BAEL-4946 moved deserialization vulnerabilities code to a new package

2021-05-19 08:47:02 +01:00
parent 06aa7787bf
commit ef8ca20541
3 changed files with 1 additions and 1 deletions
@@ -0,0 +1,40 @@
+package com.baeldung.deserialization.vulnerabilities;
+
+import org.junit.Test;
+import org.junit.jupiter.api.DisplayName;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.InputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+
+public class BadThingUnitTest {
+
+    @Test
+    @DisplayName("When a BadThing object is deserialized, then code execution in MyCustomAttackObject is run.")
+    public void givenABadThingObject_whenItsDeserialized_thenExecutionIsRun() throws Exception {
+        BadThing bt = new BadThing();
+
+        bt.looselyDefinedThing = new MyCustomAttackObject();
+        bt.methodName = "methodThatTriggersAttack";
+
+        byte[] serializedObject = serialize(bt);
+
+        try (InputStream bis = new ByteArrayInputStream(serializedObject);
+             ObjectInputStream ois = new ObjectInputStream(bis)) {
+
+            ois.readObject(); // malicious code is run
+        }
+    }
+
+    private static byte[] serialize(Object object) throws Exception {
+        try (ByteArrayOutputStream bos = new ByteArrayOutputStream();
+             ObjectOutputStream oos = new ObjectOutputStream(bos)) {
+
+            oos.writeObject(object);
+            oos.flush();
+            return bos.toByteArray();
+        }
+    }
+}