Author: amitj
Date: Wed Jan 3 11:19:39 2018
New Revision: 1819950
URL: http://svn.apache.org/viewvc?rev=1819950&view=rev
Log:
OAK-7119: Restrict de-serialization mechanism for older serialized cache map in
DataStoreCacheUtils to the classes required
- Restricted to whitelist of Map, HashMap, Long, Number, String
Modified:
jackrabbit/oak/trunk/oak-blob-plugins/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java
jackrabbit/oak/trunk/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java
Modified:
jackrabbit/oak/trunk/oak-blob-plugins/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-blob-plugins/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java?rev=1819950&r1=1819949&r2=1819950&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-blob-plugins/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java
(original)
+++
jackrabbit/oak/trunk/oak-blob-plugins/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java
Wed Jan 3 11:19:39 2018
@@ -16,12 +16,10 @@
*/
package org.apache.jackrabbit.oak.plugins.blob;
-import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.InputStream;
-import java.io.ObjectInput;
-import java.io.ObjectInputStream;
+import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
@@ -32,6 +30,7 @@ import com.google.common.collect.Maps;
import com.google.common.io.Files;
import org.apache.commons.io.FileUtils;
import org.apache.commons.io.IOUtils;
+import org.apache.commons.io.serialization.ValidatingObjectInputStream;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -63,12 +62,13 @@ public class DataStoreCacheUpgradeUtils
InputStream fis = null;
try {
- fis = new BufferedInputStream(new FileInputStream(path));
- ObjectInput input = new ObjectInputStream(fis);
+ fis = (new FileInputStream(path));
+ ValidatingObjectInputStream input = new
ValidatingObjectInputStream(fis);
+ input.accept(HashMap.class, Map.class, Number.class,
Long.class, String.class);
asyncUploadMap = (Map<String, Long>) input.readObject();
} catch (Exception e) {
- LOG.warn("Error in reading pending uploads map [{}] from
location [{}]", UPLOAD_MAP,
- homeDir);
+ LOG.error("Error in reading pending uploads map [{}] from
location [{}]", UPLOAD_MAP,
+ homeDir, e);
} finally {
IOUtils.closeQuietly(fis);
}
Modified:
jackrabbit/oak/trunk/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java?rev=1819950&r1=1819949&r2=1819950&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java
(original)
+++
jackrabbit/oak/trunk/oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java
Wed Jan 3 11:19:39 2018
@@ -18,6 +18,7 @@
*/
package org.apache.jackrabbit.oak.plugins.blob;
+import java.io.BufferedWriter;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
@@ -31,10 +32,13 @@ import java.util.concurrent.ScheduledFut
import java.util.concurrent.TimeUnit;
import java.util.concurrent.atomic.AtomicInteger;
+import ch.qos.logback.classic.Level;
+import com.google.common.base.Charsets;
import com.google.common.base.Optional;
import com.google.common.collect.Iterators;
import com.google.common.collect.Lists;
import com.google.common.collect.Maps;
+import com.google.common.io.Closeables;
import com.google.common.io.Closer;
import com.google.common.io.Files;
import com.google.common.util.concurrent.Futures;
@@ -44,7 +48,9 @@ import com.google.common.util.concurrent
import com.google.common.util.concurrent.SettableFuture;
import org.apache.commons.io.FileUtils;
import org.apache.jackrabbit.core.data.DataStoreException;
+import org.apache.jackrabbit.oak.commons.FileIOUtils;
import org.apache.jackrabbit.oak.commons.concurrent.ExecutorCloser;
+import org.apache.jackrabbit.oak.commons.junit.LogCustomizer;
import org.apache.jackrabbit.oak.stats.DefaultStatisticsProvider;
import org.apache.jackrabbit.oak.stats.StatisticsProvider;
import org.junit.After;
@@ -55,10 +61,12 @@ import org.junit.rules.TemporaryFolder;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import static org.hamcrest.CoreMatchers.containsString;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertThat;
import static org.junit.Assert.assertTrue;
/**
@@ -631,6 +639,26 @@ public class UploadStagingCacheTest exte
assertCacheStats(stagingCache, 0, 0, 2, 2);
}
+ @Test
+ public void testUpgradeCompromisedSerializedMap() throws IOException {
+ // Close the init setup
+ closer.close();
+
+ // Create pre-upgrade load
+ File home = folder.newFolder();
+ File pendingUploadsFile = new File(home,
DataStoreCacheUpgradeUtils.UPLOAD_MAP);
+ createGibberishLoad(home, pendingUploadsFile);
+
+ LogCustomizer lc =
LogCustomizer.forLogger(DataStoreCacheUpgradeUtils.class.getName())
+ .filter(Level.WARN)
+ .enable(Level.WARN)
+ .create();
+ lc.starting();
+ // Start
+ init(2, new TestStagingUploader(folder.newFolder()), home);
+ assertThat(lc.getLogs().toString(), containsString("Error in reading
pending uploads map"));
+ }
+
/** -------------------- Helper methods
----------------------------------------------------**/
private void createUpgradeLoad(File home, File pendingUploadFile) throws
IOException {
@@ -642,6 +670,17 @@ public class UploadStagingCacheTest exte
serializeMap(pendingUploads, pendingUploadFile);
}
+
+ private void createGibberishLoad(File home, File pendingUploadFile) throws
IOException {
+ BufferedWriter writer = null;
+ try {
+ writer = Files.newWriter(pendingUploadFile, Charsets.UTF_8);
+ FileIOUtils.writeAsLine(writer,
"jerhgiuheirghoeoorqehgsjlwjpfkkwpkf", false);
+ } finally {
+ Closeables.close(writer, true);
+ }
+ }
+
private void assertUpgrade(File pendingUploadFile) throws IOException {
assertNull(stagingCache.getIfPresent(ID_PREFIX + 1));
assertTrue(Files.equal(copyToFile(randomStream(1, 4 * 1024),
folder.newFile()),
