/*
 * Copyright (C) 2013 XStream Committers.
 * All rights reserved.
 *
 * The software in this package is published under the terms of the BSD
 * style license a copy of which has been included with this distribution in
 * the LICENSE.txt file.
 * 
 * Created on 23. December 2013 by Joerg Schaible
 */
package com.thoughtworks.acceptance;

import java.beans.EventHandler;

import com.thoughtworks.xstream.XStreamException;
import com.thoughtworks.xstream.converters.ConversionException;
import com.thoughtworks.xstream.converters.reflection.ReflectionConverter;

/**
 * @author J&ouml;rg Schaible
 */
public class SecurityVulnerabilityTest extends AbstractAcceptanceTest {

    private final static StringBuffer BUFFER = new StringBuffer();
    
    protected void setUp() throws Exception {
        super.setUp();
        BUFFER.setLength(0);
    }

    public void testCannotInjectEventHandler() {
        String xml = ""
                + "<string class='set'>\n"
                + "  <dynamic-proxy>\n"
                + "    <interface>java.lang.Comparable</interface>\n"
                + "    <handler class='java.beans.EventHandler'>\n"
                + "      <target class='com.thoughtworks.acceptance.SecurityVulnerabilityTest$Run'/>\n"
                + "      <action>run</action>\n"
                + "    </handler>\n"
                + "  </dynamic-proxy>\n"
                + "</string>";
        
        try {
            xstream.fromXML(xml);
            fail("Thrown " + XStreamException.class.getName() + " expected");
        } catch (final XStreamException e) {
            assertTrue(e.getMessage().contains(EventHandler.class.getName()));
        }
        assertEquals(0, BUFFER.length());
    }

    public void testExplicitlyConvertEventHandler() {
        String xml = ""
                + "<string class='tree-set'>\n"
                + "  <dynamic-proxy>\n"
                + "    <interface>java.lang.Comparable</interface>\n"
                + "    <handler class='java.beans.EventHandler'>\n"
                + "      <target class='com.thoughtworks.acceptance.SecurityVulnerabilityTest$Run'/>\n"
                + "      <action>run</action>\n"
                + "    </handler>\n"
                + "  </dynamic-proxy>\n"
                + "  <object/>\n"
                + "</string>";

        xstream.registerConverter(new ReflectionConverter(xstream.getMapper(), xstream
            .getReflectionProvider(), EventHandler.class));
        try {
            xstream.fromXML(xml);
            fail("Thrown " + ConversionException.class.getName() + " expected");
        } catch (final ConversionException e) {
            assertTrue(e.getCause() instanceof RuntimeException);
        }
        
        assertEquals("Did run!", BUFFER.toString());
    }
    
    public static class Run implements Runnable {

        public void run() {
            BUFFER.append("Did run!");
        }
    }
}

@@ -422,72 +422,8 @@
 on;%0A
-import com.thoughtworks.xstream.converters.ConversionException;%0A
 impo
@@ -672,20 +672,16 @@
 ffer();%0A
-    
 %0A    pro
@@ -771,16 +771,67 @@
 gth(0);%0A
+        xstream.alias(%22runnable%22, Runnable.class);%0A
     %7D%0A%0A 
@@ -878,32 +878,38 @@
 ler() %7B%0A        
+final 
 String xml = %22%22%0A
@@ -942,19 +942,30 @@
  class='
-set
+runnable-array
 '%3E%5Cn%22%0A  
@@ -1038,38 +1038,36 @@
 rface%3Ejava.lang.
-Compar
+Runn
 able%3C/interface%3E
@@ -1224,35 +1224,36 @@
 lnerabilityTest$
-Run
+Exec
 '/%3E%5Cn%22%0A         
@@ -1268,35 +1268,36 @@
  %22      %3Caction%3E
-run
+exec
 %3C/action%3E%5Cn%22%0A   
@@ -1402,24 +1402,16 @@
 ring%3E%22;%0A
-        
 %0A       
@@ -1774,16 +1774,22 @@
         
+final 
 String x
@@ -1834,16 +1834,22 @@
 ss='
-tree-set
+runnable-array
 '%3E%5Cn
@@ -1938,14 +1938,12 @@
 ang.
-Compar
+Runn
 able
@@ -2120,19 +2120,20 @@
 ityTest$
-Run
+Exec
 '/%3E%5Cn%22%0A 
@@ -2164,19 +2164,20 @@
 %3Caction%3E
-run
+exec
 %3C/action
@@ -2263,42 +2263,8 @@
 %5Cn%22%0A
-                + %22  %3Cobject/%3E%5Cn%22%0A
     
@@ -2442,269 +2442,141 @@
 ));%0A
-        try %7B%0A            xstream.fromXML(xml);%0A            fail(%22Thrown %22 + ConversionException.class.getName() + %22 expected%22);%0A        %7D catch (final ConversionException e) %7B%0A            assertTrue(e.getCause() instanceof RuntimeException);%0A        %7D%0A        
+%0A        final Runnable%5B%5D array = (Runnable%5B%5D)xstream.fromXML(xml);%0A        assertEquals(0, BUFFER.length());%0A        array%5B0%5D.run();
 %0A   
@@ -2594,23 +2594,24 @@
 Equals(%22
-Did run
+Executed
 !%22, BUFF
@@ -2632,20 +2632,16 @@
 ;%0A    %7D%0A
-    
 %0A    pub
@@ -2661,31 +2661,12 @@
 ass 
-Run implements Runnable
+Exec
  %7B%0A%0A
@@ -2685,19 +2685,20 @@
 ic void 
-run
+exec
 () %7B%0A   
@@ -2725,15 +2725,16 @@
 nd(%22
-Did run
+Executed
 !%22);

Make JDK vendor independent.