From 7cd0269e6c446d5a8cbc0667255aee36c42b9b53 Mon Sep 17 00:00:00 2001 From: Aman Sharma Date: Wed, 16 Aug 2023 13:13:26 +0200 Subject: [PATCH 1/6] test: reproduce #54 --- .../it/GenerateMojoIT/load_jdk_class/pom.xml | 43 +++++++ .../src/main/java/com/sun/CustomClass.java | 7 ++ pom.xml | 7 +- watchdog-agent/pom.xml | 20 ++++ watchdog-agent/src/test/java/AgentTest.java | 111 ++++++++++++++++++ .../src/test/resources/load_jdk_class | 1 + 6 files changed, 188 insertions(+), 1 deletion(-) create mode 100644 classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class/pom.xml create mode 100644 classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class/src/main/java/com/sun/CustomClass.java create mode 100644 watchdog-agent/src/test/java/AgentTest.java create mode 120000 watchdog-agent/src/test/resources/load_jdk_class diff --git a/classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class/pom.xml b/classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class/pom.xml new file mode 100644 index 00000000..398fea21 --- /dev/null +++ b/classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class/pom.xml @@ -0,0 +1,43 @@ + + + 4.0.0 + + org.example + jdk_class + 1.0-SNAPSHOT + + + 15 + 15 + + + + + + org.apache.maven.plugins + maven-assembly-plugin + 3.6.0 + + + + com.sun.CustomClass + + + + jar-with-dependencies + + + + + make-assembly + package + + single + + + + + + + + diff --git a/classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class/src/main/java/com/sun/CustomClass.java b/classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class/src/main/java/com/sun/CustomClass.java new file mode 100644 index 00000000..b4086908 --- /dev/null +++ b/classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class/src/main/java/com/sun/CustomClass.java @@ -0,0 +1,7 @@ +package com.sun; + +public class CustomClass { + public static void main(String[] args) { + System.out.println("Hello World!"); + } +} diff --git a/pom.xml b/pom.xml index 8a87d1d1..19c2ac00 100644 --- a/pom.xml +++ b/pom.xml @@ -60,7 +60,12 @@ org.junit.jupiter junit-jupiter-api - 5.10.0 + 5.8.2 + + + org.apache.maven.shared + maven-invoker + 3.2.0 diff --git a/watchdog-agent/pom.xml b/watchdog-agent/pom.xml index 98a872c6..ee7e5792 100644 --- a/watchdog-agent/pom.xml +++ b/watchdog-agent/pom.xml @@ -50,6 +50,14 @@ asm-util 9.5 + + org.junit.jupiter + junit-jupiter-api + + + org.apache.maven.shared + maven-invoker + @@ -96,6 +104,18 @@ package + + + shade-for-test + + shade + + package + + ${project.build.directory}/classes + ${project.artifactId} + + diff --git a/watchdog-agent/src/test/java/AgentTest.java b/watchdog-agent/src/test/java/AgentTest.java new file mode 100644 index 00000000..e91b522b --- /dev/null +++ b/watchdog-agent/src/test/java/AgentTest.java @@ -0,0 +1,111 @@ +import static org.assertj.core.api.Assertions.assertThat; + +import io.github.algomaster99.Terminator; +import java.io.File; +import java.io.IOException; +import java.io.InputStream; +import java.nio.file.FileVisitResult; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.nio.file.SimpleFileVisitor; +import java.nio.file.StandardCopyOption; +import java.nio.file.attribute.BasicFileAttributes; +import java.util.List; +import org.apache.maven.shared.invoker.DefaultInvocationRequest; +import org.apache.maven.shared.invoker.DefaultInvoker; +import org.apache.maven.shared.invoker.InvocationRequest; +import org.apache.maven.shared.invoker.InvocationResult; +import org.apache.maven.shared.invoker.Invoker; +import org.apache.maven.shared.invoker.MavenInvocationException; +import org.junit.jupiter.api.Test; + +public class AgentTest { + @Test + void shouldDisallowLoadingCustomJDKClass() throws MavenInvocationException, IOException, InterruptedException { + // contract: watchdog-agent should detect if the class masquerading as an internal class + + Path project = Paths.get("src/test/resources/load_jdk_class"); + + recursiveDeleteOnShutdownHook(project.resolve("target")); + + InvocationRequest request = new DefaultInvocationRequest(); + File pomFile = project.resolve("pom.xml").toFile(); + request.setPomFile(pomFile); + request.setGoals(List.of("clean", "package")); + + Invoker invoker = new DefaultInvoker(); + InvocationResult result = invoker.execute(request); + + assertThat(result.getExitCode()).isEqualTo(0); + + String fingerprintFile = + project.resolve("target").resolve("classfile.sha256.jsonl").toString(); + deleteContentsOfFile(fingerprintFile); + + String agentArgs = "fingerprints=" + fingerprintFile; + String[] cmd = { + "java", + "-javaagent:" + getAgentPath(agentArgs), + "-jar", + project.resolve("target") + .resolve("jdk_class-1.0-SNAPSHOT-jar-with-dependencies.jar") + .toString() + }; + ProcessBuilder pb = new ProcessBuilder(cmd); + pb.redirectInput(ProcessBuilder.Redirect.INHERIT); + pb.redirectOutput(ProcessBuilder.Redirect.INHERIT); + pb.redirectError(ProcessBuilder.Redirect.INHERIT); + + Process p = pb.start(); + int exitCode = p.waitFor(); + + assertThat(exitCode).isEqualTo(1); + } + + private static void deleteContentsOfFile(String file) throws InterruptedException, IOException { + String[] deleteFile = {"rm", "-f", file}; + Runtime.getRuntime().exec(deleteFile).waitFor(); + + String[] createFile = {"touch", file}; + Runtime.getRuntime().exec(createFile).waitFor(); + } + + private static String getAgentPath(String agentArgs) throws IOException { + String tempDir = System.getProperty("java.io.tmpdir"); + Path traceCollector = Path.of(tempDir, "watchdog-agent.jar"); + + try (InputStream traceCollectorStream = Terminator.class.getResourceAsStream("/watchdog-agent.jar")) { + Files.copy(traceCollectorStream, traceCollector, StandardCopyOption.REPLACE_EXISTING); + } + + return traceCollector.toAbsolutePath() + "=" + agentArgs; + } + + private static void recursiveDeleteOnShutdownHook(final Path path) { + Runtime.getRuntime().addShutdownHook(new Thread(() -> { + try { + Files.walkFileTree(path, new SimpleFileVisitor<>() { + @Override + public FileVisitResult visitFile(Path file, @SuppressWarnings("unused") BasicFileAttributes attrs) + throws IOException { + Files.delete(file); + return FileVisitResult.CONTINUE; + } + + @Override + public FileVisitResult postVisitDirectory(Path dir, IOException e) throws IOException { + if (e == null) { + Files.delete(dir); + return FileVisitResult.CONTINUE; + } + // directory iteration failed + throw e; + } + }); + } catch (IOException e) { + throw new RuntimeException("Failed to delete " + path, e); + } + })); + } +} diff --git a/watchdog-agent/src/test/resources/load_jdk_class b/watchdog-agent/src/test/resources/load_jdk_class new file mode 120000 index 00000000..d43b0887 --- /dev/null +++ b/watchdog-agent/src/test/resources/load_jdk_class @@ -0,0 +1 @@ +/home/aman/personal/who-are-you/classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class \ No newline at end of file From 56349e6cbf6dadab8993fd0752c0ce9affaf88c5 Mon Sep 17 00:00:00 2001 From: Aman Sharma Date: Wed, 16 Aug 2023 13:26:08 +0200 Subject: [PATCH 2/6] Modify workflow --- .github/workflows/tests.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index afe58ca6..167b108f 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -18,5 +18,8 @@ jobs: with: distribution: 'oracle' java-version: '17' + - name: Build project + # We need to build the agent first, because the tests depend on it + run: mvn clean install -DskipTests - name: Run tests - run: mvn clean install + run: mvn test From 480995096bb2bad3fc4e8f8f304cb705280ab261 Mon Sep 17 00:00:00 2001 From: Aman Sharma Date: Wed, 16 Aug 2023 18:05:09 +0200 Subject: [PATCH 3/6] Delete if exists --- watchdog-agent/src/test/java/AgentTest.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/watchdog-agent/src/test/java/AgentTest.java b/watchdog-agent/src/test/java/AgentTest.java index e91b522b..91c25315 100644 --- a/watchdog-agent/src/test/java/AgentTest.java +++ b/watchdog-agent/src/test/java/AgentTest.java @@ -89,14 +89,14 @@ private static void recursiveDeleteOnShutdownHook(final Path path) { @Override public FileVisitResult visitFile(Path file, @SuppressWarnings("unused") BasicFileAttributes attrs) throws IOException { - Files.delete(file); + Files.deleteIfExists(file); return FileVisitResult.CONTINUE; } @Override public FileVisitResult postVisitDirectory(Path dir, IOException e) throws IOException { if (e == null) { - Files.delete(dir); + Files.deleteIfExists(dir); return FileVisitResult.CONTINUE; } // directory iteration failed From 6f8b89980a75023e50cf4575917e4aef81efa433 Mon Sep 17 00:00:00 2001 From: Aman Sharma Date: Wed, 16 Aug 2023 18:31:20 +0200 Subject: [PATCH 4/6] Duplicate test resource --- .../src/test/resources/load_jdk_class | 1 - .../src/test/resources/load_jdk_class/pom.xml | 43 +++++++++++++++++++ .../src/main/java/com/sun/CustomClass.java | 7 +++ 3 files changed, 50 insertions(+), 1 deletion(-) delete mode 120000 watchdog-agent/src/test/resources/load_jdk_class create mode 100644 watchdog-agent/src/test/resources/load_jdk_class/pom.xml create mode 100644 watchdog-agent/src/test/resources/load_jdk_class/src/main/java/com/sun/CustomClass.java diff --git a/watchdog-agent/src/test/resources/load_jdk_class b/watchdog-agent/src/test/resources/load_jdk_class deleted file mode 120000 index d43b0887..00000000 --- a/watchdog-agent/src/test/resources/load_jdk_class +++ /dev/null @@ -1 +0,0 @@ -/home/aman/personal/who-are-you/classfile-fingerprint/src/test/resources-its/io/github/algomaster99/it/GenerateMojoIT/load_jdk_class \ No newline at end of file diff --git a/watchdog-agent/src/test/resources/load_jdk_class/pom.xml b/watchdog-agent/src/test/resources/load_jdk_class/pom.xml new file mode 100644 index 00000000..398fea21 --- /dev/null +++ b/watchdog-agent/src/test/resources/load_jdk_class/pom.xml @@ -0,0 +1,43 @@ + + + 4.0.0 + + org.example + jdk_class + 1.0-SNAPSHOT + + + 15 + 15 + + + + + + org.apache.maven.plugins + maven-assembly-plugin + 3.6.0 + + + + com.sun.CustomClass + + + + jar-with-dependencies + + + + + make-assembly + package + + single + + + + + + + + diff --git a/watchdog-agent/src/test/resources/load_jdk_class/src/main/java/com/sun/CustomClass.java b/watchdog-agent/src/test/resources/load_jdk_class/src/main/java/com/sun/CustomClass.java new file mode 100644 index 00000000..b4086908 --- /dev/null +++ b/watchdog-agent/src/test/resources/load_jdk_class/src/main/java/com/sun/CustomClass.java @@ -0,0 +1,7 @@ +package com.sun; + +public class CustomClass { + public static void main(String[] args) { + System.out.println("Hello World!"); + } +} From 7d9eebaf9db5fb405b94068bfefe4f41d07fef0a Mon Sep 17 00:00:00 2001 From: Aman Sharma Date: Wed, 16 Aug 2023 18:36:09 +0200 Subject: [PATCH 5/6] Disable test for now --- watchdog-agent/src/test/java/AgentTest.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/watchdog-agent/src/test/java/AgentTest.java b/watchdog-agent/src/test/java/AgentTest.java index 91c25315..d22a012d 100644 --- a/watchdog-agent/src/test/java/AgentTest.java +++ b/watchdog-agent/src/test/java/AgentTest.java @@ -18,9 +18,11 @@ import org.apache.maven.shared.invoker.InvocationResult; import org.apache.maven.shared.invoker.Invoker; import org.apache.maven.shared.invoker.MavenInvocationException; +import org.junit.jupiter.api.Disabled; import org.junit.jupiter.api.Test; public class AgentTest { + @Disabled("Should be worked upon after the input is from an SBOM and not maven project") @Test void shouldDisallowLoadingCustomJDKClass() throws MavenInvocationException, IOException, InterruptedException { // contract: watchdog-agent should detect if the class masquerading as an internal class From a7937164a9f03b6f41c676c514f8be8b5d7f32e5 Mon Sep 17 00:00:00 2001 From: Aman Sharma Date: Wed, 16 Aug 2023 18:40:10 +0200 Subject: [PATCH 6/6] Revert accidental package downgrade --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 19c2ac00..25b3380f 100644 --- a/pom.xml +++ b/pom.xml @@ -60,7 +60,7 @@ org.junit.jupiter junit-jupiter-api - 5.8.2 + 5.10.0 org.apache.maven.shared