1 // Copyright 2022 Code Intelligence GmbH 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 package com.example; 16 17 import com.code_intelligence.jazzer.api.FuzzerSecurityIssueHigh; 18 import java.io.*; 19 import java.lang.reflect.InvocationTargetException; 20 import java.util.Base64; 21 import org.junit.After; 22 import org.junit.Test; 23 24 public class DisabledHooksTest { triggerReflectiveCallSanitizer()25 public static void triggerReflectiveCallSanitizer() { 26 try { 27 Class.forName("jaz.Zer").newInstance(); 28 } catch (ClassNotFoundException | IllegalAccessException | InstantiationException ignored) { 29 } 30 } 31 triggerExpressionLanguageInjectionSanitizer()32 public static void triggerExpressionLanguageInjectionSanitizer() throws Throwable { 33 try { 34 Class.forName("jaz.Zer").getMethod("el").invoke(null); 35 } catch (InvocationTargetException e) { 36 throw e.getCause(); 37 } catch (IllegalAccessException | ClassNotFoundException | NoSuchMethodException ignore) { 38 } 39 } 40 triggerDeserializationSanitizer()41 public static void triggerDeserializationSanitizer() { 42 byte[] data = 43 Base64.getDecoder().decode("rO0ABXNyAAdqYXouWmVyAAAAAAAAACoCAAFCAAlzYW5pdGl6ZXJ4cAEK"); 44 try { 45 ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data)); 46 System.out.println(ois.readObject()); 47 } catch (IOException | ClassNotFoundException ignore) { 48 } 49 } 50 51 @After resetDisabledHooksProperty()52 public void resetDisabledHooksProperty() { 53 System.clearProperty("jazzer.disabled_hooks"); 54 } 55 56 @Test(expected = FuzzerSecurityIssueHigh.class) enableReflectiveCallSanitizer()57 public void enableReflectiveCallSanitizer() { 58 triggerReflectiveCallSanitizer(); 59 } 60 61 @Test(expected = FuzzerSecurityIssueHigh.class) enableDeserializationSanitizer()62 public void enableDeserializationSanitizer() { 63 triggerDeserializationSanitizer(); 64 } 65 66 @Test(expected = FuzzerSecurityIssueHigh.class) enableExpressionLanguageInjectionSanitizer()67 public void enableExpressionLanguageInjectionSanitizer() throws Throwable { 68 triggerExpressionLanguageInjectionSanitizer(); 69 } 70 71 @Test disableReflectiveCallSanitizer()72 public void disableReflectiveCallSanitizer() { 73 System.setProperty( 74 "jazzer.disabled_hooks", "com.code_intelligence.jazzer.sanitizers.ReflectiveCall"); 75 triggerReflectiveCallSanitizer(); 76 } 77 78 @Test disableDeserializationSanitizer()79 public void disableDeserializationSanitizer() { 80 System.setProperty( 81 "jazzer.disabled_hooks", "com.code_intelligence.jazzer.sanitizers.Deserialization"); 82 triggerDeserializationSanitizer(); 83 } 84 85 @Test disableExpressionLanguageSanitizer()86 public void disableExpressionLanguageSanitizer() throws Throwable { 87 System.setProperty("jazzer.disabled_hooks", 88 "com.code_intelligence.jazzer.sanitizers.ExpressionLanguageInjection"); 89 triggerExpressionLanguageInjectionSanitizer(); 90 } 91 92 @Test(expected = FuzzerSecurityIssueHigh.class) disableReflectiveCallAndEnableDeserialization()93 public void disableReflectiveCallAndEnableDeserialization() { 94 System.setProperty( 95 "jazzer.disabled_hooks", "com.code_intelligence.jazzer.sanitizers.ReflectiveCall"); 96 triggerReflectiveCallSanitizer(); 97 triggerDeserializationSanitizer(); 98 } 99 100 @Test disableAllSanitizers()101 public void disableAllSanitizers() throws Throwable { 102 System.setProperty("jazzer.disabled_hooks", 103 "com.code_intelligence.jazzer.sanitizers.ReflectiveCall," 104 + "com.code_intelligence.jazzer.sanitizers.Deserialization," 105 + "com.code_intelligence.jazzer.sanitizers.ExpressionLanguageInjection"); 106 triggerReflectiveCallSanitizer(); 107 triggerExpressionLanguageInjectionSanitizer(); 108 triggerDeserializationSanitizer(); 109 } 110 } 111