Author: reschke
Date: Tue Jan 9 15:39:46 2018
New Revision: 1820674
URL: http://svn.apache.org/viewvc?rev=1820674&view=rev
Log:
OAK-7119: Restrict de-serialization mechanism for older serialized cache map in
DataStoreCacheUtils to the classes required (ported to 1.6)
- Restricted to whitelist of Map, HashMap, Long, Number, String
Modified:
jackrabbit/oak/branches/1.6/oak-core/ (props changed)
jackrabbit/oak/branches/1.6/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java
jackrabbit/oak/branches/1.6/oak-core/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java
Propchange: jackrabbit/oak/branches/1.6/oak-core/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue Jan 9 15:39:46 2018
@@ -1,4 +1,5 @@
/jackrabbit/oak/branches/1.0/oak-core:1665962
+/jackrabbit/oak/trunk/oak-blob-plugins:1819950
/jackrabbit/oak/trunk/oak-core:1781068,1781075,1781248,1781386,1781846,1781907,1782000,1782029,1782196,1782447,1782476,1782770,1782945,1782966,1782973,1782990,1783061,1783066,1783089,1783104-1783105,1783110,1783619,1783720,1783731,1783733,1783738,1783742,1783773,1783855,1783891,1784023,1784034,1784130,1784162,1784251,1784401,1784551,1784574,1784689,1785095,1785108,1785283,1785838,1785917,1785919,1785946,1786122,1787074,1787145,1787151,1787217,1787425,1788056,1788378,1788387-1788389,1788463,1788476,1788850,1789056,1789441,1789534,1790382,1792049,1792463,1792742,1792746,1793013,1793088,1793618,1793627,1793644,1794393,1794417,1794683,1795138,1795314,1795330,1795475,1795488,1795491,1795502,1795594,1795613,1795618,1796144,1796230,1796239,1796274,1796278,1796988,1797378,1798035,1798834,1799219,1799389,1799393,1799924,1800269,1800606,1800613,1800974,1801011,1801013,1801118-1801119,1801675,1802260,1802262,1802286,1802548,1802934,1802938,1802973,1803026,1803247-1803249,1803951,1803953-180395
5,1805851-1805852,1806668,1807308,1807688,1808125,1808128,1808142,1808240,1808246,1809024,1809026,1809131,1809163,1809253,1809255-1809256,1811380,1811952,1811963,1811986,1814332,1818645
/jackrabbit/oak/trunk/oak-store-document:1809866,1811575,1811702,1811709,1811823,1811835,1811931,1812739,1812750,1812753,1814407,1814499,1814579,1815450,1815466,1815940,1816436,1818301,1818303,1818903,1818906,1819421,1820199
/jackrabbit/trunk/oak-core:1345480
Modified:
jackrabbit/oak/branches/1.6/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.6/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java?rev=1820674&r1=1820673&r2=1820674&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.6/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java
(original)
+++
jackrabbit/oak/branches/1.6/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/blob/DataStoreCacheUpgradeUtils.java
Tue Jan 9 15:39:46 2018
@@ -16,12 +16,10 @@
*/
package org.apache.jackrabbit.oak.plugins.blob;
-import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.InputStream;
-import java.io.ObjectInput;
-import java.io.ObjectInputStream;
+import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
@@ -32,6 +30,7 @@ import com.google.common.collect.Maps;
import com.google.common.io.Files;
import org.apache.commons.io.FileUtils;
import org.apache.commons.io.IOUtils;
+import org.apache.commons.io.serialization.ValidatingObjectInputStream;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -63,12 +62,13 @@ public class DataStoreCacheUpgradeUtils
InputStream fis = null;
try {
- fis = new BufferedInputStream(new FileInputStream(path));
- ObjectInput input = new ObjectInputStream(fis);
+ fis = (new FileInputStream(path));
+ ValidatingObjectInputStream input = new
ValidatingObjectInputStream(fis);
+ input.accept(HashMap.class, Map.class, Number.class,
Long.class, String.class);
asyncUploadMap = (Map<String, Long>) input.readObject();
} catch (Exception e) {
- LOG.warn("Error in reading pending uploads map [{}] from
location [{}]", UPLOAD_MAP,
- homeDir);
+ LOG.error("Error in reading pending uploads map [{}] from
location [{}]", UPLOAD_MAP,
+ homeDir, e);
} finally {
IOUtils.closeQuietly(fis);
}
Modified:
jackrabbit/oak/branches/1.6/oak-core/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.6/oak-core/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java?rev=1820674&r1=1820673&r2=1820674&view=diff
==============================================================================
---
jackrabbit/oak/branches/1.6/oak-core/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java
(original)
+++
jackrabbit/oak/branches/1.6/oak-core/src/test/java/org/apache/jackrabbit/oak/plugins/blob/UploadStagingCacheTest.java
Tue Jan 9 15:39:46 2018
@@ -18,6 +18,7 @@
*/
package org.apache.jackrabbit.oak.plugins.blob;
+import java.io.BufferedWriter;
import java.io.File;
import java.io.IOException;
import java.io.InputStream;
@@ -31,10 +32,13 @@ import java.util.concurrent.ScheduledFut
import java.util.concurrent.TimeUnit;
import java.util.concurrent.atomic.AtomicInteger;
+import ch.qos.logback.classic.Level;
+import com.google.common.base.Charsets;
import com.google.common.base.Optional;
import com.google.common.collect.Iterators;
import com.google.common.collect.Lists;
import com.google.common.collect.Maps;
+import com.google.common.io.Closeables;
import com.google.common.io.Closer;
import com.google.common.io.Files;
import com.google.common.util.concurrent.Futures;
@@ -44,7 +48,9 @@ import com.google.common.util.concurrent
import com.google.common.util.concurrent.SettableFuture;
import org.apache.commons.io.FileUtils;
import org.apache.jackrabbit.core.data.DataStoreException;
+import org.apache.jackrabbit.oak.commons.FileIOUtils;
import org.apache.jackrabbit.oak.commons.concurrent.ExecutorCloser;
+import org.apache.jackrabbit.oak.commons.junit.LogCustomizer;
import org.apache.jackrabbit.oak.stats.DefaultStatisticsProvider;
import org.apache.jackrabbit.oak.stats.StatisticsProvider;
import org.junit.After;
@@ -55,9 +61,11 @@ import org.junit.rules.TemporaryFolder;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import static org.hamcrest.CoreMatchers.containsString;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertThat;
import static org.junit.Assert.assertTrue;
/**
@@ -613,6 +621,26 @@ public class UploadStagingCacheTest exte
assertCacheStats(stagingCache, 0, 0, 2, 2);
}
+ @Test
+ public void testUpgradeCompromisedSerializedMap() throws IOException {
+ // Close the init setup
+ closer.close();
+
+ // Create pre-upgrade load
+ File home = folder.newFolder();
+ File pendingUploadsFile = new File(home,
DataStoreCacheUpgradeUtils.UPLOAD_MAP);
+ createGibberishLoad(home, pendingUploadsFile);
+
+ LogCustomizer lc =
LogCustomizer.forLogger(DataStoreCacheUpgradeUtils.class.getName())
+ .filter(Level.WARN)
+ .enable(Level.WARN)
+ .create();
+ lc.starting();
+ // Start
+ init(2, new TestStagingUploader(folder.newFolder()), home);
+ assertThat(lc.getLogs().toString(), containsString("Error in reading
pending uploads map"));
+ }
+
/** -------------------- Helper methods
----------------------------------------------------**/
private void createUpgradeLoad(File home, File pendingUploadFile) throws
IOException {
@@ -624,6 +652,17 @@ public class UploadStagingCacheTest exte
serializeMap(pendingUploads, pendingUploadFile);
}
+
+ private void createGibberishLoad(File home, File pendingUploadFile) throws
IOException {
+ BufferedWriter writer = null;
+ try {
+ writer = Files.newWriter(pendingUploadFile, Charsets.UTF_8);
+ FileIOUtils.writeAsLine(writer,
"jerhgiuheirghoeoorqehgsjlwjpfkkwpkf", false);
+ } finally {
+ Closeables.close(writer, true);
+ }
+ }
+
private void assertUpgrade(File pendingUploadFile) throws IOException {
assertNull(stagingCache.getIfPresent(ID_PREFIX + 1));
assertTrue(Files.equal(copyToFile(randomStream(1, 4 * 1024),
folder.newFile()),
