JavaBeanAccessorMethodAuthorizer implements MethodInvocationAuthorizer { @Override public boolean authorize(Method method, Object target) { if (restrictedMethodAuthorizer.isPermanentlyForbiddenMethod(method, target)) { return false; } String packageName = target.getClass().getPackage().getName(); if (packageName.startsWith(GEODE_BASE_PACKAGE)) { return restrictedMethodAuthorizer.isAllowedGeodeMethod(method, target); } String methodName = method.getName(); if (pattern.matcher(methodName).matches()) { if (allowedPackages.stream().anyMatch(packageName::startsWith)) { return true; } } return restrictedMethodAuthorizer.authorize(method, target); } JavaBeanAccessorMethodAuthorizer(Cache cache, Set<String> allowedPackages);  JavaBeanAccessorMethodAuthorizer(RestrictedMethodAuthorizer restrictedMethodAuthorizer,
      Set<String> allowedPackages); @Override boolean authorize(Method method, Object target); Set<String> getAllowedPackages();  }
@Test public void authorizeReturnsFalseForKnownDangerousMethods() throws NoSuchMethodException { List<Method> dangerousMethods = new ArrayList<>(); dangerousMethods.add(TestBean.class.getMethod("getClass")); dangerousMethods.add(TestBean.class.getMethod("readResolve")); dangerousMethods.add(TestBean.class.getMethod("readObjectNoData")); dangerousMethods.add(TestBean.class.getMethod("readObject", ObjectInputStream.class)); dangerousMethods.add(TestBean.class.getMethod("writeReplace")); dangerousMethods.add(TestBean.class.getMethod("writeObject", ObjectOutputStream.class)); dangerousMethods.forEach( method -> assertThat( authorizerWithLangAndIOPackagesSpecified.authorize(method, new TestBean())) .isFalse()); }
@Test public void authorizeReturnsFalseForDisallowedGeodeClassesWithGeodePackageSpecified() throws NoSuchMethodException { assertThat((TestBean.class.getPackage().getName())) .startsWith(JavaBeanAccessorMethodAuthorizer.GEODE_BASE_PACKAGE); List<Method> geodeMethods = new ArrayList<>(); geodeMethods.add(TestBean.class.getMethod("isMatchingMethod")); geodeMethods.add(TestBean.class.getMethod("getMatchingMethod")); geodeMethods.add(TestBean.class.getMethod("nonMatchingMethod")); Set<String> geodePackage = new HashSet<>(); geodePackage.add(JavaBeanAccessorMethodAuthorizer.GEODE_BASE_PACKAGE); JavaBeanAccessorMethodAuthorizer geodeMatchingAuthorizer = new JavaBeanAccessorMethodAuthorizer(defaultAuthorizer, geodePackage); geodeMethods.forEach( method -> assertThat(geodeMatchingAuthorizer.authorize(method, new TestBean())).isFalse()); }
@Test public void authorizeReturnsFalseForMatchingMethodNamesAndNonMatchingPackage() throws NoSuchMethodException { Method getMatchingMethod = List.class.getMethod("get", int.class); Method isMatchingMethod = List.class.getMethod("isEmpty"); assertThat( authorizerWithLangAndIOPackagesSpecified.authorize(isMatchingMethod, new ArrayList())) .isFalse(); assertThat( authorizerWithLangAndIOPackagesSpecified.authorize(getMatchingMethod, new ArrayList())) .isFalse(); }
@Test public void authorizeReturnsFalseForNonMatchingMethodNameAndMatchingPackage() throws NoSuchMethodException { Method langMethod = String.class.getMethod("notify"); assertThat(authorizerWithLangAndIOPackagesSpecified.authorize(langMethod, "")).isFalse(); Method ioMethod = File.class.getMethod("notify"); assertThat(authorizerWithLangAndIOPackagesSpecified.authorize(ioMethod, new File(""))) .isFalse(); }
@Test public void authorizeReturnsTrueForMatchingMethodNamesAndPackage() throws NoSuchMethodException { Method isMatchingLangMethod = String.class.getMethod("isEmpty"); Method getMatchingLangMethod = String.class.getMethod("getBytes"); assertThat(authorizerWithLangAndIOPackagesSpecified.authorize(isMatchingLangMethod, "")) .isTrue(); assertThat(authorizerWithLangAndIOPackagesSpecified.authorize(getMatchingLangMethod, "")) .isTrue(); Method isMatchingIOMethod = File.class.getMethod("isAbsolute"); Method getMatchingIOMethod = File.class.getMethod("getPath"); assertThat(authorizerWithLangAndIOPackagesSpecified.authorize(isMatchingIOMethod, new File(""))) .isTrue(); assertThat( authorizerWithLangAndIOPackagesSpecified.authorize(getMatchingIOMethod, new File(""))) .isTrue(); }
@Test public void authorizeReturnsFalseForNonMatchingDisallowedMethod() throws NoSuchMethodException { Method method = Object.class.getMethod("notify"); assertThat(authorizerWithLangAndIOPackagesSpecified.authorize(method, new Object())).isFalse(); }
@Test public void authorizeReturnsTrueForNonMatchingAllowedMethod() throws NoSuchMethodException { Method method = Object.class.getMethod("equals", Object.class); assertThat(authorizerWithLangAndIOPackagesSpecified.authorize(method, new Object())).isTrue(); }