-
Notifications
You must be signed in to change notification settings - Fork 5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CAMEL-11929: camel-castor - Add more configuration
- Loading branch information
Showing
9 changed files
with
307 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
96 changes: 96 additions & 0 deletions
96
...camel-castor/src/main/java/org/apache/camel/dataformat/castor/WhitelistObjectFactory.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| /** | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.camel.dataformat.castor; | ||
|
|
||
| import org.apache.camel.util.EndpointHelper; | ||
| import org.exolab.castor.util.DefaultObjectFactory; | ||
|
|
||
| public class WhitelistObjectFactory extends DefaultObjectFactory { | ||
|
|
||
| private String allowClasses; | ||
| private String denyClasses; | ||
|
|
||
| public String getAllowClasses() { | ||
| return allowClasses; | ||
| } | ||
|
|
||
| public void setAllowClasses(String allowClasses) { | ||
| this.allowClasses = allowClasses; | ||
| } | ||
|
|
||
| public String getDenyClasses() { | ||
| return denyClasses; | ||
| } | ||
|
|
||
| public void setDenyClasses(String denyClasses) { | ||
| this.denyClasses = denyClasses; | ||
| } | ||
|
|
||
| @Override | ||
| public Object createInstance(Class type) throws IllegalAccessException, InstantiationException { | ||
| if (allowCreate(type)) { | ||
| return super.createInstance(type); | ||
| } else { | ||
| throw new IllegalAccessException("Not allowed to create class of type: " + type); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public Object createInstance(Class type, Object[] args) throws IllegalAccessException, InstantiationException { | ||
| if (allowCreate(type)) { | ||
| return super.createInstance(type, args); | ||
| } else { | ||
| throw new IllegalAccessException("Not allowed to create class of type: " + type); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public Object createInstance(Class type, Class[] argTypes, Object[] args) throws IllegalAccessException, InstantiationException { | ||
| if (allowCreate(type)) { | ||
| return super.createInstance(type, argTypes, args); | ||
| } else { | ||
| throw new IllegalAccessException("Not allowed to create class of type: " + type); | ||
| } | ||
| } | ||
|
|
||
| private boolean allowCreate(Class type) { | ||
| String name = type.getName(); | ||
|
|
||
| // deny takes precedence | ||
| if (denyClasses != null) { | ||
| String[] arr = denyClasses.split(","); | ||
| for (String key : arr) { | ||
| if (EndpointHelper.matchPattern(name, key)) { | ||
| return false; | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // deny takes precedence | ||
| if (allowClasses != null) { | ||
| String[] arr = allowClasses.split(","); | ||
| for (String key : arr) { | ||
| if (EndpointHelper.matchPattern(name, key)) { | ||
| return true; | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // deny by default | ||
| return false; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
60 changes: 60 additions & 0 deletions
60
components/camel-castor/src/test/java/org/apache/camel/dataformat/castor/WhitelistTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| /** | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.camel.dataformat.castor; | ||
|
|
||
| import org.apache.camel.RoutesBuilder; | ||
| import org.apache.camel.builder.RouteBuilder; | ||
| import org.apache.camel.test.junit4.CamelTestSupport; | ||
| import org.junit.Test; | ||
|
|
||
| public class WhitelistTest extends CamelTestSupport { | ||
|
|
||
| @Test | ||
| public void testDeny() throws Exception { | ||
| final String stuff = "<x xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:java=\"http://java.sun.com\"" | ||
| + " xsi:type=\"java:org.springframework.beans.factory.config.PropertyPathFactoryBean\">" | ||
| + "<target-bean-name>ldap://localhost:1389/obj</target-bean-name><property-path>foo</property-path>" | ||
| + "<bean-factory xsi:type=\"java:org.springframework.jndi.support.SimpleJndiBeanFactory\">" | ||
| + "<shareable-resource>ldap://localhost:1389/obj</shareable-resource></bean-factory></x>"; | ||
|
|
||
| try { | ||
| template.sendBody("direct:unmarshal", stuff); | ||
| fail("Should throw an error"); | ||
| } catch (Exception e) { | ||
| IllegalAccessException iae = assertIsInstanceOf(IllegalAccessException.class, e.getCause().getCause()); | ||
| assertNotNull(iae); | ||
| assertTrue(iae.getMessage().startsWith("Not allowed to create class of type: class org.springframework.beans.factory.config.PropertyPathFactoryBean")); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| protected RoutesBuilder createRouteBuilder() throws Exception { | ||
| CastorDataFormat castor = new CastorDataFormat(); | ||
| // note that whitelist is enabled by default | ||
| // castor.setWhitlistEnabled(true); | ||
| // and that everything is denied by default | ||
| // so you would need to configure allow to enable safe classes to be loaded | ||
| // castor.setDeniedUnmarshallObjects("org.spring.*"); | ||
|
|
||
| return new RouteBuilder() { | ||
| @Override | ||
| public void configure() throws Exception { | ||
| from("direct:unmarshal").unmarshal(castor).to("mock:unmarshal"); | ||
| } | ||
| }; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.