paulk-asert commented on code in PR #2864:
URL: https://github.com/apache/groovy/pull/2864#discussion_r3930106933
##########
src/test/groovy/groovy/lang/ClosureSerializationCycleTest.groovy:
##########
@@ -215,6 +269,56 @@ final class ClosureSerializationCycleTest {
serialize(trampoline)
}
+ static byte[] serializeCyclicWritable() {
+ def writable = { x -> x }.asWritable()
+ setDeclaredField(writable, 'owner', writable)
+ setDeclaredField(writable, 'delegate', writable)
+ serialize(writable)
+ }
+
+ static byte[] serializeMemoized() {
+ serialize({ x -> x * 2 }.memoize())
+ }
+
+ static byte[] serializeCyclicMemoized() {
+ def memoized = { x -> x * 2 }.memoize()
+ setDeclaredField(memoized, 'closure', memoized)
+ serialize(memoized)
+ }
+
+ static byte[] serializeCyclicSoftMemoized() {
+ // A real instance cannot be serialized: it holds a non-transient
ReferenceQueue. A forged
+ // gadget stream is hand-written and under no such constraint, so
the unserializable fields
+ // are cleared here to produce the stream an attacker would simply
author.
+ def memoized = { x -> x * 2 }.memoizeAtLeast(4)
+ setDeclaredField(memoized, 'queue', null)
+ setDeclaredField(memoized, 'lruProtectionStorage', null)
+ setDeclaredField(memoized, 'closure', memoized)
+ serialize(memoized)
+ }
+
+ static byte[] serializePredicateClosure() {
+ serialize(org.apache.groovy.util.Closures.from({ n -> n % 2 == 0 }
as java.util.function.Predicate))
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
