SecurityManagerPolicy extends Policy { public boolean implies(CodeSource codeSource, Permission permission) { return super.implies(concat(toString(codeSource), getPermissionFacts(permission))); }  @Override String getName(); @Override FactMetaData getRootFactMetaData(); boolean implies(CodeSource codeSource, Permission permission); void logViolation(CodeSource codeSource, Permission permission); void writeJavaPolicy(Writer writer); void parseJavaPolicy(Reader reader);  }
@Test public void testImplies() throws IOException { JSONObject jsonPolicy = new JSONObject() .put("file:/tmp/foo.jar", new JSONObject() .put("java.io.FilePermission", new JSONObject() .put("/tmp/foo/bar/baz.txt", new JSONObject().put("read", new JSONObject())) ) ); SecurityManagerPolicy policy = createPolicy(); policy.parsePolicy(new StringReader(jsonPolicy.toString())); final CodeSource codeSource = new CodeSource(new URL("file:/tmp/foo.jar"), (java.security.cert.Certificate[])null); assertTrue(policy.implies(codeSource, new FilePermission("/tmp/foo/bar/baz.txt", "read"))); assertFalse(policy.implies(codeSource, new FilePermission("/tmp/foo/bar/baz.txt", "write"))); assertFalse(policy.implies(codeSource, new FilePermission("/tmp/foo/bar/bar.txt", "read"))); final CodeSource codeSource2 = new CodeSource(new URL("file:/tmp/bar.jar"), (java.security.cert.Certificate[])null); assertFalse(policy.implies(codeSource2, new FilePermission("/tmp/foo/bar/baz.txt", "read"))); }
@Test public void testCodeSourceMatching() throws IOException { SecurityManagerPolicy policy = createPolicy(); policy.parsePolicy(new StringReader("{\n" + " \"file:/WEB-INF/classes/com/foo/*\": {\n" + " \"com.coverity.security.pie.policy.securitymanager.SecurityManagerPolicyTest$MyPermission\": { \"abc\": {} }\n" + " },\n" + " \"file:/WEB-INF/classes/com/bar/*\": {\n" + " \"com.coverity.security.pie.policy.securitymanager.SecurityManagerPolicyTest$MyPermission\": { \"def\": {} }\n" + " },\n" + " \"file:/WEB-INF/lib/-\": {\n" + " \"com.coverity.security.pie.policy.securitymanager.SecurityManagerPolicyTest$MyPermission\": { \"ghi\": {} }\n" + " }\n" + "}")); assertTrue(policy.implies(new CodeSource(new URL("file:/WEB-INF/classes/com/foo/Foo.class"), (Certificate[]) null), new MyPermission("abc", null))); assertTrue(policy.implies(new CodeSource(new URL("file:/WEB-INF/classes/com/foo/Bar.class"), (Certificate[]) null), new MyPermission("abc", null))); assertFalse(policy.implies(new CodeSource(new URL("file:/WEB-INF/classes/com/foo/bar/Foo.class"), (Certificate[]) null), new MyPermission("abc", null))); assertFalse(policy.implies(new CodeSource(new URL("file:/WEB-INF/classes/com/bar/Foo.class"), (Certificate[]) null), new MyPermission("abc", null))); assertTrue(policy.implies(new CodeSource(new URL("file:/WEB-INF/classes/com/bar/Foo.class"), (Certificate[]) null), new MyPermission("def", null))); assertTrue(policy.implies(new CodeSource(new URL("file:/WEB-INF/lib/foo.jar!com/foo/Foo.class"), (Certificate[]) null), new MyPermission("ghi", null))); assertFalse(policy.implies(new CodeSource(new URL("file:/WEB-INF/lib/foo.jar!com/foo/Foo.class"), (Certificate[]) null), new MyPermission("abc", null))); assertFalse(policy.implies(new CodeSource(new URL("file:/WEB-INF/lib/foo.jar!com/foo/Foo.class"), (Certificate[]) null), new MyPermission("def", null))); }