From 652c6717d88ef62dd6fea2d7a95f671f6e77b394 Mon Sep 17 00:00:00 2001
From: alexp <unknown>
Date: Fri, 1 Oct 2010 18:39:44 +0400
Subject: [PATCH] 6622002: UIDefault.ProxyLazyValue has unsafe reflection usage
 Reviewed-by: malenkov

---
 src/share/classes/javax/swing/UIDefaults.java | 14 ++++
 .../swing/UIDefaults/6622002/bug6622002.java  | 64 +++++++++++++++++++
 2 files changed, 78 insertions(+)
 create mode 100644 test/javax/swing/UIDefaults/6622002/bug6622002.java

diff --git a/src/share/classes/javax/swing/UIDefaults.java b/src/share/classes/javax/swing/UIDefaults.java
index 2c9f2c34e..2a9056f53 100644
--- a/src/share/classes/javax/swing/UIDefaults.java
+++ b/src/share/classes/javax/swing/UIDefaults.java
@@ -52,6 +52,7 @@ import java.security.AccessControlContext;
 import java.security.PrivilegedAction;
 
 import sun.reflect.misc.MethodUtil;
+import sun.reflect.misc.ReflectUtil;
 import sun.util.CoreResourceBundleControl;
 
 /**
@@ -1078,6 +1079,9 @@ public class UIDefaults extends Hashtable<Object,Object>
             // In order to pick up the security policy in effect at the
             // time of creation we use a doPrivileged with the
             // AccessControlContext that was in place when this was created.
+            if (acc == null && System.getSecurityManager() != null) {
+                throw new SecurityException("null AccessControlContext");
+            }
             return AccessController.doPrivileged(new PrivilegedAction<Object>() {
                 public Object run() {
                     try {
@@ -1093,7 +1097,9 @@ public class UIDefaults extends Hashtable<Object,Object>
                                 cl = ClassLoader.getSystemClassLoader();
                             }
                         }
+                        ReflectUtil.checkPackageAccess(className);
                         c = Class.forName(className, true, (ClassLoader)cl);
+                        checkAccess(c.getModifiers());
                         if (methodName != null) {
                             Class[] types = getClassArray(args);
                             Method m = c.getMethod(methodName, types);
@@ -1101,6 +1107,7 @@ public class UIDefaults extends Hashtable<Object,Object>
                         } else {
                             Class[] types = getClassArray(args);
                             Constructor constructor = c.getConstructor(types);
+                            checkAccess(constructor.getModifiers());
                             return constructor.newInstance(args);
                         }
                     } catch(Exception e) {
@@ -1115,6 +1122,13 @@ public class UIDefaults extends Hashtable<Object,Object>
             }, acc);
         }
 
+        private void checkAccess(int modifiers) {
+            if(System.getSecurityManager() != null &&
+                    !Modifier.isPublic(modifiers)) {
+                throw new SecurityException("Resource is not accessible");
+            }
+        }
+
         /*
          * Coerce the array of class types provided into one which
          * looks the way the Reflection APIs expect.  This is done
diff --git a/test/javax/swing/UIDefaults/6622002/bug6622002.java b/test/javax/swing/UIDefaults/6622002/bug6622002.java
new file mode 100644
index 000000000..afd883b1e
--- /dev/null
+++ b/test/javax/swing/UIDefaults/6622002/bug6622002.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug 6622002
+ * @author Alexander Potochkin
+ * @summary UIDefault.ProxyLazyValue has unsafe reflection usage
+ */
+
+import javax.swing.*;
+
+public class bug6622002 {
+     public static void main(String[] args) {
+
+         if (createPrivateValue() == null) {
+             throw new RuntimeException("The private value unexpectedly wasn't created");
+         }
+
+         if (createPublicValue() == null) {
+             throw new RuntimeException("The public value unexpectedly wasn't created");
+         }
+
+         System.setSecurityManager(new SecurityManager());
+
+         if (createPrivateValue() != null) {
+             throw new RuntimeException("The private value was unexpectedly created");
+         }
+
+         if (createPublicValue() == null) {
+             throw new RuntimeException("The public value unexpectedly wasn't created");
+         }
+     }
+
+    private static Object createPrivateValue() {
+        return new UIDefaults.ProxyLazyValue(
+            "javax.swing.MultiUIDefaults").createValue(null);
+    }
+
+    private static Object createPublicValue() {
+        return new UIDefaults.ProxyLazyValue(
+            "javax.swing.UIDefaults").createValue(null);
+    }
+}
-- 
GitLab