access denied (\"java.lang.RuntimePermission\" \"exitVM.0\")")) {
        // test succeeded
        } else {
            throw e;
        }
    }
}
Also used : KieFileSystem(org.kie.api.builder.KieFileSystem) PropertyAccessException(org.mvel2.PropertyAccessException) KieServices(org.kie.api.KieServices) KieSession(org.kie.api.runtime.KieSession) ReleaseId(org.kie.api.builder.ReleaseId) ConsequenceException(org.kie.api.runtime.rule.ConsequenceException) PropertyAccessException(org.mvel2.PropertyAccessException) KieContainer(org.kie.api.runtime.KieContainer) Test(org.junit.Test)

Example 17 with KieFileSystem

use of org.kie.api.builder.KieFileSystem in project drools by kiegroup.

the class SecurityPolicyTest method testCustomAccumulateMVEL.

@Test
public void testCustomAccumulateMVEL() throws Exception {
    String drl = "package org.foo.bar\n" + "rule testRule dialect \"mvel\" \n" + "    when\n" + "        Number() from accumulate(Object(), " + "               init(System.exit(-1);), " + "               action(System.exit(-1);), " + "               reverse(System.exit(-1);), " + "               result(0))\n" + "    then\n" + "end";
    try {
        KieServices ks = KieServices.Factory.get();
        KieFileSystem kfs = ks.newKieFileSystem().write(ResourceFactory.newByteArrayResource(drl.getBytes()).setSourcePath("org/foo/bar/r1.drl"));
        ks.newKieBuilder(kfs).buildAll();
        ReleaseId releaseId = ks.getRepository().getDefaultReleaseId();
        KieContainer kc = ks.newKieContainer(releaseId);
        KieSession ksession = kc.newKieSession();
        ksession.fireAllRules();
        Assert.fail("The security policy for the rule should have prevented this from executing...");
    } catch (PropertyAccessException e) {
        // weak way of testing but couldn't find a better way
        if (e.toString().contains("The security policy should have prevented")) {
            Assert.fail("The security policy for the rule should have prevented this from executing...");
        } else {
        // test succeeded
        }
    } catch (Exception e) {
        if (e.toString().contains("access denied (\"java.lang.RuntimePermission\" \"exitVM.-1\")")) {
        // test succeeded
        } else {
            throw e;
        }
    }
}
Also used : KieFileSystem(org.kie.api.builder.KieFileSystem) PropertyAccessException(org.mvel2.PropertyAccessException) KieServices(org.kie.api.KieServices) KieSession(org.kie.api.runtime.KieSession) ReleaseId(org.kie.api.builder.ReleaseId) ConsequenceException(org.kie.api.runtime.rule.ConsequenceException) PropertyAccessException(org.mvel2.PropertyAccessException) KieContainer(org.kie.api.runtime.KieContainer) Test(org.junit.Test)

Example 18 with KieFileSystem

use of org.kie.api.builder.KieFileSystem in project drools by kiegroup.

the class SecurityPolicyTest method testAccumulateFunctionJava.

@Test
public void testAccumulateFunctionJava() throws Exception {
    String drl = "package org.foo.bar\n" + "import " + MaliciousExitHelper.class.getName().replace('$', '.') + " \n" + "rule testRule dialect \"java\" \n" + "    when\n" + "        Number() from accumulate(Object(), " + "               sum(MaliciousExitHelper.exit()))\n" + "    then\n" + "end";
    try {
        KieServices ks = KieServices.Factory.get();
        KieFileSystem kfs = ks.newKieFileSystem().write(ResourceFactory.newByteArrayResource(drl.getBytes()).setSourcePath("org/foo/bar/r1.drl"));
        ks.newKieBuilder(kfs).buildAll();
        ReleaseId releaseId = ks.getRepository().getDefaultReleaseId();
        KieContainer kc = ks.newKieContainer(releaseId);
        KieSession ksession = kc.newKieSession();
        ksession.insert("foo");
        ksession.fireAllRules();
        Assert.fail("The security policy for the rule should have prevented this from executing...");
    } catch (PropertyAccessException e) {
        // weak way of testing but couldn't find a better way
        if (e.toString().contains("The security policy should have prevented")) {
            Assert.fail("The security policy for the rule should have prevented this from executing...");
        } else {
        // test succeeded
        }
    } catch (Exception e) {
        if (e.toString().contains("access denied (\"java.lang.RuntimePermission\" \"exitVM.0\")")) {
        // test succeeded
        } else {
            throw e;
        }
    }
}
Also used : KieFileSystem(org.kie.api.builder.KieFileSystem) PropertyAccessException(org.mvel2.PropertyAccessException) KieServices(org.kie.api.KieServices) KieSession(org.kie.api.runtime.KieSession) ReleaseId(org.kie.api.builder.ReleaseId) ConsequenceException(org.kie.api.runtime.rule.ConsequenceException) PropertyAccessException(org.mvel2.PropertyAccessException) KieContainer(org.kie.api.runtime.KieContainer) Test(org.junit.Test)

Example 19 with KieFileSystem

use of org.kie.api.builder.KieFileSystem in project drools by kiegroup.

the class SecurityPolicyTest method testUntrustedMvelConsequence.

@Test
public void testUntrustedMvelConsequence() throws Exception {
    String drl = "package org.foo.bar\n" + "rule R1 dialect \"mvel\" when\n" + "then\n" + "    System.exit(0);" + "end\n";
    try {
        KieServices ks = KieServices.Factory.get();
        KieFileSystem kfs = ks.newKieFileSystem().write(ResourceFactory.newByteArrayResource(drl.getBytes()).setSourcePath("org/foo/bar/r1.drl"));
        ks.newKieBuilder(kfs).buildAll();
        ReleaseId releaseId = ks.getRepository().getDefaultReleaseId();
        KieContainer kc = ks.newKieContainer(releaseId);
        KieSession ksession = kc.newKieSession();
        ksession.fireAllRules();
        Assert.fail("The security policy for the rule should have prevented this from executing...");
    } catch (ShouldHavePrevented e) {
        Assert.fail("The security policy for the rule should have prevented this from executing...");
    } catch (ConsequenceException e) {
    // test succeeded. the policy in place prevented the rule from executing the System.exit().
    }
}
Also used : KieFileSystem(org.kie.api.builder.KieFileSystem) KieServices(org.kie.api.KieServices) KieSession(org.kie.api.runtime.KieSession) ReleaseId(org.kie.api.builder.ReleaseId) ConsequenceException(org.kie.api.runtime.rule.ConsequenceException) KieContainer(org.kie.api.runtime.KieContainer) Test(org.junit.Test)

Example 20 with KieFileSystem

use of org.kie.api.builder.KieFileSystem in project drools by kiegroup.

the class SecurityPolicyTest method testUntrustedJavaConsequence.

@Test
public void testUntrustedJavaConsequence() throws Exception {
    String drl = "package org.foo.bar\n" + "rule R1 when\n" + "then\n" + "    System.exit(0);" + "end\n";
    try {
        KieServices ks = KieServices.Factory.get();
        KieFileSystem kfs = ks.newKieFileSystem().write(ResourceFactory.newByteArrayResource(drl.getBytes()).setSourcePath("org/foo/bar/r1.drl"));
        ks.newKieBuilder(kfs).buildAll();
        ReleaseId releaseId = ks.getRepository().getDefaultReleaseId();
        KieContainer kc = ks.newKieContainer(releaseId);
        KieSession ksession = kc.newKieSession();
        ksession.fireAllRules();
        Assert.fail("The security policy for the rule should have prevented this from executing...");
    } catch (ShouldHavePrevented e) {
        Assert.fail("The security policy for the rule should have prevented this from executing...");
    } catch (ConsequenceException e) {
    // test succeeded. the policy in place prevented the rule from executing the System.exit().
    }
}
Also used : KieFileSystem(org.kie.api.builder.KieFileSystem) KieServices(org.kie.api.KieServices) KieSession(org.kie.api.runtime.KieSession) ReleaseId(org.kie.api.builder.ReleaseId) ConsequenceException(org.kie.api.runtime.rule.ConsequenceException) KieContainer(org.kie.api.runtime.KieContainer) Test(org.junit.Test)

Aggregations

KieFileSystem (org.kie.api.builder.KieFileSystem)297 KieServices (org.kie.api.KieServices)241 Test (org.junit.Test)211 KieBuilder (org.kie.api.builder.KieBuilder)179 KieSession (org.kie.api.runtime.KieSession)101 KieModuleModel (org.kie.api.builder.model.KieModuleModel)79 KieContainer (org.kie.api.runtime.KieContainer)74 ReleaseId (org.kie.api.builder.ReleaseId)64 Results (org.kie.api.builder.Results)60 InternalKieBuilder (org.kie.internal.builder.InternalKieBuilder)53 InternalKieModule (org.drools.compiler.kie.builder.impl.InternalKieModule)39 KieBase (org.kie.api.KieBase)38 IncrementalResults (org.kie.internal.builder.IncrementalResults)36 StatelessKieSession (org.kie.api.runtime.StatelessKieSession)32 KieBaseModel (org.kie.api.builder.model.KieBaseModel)31 ArrayList (java.util.ArrayList)30 Message (org.kie.api.builder.Message)26 KieModule (org.kie.api.builder.KieModule)22 Message (org.drools.compiler.Message)20 Resource (org.kie.api.io.Resource)18