WrapperForInsecureClassloader implements ResourceLoader { @Override public InputStream getResourceAsStream(String name) { if(name.contains("..")){ return null; }else{ return loader.getResourceAsStream(name); } } WrapperForInsecureClassloader(ResourceLoader loader); @Override InputStream getResourceAsStream(String name);  }
@Test public void passesTheDataThroughUnmolested() { ResourceLoader loader = new MockClasspathLoader("frog", new byte[]{0x1, 0x2, 0x3}); WrapperForInsecureClassloader testSubject = new WrapperForInsecureClassloader(loader); InputStream result = testSubject.getResourceAsStream("frog"); assertArrayEquals(new byte[]{0x1, 0x2, 0x3}, toByteArray(result)); }
@Test public void returnsNullWhenAskedForPathsThatAreNotSafeToUseWithInsecureClassloaders() { ResourceLoader loader = new MockClasspathLoader("frog/../../../foo", new byte[]{0x1, 0x2, 0x3}); WrapperForInsecureClassloader testSubject = new WrapperForInsecureClassloader(loader); InputStream result = testSubject.getResourceAsStream("frog/../../../foo"); Assert.assertNull("Expected null", result); }