Skip to content

Commit ccee6cc

Browse files
jasmith-hsjasmith-hs
committed
Add tests that certain classes and packages CANNOT be allowlisted
1 parent 2a8ef10 commit ccee6cc

1 file changed

Lines changed: 209 additions & 0 deletions

File tree

‎src/test/java/com/hubspot/jinjava/el/ext/ValidatorConfigBannedConstructsTest.java‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
package com.hubspot.jinjava.el.ext;
2+
3+
import static org.assertj.core.api.Assertions.assertThatThrownBy;
4+
5+
import com.fasterxml.jackson.databind.ObjectMapper;
6+
import com.hubspot.jinjava.interpret.JinjavaInterpreter;
7+
import java.lang.reflect.Method;
8+
import org.junit.Test;
9+
10+
public class ValidatorConfigBannedConstructsTest {
11+
12+
// MethodValidatorConfig: allowedMethods() path
13+
14+
@Test
15+
public void itRejectsObjectMethodInAllowedMethods() throws NoSuchMethodException {
16+
Method toStringMethod = Object.class.getMethod("toString");
17+
assertThatThrownBy(
18+
() -> MethodValidatorConfig.builder().addAllowedMethods(toStringMethod).build()
19+
)
20+
.isInstanceOf(IllegalStateException.class)
21+
.hasMessageContaining("Banned classes or prefixes");
22+
}
23+
24+
@Test
25+
public void itRejectsClassMethodInAllowedMethods() throws NoSuchMethodException {
26+
Method getNameMethod = Class.class.getMethod("getName");
27+
assertThatThrownBy(
28+
() -> MethodValidatorConfig.builder().addAllowedMethods(getNameMethod).build()
29+
)
30+
.isInstanceOf(IllegalStateException.class)
31+
.hasMessageContaining("Banned classes or prefixes");
32+
}
33+
34+
// MethodValidatorConfig: allowedDeclaredMethodsFromCanonicalClassNames() path
35+
36+
@Test
37+
public void itRejectsObjectClassInAllowedDeclaredMethodClassNames() {
38+
assertThatThrownBy(
39+
() ->
40+
MethodValidatorConfig
41+
.builder()
42+
.addAllowedDeclaredMethodsFromCanonicalClassNames(
43+
Object.class.getCanonicalName()
44+
)
45+
.build()
46+
)
47+
.isInstanceOf(IllegalStateException.class)
48+
.hasMessageContaining("Banned classes or prefixes");
49+
}
50+
51+
@Test
52+
public void itRejectsClassClassInAllowedDeclaredMethodClassNames() {
53+
assertThatThrownBy(
54+
() ->
55+
MethodValidatorConfig
56+
.builder()
57+
.addAllowedDeclaredMethodsFromCanonicalClassNames(
58+
Class.class.getCanonicalName()
59+
)
60+
.build()
61+
)
62+
.isInstanceOf(IllegalStateException.class)
63+
.hasMessageContaining("Banned classes or prefixes");
64+
}
65+
66+
@Test
67+
public void itRejectsObjectMapperInAllowedDeclaredMethodClassNames() {
68+
assertThatThrownBy(
69+
() ->
70+
MethodValidatorConfig
71+
.builder()
72+
.addAllowedDeclaredMethodsFromCanonicalClassNames(
73+
ObjectMapper.class.getCanonicalName()
74+
)
75+
.build()
76+
)
77+
.isInstanceOf(IllegalStateException.class)
78+
.hasMessageContaining("Banned classes or prefixes");
79+
}
80+
81+
@Test
82+
public void itRejectsJinjavaInterpreterInAllowedDeclaredMethodClassNames() {
83+
assertThatThrownBy(
84+
() ->
85+
MethodValidatorConfig
86+
.builder()
87+
.addAllowedDeclaredMethodsFromCanonicalClassNames(
88+
JinjavaInterpreter.class.getCanonicalName()
89+
)
90+
.build()
91+
)
92+
.isInstanceOf(IllegalStateException.class)
93+
.hasMessageContaining("Banned classes or prefixes");
94+
}
95+
96+
// MethodValidatorConfig: allowedDeclaredMethodsFromCanonicalClassPrefixes() path
97+
98+
@Test
99+
public void itRejectsReflectPackageInAllowedDeclaredMethodPrefixes() {
100+
assertThatThrownBy(
101+
() ->
102+
MethodValidatorConfig
103+
.builder()
104+
.addAllowedDeclaredMethodsFromCanonicalClassPrefixes(
105+
Method.class.getPackageName()
106+
)
107+
.build()
108+
)
109+
.isInstanceOf(IllegalStateException.class)
110+
.hasMessageContaining("Banned classes or prefixes");
111+
}
112+
113+
@Test
114+
public void itRejectsJacksonDatabindPackageInAllowedDeclaredMethodPrefixes() {
115+
assertThatThrownBy(
116+
() ->
117+
MethodValidatorConfig
118+
.builder()
119+
.addAllowedDeclaredMethodsFromCanonicalClassPrefixes(
120+
ObjectMapper.class.getPackageName()
121+
)
122+
.build()
123+
)
124+
.isInstanceOf(IllegalStateException.class)
125+
.hasMessageContaining("Banned classes or prefixes");
126+
}
127+
128+
// ReturnTypeValidatorConfig: allowedCanonicalClassNames() path
129+
130+
@Test
131+
public void itRejectsObjectClassInAllowedReturnTypeClassNames() {
132+
assertThatThrownBy(
133+
() ->
134+
ReturnTypeValidatorConfig
135+
.builder()
136+
.addAllowedCanonicalClassNames(Object.class.getCanonicalName())
137+
.build()
138+
)
139+
.isInstanceOf(IllegalStateException.class)
140+
.hasMessageContaining("Banned classes or prefixes");
141+
}
142+
143+
@Test
144+
public void itRejectsClassClassInAllowedReturnTypeClassNames() {
145+
assertThatThrownBy(
146+
() ->
147+
ReturnTypeValidatorConfig
148+
.builder()
149+
.addAllowedCanonicalClassNames(Class.class.getCanonicalName())
150+
.build()
151+
)
152+
.isInstanceOf(IllegalStateException.class)
153+
.hasMessageContaining("Banned classes or prefixes");
154+
}
155+
156+
@Test
157+
public void itRejectsObjectMapperInAllowedReturnTypeClassNames() {
158+
assertThatThrownBy(
159+
() ->
160+
ReturnTypeValidatorConfig
161+
.builder()
162+
.addAllowedCanonicalClassNames(ObjectMapper.class.getCanonicalName())
163+
.build()
164+
)
165+
.isInstanceOf(IllegalStateException.class)
166+
.hasMessageContaining("Banned classes or prefixes");
167+
}
168+
169+
@Test
170+
public void itRejectsJinjavaInterpreterInAllowedReturnTypeClassNames() {
171+
assertThatThrownBy(
172+
() ->
173+
ReturnTypeValidatorConfig
174+
.builder()
175+
.addAllowedCanonicalClassNames(JinjavaInterpreter.class.getCanonicalName())
176+
.build()
177+
)
178+
.isInstanceOf(IllegalStateException.class)
179+
.hasMessageContaining("Banned classes or prefixes");
180+
}
181+
182+
// ReturnTypeValidatorConfig: allowedCanonicalClassPrefixes() path
183+
184+
@Test
185+
public void itRejectsReflectPackageInAllowedReturnTypePrefixes() {
186+
assertThatThrownBy(
187+
() ->
188+
ReturnTypeValidatorConfig
189+
.builder()
190+
.addAllowedCanonicalClassPrefixes(Method.class.getPackageName())
191+
.build()
192+
)
193+
.isInstanceOf(IllegalStateException.class)
194+
.hasMessageContaining("Banned classes or prefixes");
195+
}
196+
197+
@Test
198+
public void itRejectsJacksonDatabindPackageInAllowedReturnTypePrefixes() {
199+
assertThatThrownBy(
200+
() ->
201+
ReturnTypeValidatorConfig
202+
.builder()
203+
.addAllowedCanonicalClassPrefixes(ObjectMapper.class.getPackageName())
204+
.build()
205+
)
206+
.isInstanceOf(IllegalStateException.class)
207+
.hasMessageContaining("Banned classes or prefixes");
208+
}
209+
}

0 commit comments

Comments
 (0)