[GEODE-7396] JavaBeanAccessorMethodAuthorizer does not authorize methods on java.io classes

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.11.0
• Component/s: querying, security
• Labels: GeodeCommons
• Assignee: Donal Evans
• Reporter: Donal Evans
• Created: 31/Oct/19 18:36
• Updated: 30/Dec/19 18:50
• Resolved: 01/Nov/19 15:02

Description

The following test failed using an authorizer with java.lang and java.io packages specified as allowed. It's unclear at this time if the problem is related specifically to the java.io package or if it is a problem with how the JavaBeanAccessorMethodAuthorizer handles multiple parameters.

 
@Test
  public void test() throws NoSuchMethodException {
    Method disallowedJavaIOMethod = File.class.getMethod("getPath");
    assertThat(authorizerWithStringAndIOPackageSpecified.authorize(allowedJavaIOMethod, new File(""))).isTrue();
  } 

Issue Links

• is a child of: GEODE-6983 Epic for OQL Method Invocation Security
• links to: GitHub Pull Request #4263