[
https://issues.apache.org/jira/browse/GROOVY-12339?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110934#comment-18110934
]
ASF GitHub Bot commented on GROOVY-12339:
-----------------------------------------
blackdrag commented on code in PR #2864:
URL: https://github.com/apache/groovy/pull/2864#discussion_r3920568886
##########
src/test/groovy/groovy/lang/ClosureSerializationCycleTest.groovy:
##########
@@ -215,6 +269,56 @@ final class ClosureSerializationCycleTest {
serialize(trampoline)
}
+ static byte[] serializeCyclicWritable() {
+ def writable = { x -> x }.asWritable()
+ setDeclaredField(writable, 'owner', writable)
+ setDeclaredField(writable, 'delegate', writable)
+ serialize(writable)
+ }
+
+ static byte[] serializeMemoized() {
+ serialize({ x -> x * 2 }.memoize())
+ }
+
+ static byte[] serializeCyclicMemoized() {
+ def memoized = { x -> x * 2 }.memoize()
+ setDeclaredField(memoized, 'closure', memoized)
+ serialize(memoized)
+ }
+
+ static byte[] serializeCyclicSoftMemoized() {
+ // A real instance cannot be serialized: it holds a non-transient
ReferenceQueue. A forged
+ // gadget stream is hand-written and under no such constraint, so
the unserializable fields
+ // are cleared here to produce the stream an attacker would simply
author.
+ def memoized = { x -> x * 2 }.memoizeAtLeast(4)
+ setDeclaredField(memoized, 'queue', null)
+ setDeclaredField(memoized, 'lruProtectionStorage', null)
+ setDeclaredField(memoized, 'closure', memoized)
+ serialize(memoized)
+ }
+
+ static byte[] serializePredicateClosure() {
+ serialize(org.apache.groovy.util.Closures.from({ n -> n % 2 == 0 }
as java.util.function.Predicate))
Review Comment:
the FQNs again
> Additional Closure serialization cycle checks
> ---------------------------------------------
>
> Key: GROOVY-12339
> URL: https://issues.apache.org/jira/browse/GROOVY-12339
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
