Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-08 Thread Weijun Wang
> On Apr 8, 2019, at 9:38 PM, Sean Mullan wrote: > > On 4/6/19 10:33 AM, Weijun Wang wrote: >> 603 // check that the Class of the Permission key and value are the >> same >> 604 for (Map.Entry e : perms.entrySet()) { >> 605 Permission k = e.getKey(); >> 606

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-08 Thread Sean Mullan
On 4/6/19 10:33 AM, Weijun Wang wrote: 603 // check that the Class of the Permission key and value are the same 604 for (Map.Entry e : perms.entrySet()) { 605 Permission k = e.getKey(); 606 Permission v = e.getValue(); 607 if (!(k.get

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-06 Thread Weijun Wang
603 // check that the Class of the Permission key and value are the same 604 for (Map.Entry e : perms.entrySet()) { 605 Permission k = e.getKey(); 606 Permission v = e.getValue(); 607 if (!(k.getClass().equals(v.getClass( { 608

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-05 Thread Sean Mullan
Updated webrev: http://cr.openjdk.java.net/~mullan/webrevs/8020637/webrev.01/ The serialized streams are now encoded within the test code itself. I also added a test case for an PermissionsHash object with invalid mappings. I also modified the fix. Instead of trying to fix the mappings in the

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-02 Thread Weijun Wang
+1. --Max > On Apr 2, 2019, at 9:55 PM, Roger Riggs wrote: > > Hi Sean, > > Typically, fixed serialization streams are encoded in the source > as byte arrays. That keeps binary content out of the repo > and provides a place for the comments. > > Roger > > > On 04/02/2019 09:50 AM, Sean Mull

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-02 Thread Roger Riggs
Hi Sean, Typically, fixed serialization streams are encoded in the source as byte arrays. That keeps binary content out of the repo and provides a place for the comments. Roger On 04/02/2019 09:50 AM, Sean Mullan wrote: On 4/2/19 9:44 AM, Weijun Wang wrote: On Apr 2, 2019, at 9:33 PM, Sea

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-02 Thread Sean Mullan
On 4/2/19 9:44 AM, Weijun Wang wrote: On Apr 2, 2019, at 9:33 PM, Sean Mullan wrote: On 4/1/19 11:12 PM, Weijun Wang wrote: I can understand the change in Permissions, but is there any difference in PermissionsHash? The key and value in the PermissionsHash map is always the same object.

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-02 Thread Weijun Wang
> On Apr 2, 2019, at 9:33 PM, Sean Mullan wrote: > > On 4/1/19 11:12 PM, Weijun Wang wrote: >> I can understand the change in Permissions, but is there any difference in >> PermissionsHash? > > The key and value in the PermissionsHash map is always the same object. This > fix ensures that i

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-02 Thread Sean Mullan
On 4/1/19 11:12 PM, Weijun Wang wrote: I can understand the change in Permissions, but is there any difference in PermissionsHash? The key and value in the PermissionsHash map is always the same object. This fix ensures that is respected, otherwise after deserialization you could have a Sock

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-01 Thread Weijun Wang
I can understand the change in Permissions, but is there any difference in PermissionsHash? --Max > On Apr 2, 2019, at 1:10 AM, Sean Mullan wrote: > > It is currently possible to change the mappings in a serialized > java.security.Permissions object such that they no longer map correctly, and

[13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-01 Thread Sean Mullan
It is currently possible to change the mappings in a serialized java.security.Permissions object such that they no longer map correctly, and Permissions.readObject won't detect this. This change makes sure that for a deserialized Permissions object, the permissions are mapped correctly to the