Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
* @version 1.0.0
*/
@API(status = Status.MAINTAINED)
public class AresConfiguration {
public final class AresConfiguration {

private AresConfiguration() {
}
Expand Down
7 changes: 6 additions & 1 deletion src/main/java/de/tum/cit/ase/ares/api/Main.java
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,14 @@

import java.nio.file.Path;

import de.tum.cit.ase.ares.api.localization.Messages;
import de.tum.cit.ase.ares.api.policy.SecurityPolicyReaderAndDirector;

public class Main {
public final class Main {
private Main() {
throw new SecurityException(Messages.localized("security.general.utility.initialization", "Main"));
}

public static void main(String[] args) {
SecurityPolicyReaderAndDirector securityPolicyReaderAndDirector = new SecurityPolicyReaderAndDirector(
Path.of("/Users", "markuspaulsen", "Documents", "Ares2", "src", "main", "resources",
Expand Down
12 changes: 8 additions & 4 deletions src/main/java/de/tum/cit/ase/ares/api/PathActionLevel.java
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,18 @@ public boolean isBelowOrEqual(PathActionLevel other) {
}

public static PathActionLevel getLevelOf(String actions) {
if (actions.contains("execute")) //$NON-NLS-1$
if (actions.contains("execute")) { //$NON-NLS-1$
return EXECUTE;
if (actions.contains("delete")) //$NON-NLS-1$
}
if (actions.contains("delete")) { //$NON-NLS-1$
return DELETE;
if (actions.contains("write")) //$NON-NLS-1$
}
if (actions.contains("write")) { //$NON-NLS-1$
return WRITE;
if (actions.contains("readlink")) //$NON-NLS-1$
}
if (actions.contains("readlink")) { //$NON-NLS-1$
return READLINK;
}
return READ;
}
}
14 changes: 9 additions & 5 deletions src/main/java/de/tum/cit/ase/ares/api/PathType.java
Original file line number Diff line number Diff line change
Expand Up @@ -166,8 +166,9 @@ public boolean isPatternRecursive(String pathPattern) {

private static Path relativizeSafe(Path any, int offset) {
var path = any.normalize().toAbsolutePath();
if (!Objects.equals(path.getRoot(), CURRENT_PATH.getRoot()))
if (!Objects.equals(path.getRoot(), CURRENT_PATH.getRoot())) {
return path;
}
return CURRENT_PATH_HIERARCHY.get(offset).relativize(path).normalize();
}

Expand All @@ -183,18 +184,21 @@ private GlobNormalizationResult(String globPattern) {
String cleaned;
cleaned = GLOB_SINGLE_DOT_ELIMINATION.matcher(globPattern).replaceAll(""); //$NON-NLS-1$
Matcher m;
while ((m = GLOB_DOUBLE_DOT_ELIMINATION.matcher(cleaned)).find())
while ((m = GLOB_DOUBLE_DOT_ELIMINATION.matcher(cleaned)).find()) {
cleaned = m.replaceAll(""); //$NON-NLS-1$
}
var offset = 0;
while (cleaned.startsWith("..")) { //$NON-NLS-1$
if (cleaned.length() == 2)
if (cleaned.length() == 2) {
cleaned = ""; //$NON-NLS-1$
else
} else {
cleaned = cleaned.substring(3);
}
offset++;
}
if (offset >= CURRENT_PATH_HIERARCHY.size())
if (offset >= CURRENT_PATH_HIERARCHY.size()) {
throw new IllegalArgumentException("relative glob pattern for current path requires offset " + offset); //$NON-NLS-1$
}
this.relativeOffset = offset;
this.normalizedGlobPattern = cleaned;
}
Expand Down
3 changes: 2 additions & 1 deletion src/main/java/de/tum/cit/ase/ares/api/TestUtils.java
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,9 @@ public static void privilegedFail(String message) {

public static ThreadGroup getRootThreadGroup() {
ThreadGroup group = Thread.currentThread().getThreadGroup();
for (ThreadGroup tg = group; tg != null; tg = group.getParent())
for (ThreadGroup tg = group; tg != null; tg = group.getParent()) {
group = tg;
}
return group;
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -376,6 +376,13 @@ public void executeAOPTestCase(@Nonnull String architectureMode, @Nonnull String
"threadClassAllowedToBeCreated",
threadCreationExtractor.getPermittedThreadClasses().toArray(String[]::new))
.forEach((k, v) -> JavaAOPTestCase.setJavaAdviceSettingValue(k, v, architectureMode, aopMode));
// The cases above are exhaustive over JavaAOPTestCaseSupported today, so this
// branch is only reachable once a new kind of test case is added. Failing here
// rather than silently applying no advice settings keeps that mistake loud: a
// test case whose settings were never written would run unguarded.
default -> throw new IllegalStateException(
"Ares Security Error (Reason: Ares-Code; Stage: Execution): No advice settings are defined for the security test case "
+ aopTestCaseSupported + ".");
}
}
// </editor-fold>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
* @version 2.0.0
* @since 2.0.0
*/
public class JavaAOPTestCaseSettings {
public final class JavaAOPTestCaseSettings {

/**
* Lock object for synchronizing access to all security-related settings.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
* This class is the entry point for the Java instrumentation agent. It installs
* the agent builder for the different types of file operations.
*/
public class JavaInstrumentationAgent {
public final class JavaInstrumentationAgent {

private JavaInstrumentationAgent() {
throw new SecurityException(JavaInstrumentationAdviceAbstractToolbox
Expand Down Expand Up @@ -56,48 +56,58 @@ public static void premain(String agentArgs, Instrumentation inst) {
java.lang.StackWalker walker = java.lang.StackWalker.getInstance();
walker.walk(stream -> stream.limit(1L).count());

installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanReadFiles,
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_READ_FILES,
JavaInstrumentationBindingDefinitions::createReadPathMethodBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanOverwriteFiles,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_OVERWRITE_FILES,
JavaInstrumentationBindingDefinitions::createOverwritePathMethodBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanCreateFiles,
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_CREATE_FILES,
JavaInstrumentationBindingDefinitions::createCreatePathMethodBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanExecuteFiles,
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_EXECUTE_FILES,
JavaInstrumentationBindingDefinitions::createExecutePathMethodBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanDeleteFiles,
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_DELETE_FILES,
JavaInstrumentationBindingDefinitions::createDeletePathMethodBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanCreateThreads,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_CREATE_THREADS,
JavaInstrumentationBindingDefinitions::createCreateThreadMethodBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanExecuteCommands,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_EXECUTE_COMMANDS,
JavaInstrumentationBindingDefinitions::createExecuteCommandMethodBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanConnectToNetwork,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_CONNECT_TO_NETWORK,
JavaInstrumentationBindingDefinitions::createConnectNetworkMethodBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanSendToNetwork,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_SEND_TO_NETWORK,
JavaInstrumentationBindingDefinitions::createSendNetworkMethodBinding);
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.methodsWhichCanReceiveFromNetwork,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_RECEIVE_FROM_NETWORK,
JavaInstrumentationBindingDefinitions::createReceiveNetworkMethodBinding);

installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanReadFiles,
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_READ_FILES,
JavaInstrumentationBindingDefinitions::createReadPathConstructorBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanOverwriteFiles,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_OVERWRITE_FILES,
JavaInstrumentationBindingDefinitions::createOverwritePathConstructorBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanCreateFiles,
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_CREATE_FILES,
JavaInstrumentationBindingDefinitions::createCreatePathConstructorBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanExecuteFiles,
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_EXECUTE_FILES,
JavaInstrumentationBindingDefinitions::createExecutePathConstructorBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanDeleteFiles,
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_DELETE_FILES,
JavaInstrumentationBindingDefinitions::createDeletePathConstructorBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanCreateThreads,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_CREATE_THREADS,
JavaInstrumentationBindingDefinitions::createCreateThreadConstructorBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanExecuteCommands,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_EXECUTE_COMMANDS,
JavaInstrumentationBindingDefinitions::createExecuteCommandConstructorBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanConnectToNetwork,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_CONNECT_TO_NETWORK,
JavaInstrumentationBindingDefinitions::createConnectNetworkConstructorBinding);
installAgentBuilder(inst, unsafeFactory, JavaInstrumentationPointcutDefinitions.methodsWhichCanSendToNetwork,
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_SEND_TO_NETWORK,
JavaInstrumentationBindingDefinitions::createSendNetworkConstructorBinding);
installAgentBuilder(inst, unsafeFactory,
JavaInstrumentationPointcutDefinitions.methodsWhichCanReceiveFromNetwork,
JavaInstrumentationPointcutDefinitions.METHODS_WHICH_CAN_RECEIVE_FROM_NETWORK,
JavaInstrumentationBindingDefinitions::createReceiveNetworkConstructorBinding);
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -333,9 +333,9 @@ static boolean isClassLoadingInProgress() {
Iterator<StackWalker.StackFrame> iterator = frames.iterator();
while (iterator.hasNext()) {
String className = iterator.next().getClassName();
if (className.startsWith("jdk.internal.loader.") || className.equals("java.lang.ClassLoader")
|| className.equals("java.security.SecureClassLoader")
|| className.equals("java.net.URLClassLoader")) {
if (className.startsWith("jdk.internal.loader.") || "java.lang.ClassLoader".equals(className)
|| "java.security.SecureClassLoader".equals(className)
|| "java.net.URLClassLoader".equals(className)) {
return Boolean.TRUE;
}
}
Expand Down Expand Up @@ -385,9 +385,9 @@ static boolean isProjectSourcesFinderInProgress() {
* architecture test setup.
*/
private static boolean isTrustedSetupUtility(@Nonnull String className) {
return className.equals("de.tum.cit.ase.ares.api.util.ProjectSourcesFinder")
|| className.equals("de.tum.cit.ase.ares.api.structural.testutils.ClassNameScanner")
|| className.equals("de.tum.cit.ase.ares.api.util.FileTools");
return "de.tum.cit.ase.ares.api.util.ProjectSourcesFinder".equals(className)
|| "de.tum.cit.ase.ares.api.structural.testutils.ClassNameScanner".equals(className)
|| "de.tum.cit.ase.ares.api.util.FileTools".equals(className);
}
// </editor-fold>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -691,7 +691,7 @@ private static void checkCommandSystemInteractionImpl(@Nonnull String action, @N
// <editor-fold desc="Get information from settings">
@Nullable
final String aopMode = getValueFromSettings("aopMode");
if (aopMode == null || aopMode.isEmpty() || !aopMode.equals("INSTRUMENTATION")) {
if (aopMode == null || aopMode.isEmpty() || !"INSTRUMENTATION".equals(aopMode)) {
return;
}
@Nullable
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -379,7 +379,7 @@ private static Path variableToPath(@Nullable Object variableValue, boolean allow
return Path.of(url.toURI()).normalize().toAbsolutePath();
} else if (variableValue instanceof String) {
// Empty string is not a valid path
if (variableValue.equals("")) {
if ("".equals(variableValue)) {
throw new SecurityException(localize("security.instrumentation.invalid.path", variableValue));
}
// "/" is the root directory and is a valid path - let it be processed normally
Expand Down Expand Up @@ -1367,7 +1367,7 @@ && isCryptoPolicyPath(pathIllegallyInteractedThroughReceiver)) {
// allowed
// This is a side effect of how the JVM resolves classes and is not a security
// concern
if (pathIllegallyInteractedThroughAttribute.equals("/")) {
if ("/".equals(pathIllegallyInteractedThroughAttribute)) {
isInternalAllowed = true;
}

Expand Down Expand Up @@ -1458,7 +1458,7 @@ public static void checkFileSystemInteraction(@Nonnull String action, @Nonnull S
// <editor-fold desc="Check instrumentation mode early">
@Nullable
final String aopMode = getValueFromSettings("aopMode");
if (aopMode == null || aopMode.isEmpty() || !aopMode.equals("INSTRUMENTATION")) {
if (aopMode == null || aopMode.isEmpty() || !"INSTRUMENTATION".equals(aopMode)) {
return;
}
@Nullable
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -880,7 +880,7 @@ private static void checkNetworkSystemInteractionImpl(@Nonnull String action, @N
// <editor-fold desc="Get information from settings">
@Nullable
final String aopMode = getValueFromSettings("aopMode");
if (aopMode == null || aopMode.isEmpty() || !aopMode.equals("INSTRUMENTATION")) {
if (aopMode == null || aopMode.isEmpty() || !"INSTRUMENTATION".equals(aopMode)) {
return;
}
@Nullable
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -325,7 +325,7 @@ private static boolean isThreadFieldHolder(@Nullable Object variableValue) {
String className = variableClass.getName();

// Check if the class name matches Thread.FieldHolder pattern
return className.equals("java.lang.Thread$FieldHolder")
return "java.lang.Thread$FieldHolder".equals(className)
|| className.endsWith("$FieldHolder") && className.startsWith("java.lang.Thread");
} catch (Exception e) {
return false;
Expand Down Expand Up @@ -617,7 +617,7 @@ private static void checkThreadSystemInteractionImpl(@Nonnull String action, @No
// <editor-fold desc="Get information from settings">
@Nullable
final String aopMode = getValueFromSettings("aopMode");
if (aopMode == null || aopMode.isEmpty() || !aopMode.equals("INSTRUMENTATION")) {
if (aopMode == null || aopMode.isEmpty() || !"INSTRUMENTATION".equals(aopMode)) {
return;
}
@Nullable
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,12 @@
* checks.
*/
public final class JavaInstrumentationConnectNetworkConstructorAdvice {
private JavaInstrumentationConnectNetworkConstructorAdvice() {
throw new SecurityException(
JavaInstrumentationAdviceAbstractToolbox.localize("security.instrumentation.utility.initialization",
"JavaInstrumentationConnectNetworkConstructorAdvice"));
}

/**
* This method is called when a constructor connecting to networks is entered.
* It performs security checks to determine whether the constructor execution is
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@
* checks.
*/
public final class JavaInstrumentationConnectNetworkMethodAdvice {
private JavaInstrumentationConnectNetworkMethodAdvice() {
throw new SecurityException(JavaInstrumentationAdviceAbstractToolbox.localize(
"security.instrumentation.utility.initialization", "JavaInstrumentationConnectNetworkMethodAdvice"));
}

/**
* This method is called when a method connecting to networks is entered. It
* performs security checks to determine whether the method execution is allowed
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,11 @@
* JavaInstrumentationAdviceFileSystemToolbox to perform these security checks.
*/
public final class JavaInstrumentationCreatePathConstructorAdvice {
private JavaInstrumentationCreatePathConstructorAdvice() {
throw new SecurityException(JavaInstrumentationAdviceAbstractToolbox.localize(
"security.instrumentation.utility.initialization", "JavaInstrumentationCreatePathConstructorAdvice"));
}

/**
* This method is called when a constructor creating files is entered. It
* performs security checks to determine whether the constructor execution is
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,11 @@
* JavaInstrumentationAdviceFileSystemToolbox to perform these security checks.
*/
public final class JavaInstrumentationCreatePathMethodAdvice {
private JavaInstrumentationCreatePathMethodAdvice() {
throw new SecurityException(JavaInstrumentationAdviceAbstractToolbox.localize(
"security.instrumentation.utility.initialization", "JavaInstrumentationCreatePathMethodAdvice"));
}

/**
* This method is called when a method creating files is entered. It performs
* security checks to determine whether the method execution is allowed
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@
* checks.
*/
public final class JavaInstrumentationCreateThreadConstructorAdvice {
private JavaInstrumentationCreateThreadConstructorAdvice() {
throw new SecurityException(JavaInstrumentationAdviceAbstractToolbox.localize(
"security.instrumentation.utility.initialization", "JavaInstrumentationCreateThreadConstructorAdvice"));
}

/**
* This method is called when a constructor creating threads is entered. It
* performs security checks to determine whether the constructor execution is
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,11 @@
* checks.
*/
public final class JavaInstrumentationCreateThreadMethodAdvice {
private JavaInstrumentationCreateThreadMethodAdvice() {
throw new SecurityException(JavaInstrumentationAdviceAbstractToolbox.localize(
"security.instrumentation.utility.initialization", "JavaInstrumentationCreateThreadMethodAdvice"));
}

/**
* This method is called when a method creating threads is entered. It performs
* security checks to determine whether the method execution is allowed
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,11 @@
* JavaInstrumentationAdviceFileSystemToolbox to perform these security checks.
*/
public final class JavaInstrumentationDeletePathConstructorAdvice {
private JavaInstrumentationDeletePathConstructorAdvice() {
throw new SecurityException(JavaInstrumentationAdviceAbstractToolbox.localize(
"security.instrumentation.utility.initialization", "JavaInstrumentationDeletePathConstructorAdvice"));
}

/**
* This method is called when a constructor deleting files is entered. It
* performs security checks to determine whether the constructor execution is
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,11 @@
* JavaInstrumentationAdviceFileSystemToolbox to perform these security checks.
*/
public final class JavaInstrumentationDeletePathMethodAdvice {
private JavaInstrumentationDeletePathMethodAdvice() {
throw new SecurityException(JavaInstrumentationAdviceAbstractToolbox.localize(
"security.instrumentation.utility.initialization", "JavaInstrumentationDeletePathMethodAdvice"));
}

/**
* This method is called when a method deleting files is entered. It performs
* security checks to determine whether the method execution is allowed
Expand Down
Loading
Loading