map) {
- System.out.println("John Doe CC#: " + map.getData("John Doe")); //$NON-NLS-2$
- System.out.println("Jane Doe CC#: " + map.getData("Jane Doe")); //$NON-NLS-2$
+ System.out.println("John Doe CC#: " + map.getData("John Doe"));
+ System.out.println("Jane Doe CC#: " + map.getData("Jane Doe"));
}
@SuppressWarnings("unchecked")
diff --git a/JavaSCR/src/main/java/ser02j/SerializableMap.java b/JavaSCR9/src/main/java/ser02j/SerializableMap.java
similarity index 97%
rename from JavaSCR/src/main/java/ser02j/SerializableMap.java
rename to JavaSCR9/src/main/java/ser02j/SerializableMap.java
index 8e6921f..1aa0bfe 100644
--- a/JavaSCR/src/main/java/ser02j/SerializableMap.java
+++ b/JavaSCR9/src/main/java/ser02j/SerializableMap.java
@@ -1,6 +1,6 @@
// The MIT License (MIT)
//
-// Copyright (c) 2017 Robert C. Seacord
+// Copyright (c) 2019 Robert C. Seacord
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
diff --git a/JavaSCR/src/main/java/ser03j/Malicious.java b/JavaSCR9/src/main/java/ser03j/Malicious.java
similarity index 75%
rename from JavaSCR/src/main/java/ser03j/Malicious.java
rename to JavaSCR9/src/main/java/ser03j/Malicious.java
index a0f8c97..a43f811 100644
--- a/JavaSCR/src/main/java/ser03j/Malicious.java
+++ b/JavaSCR9/src/main/java/ser03j/Malicious.java
@@ -1,6 +1,6 @@
// The MIT License (MIT)
//
-// Copyright (c) 2017 Robert C. Seacord
+// Copyright (c) 2019 Robert C. Seacord
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
@@ -22,25 +22,12 @@
package ser03j;
+import serial.Serial;
+
import java.io.*;
class Malicious {
- private static byte[] serialize(Object o) throws IOException {
- try (ByteArrayOutputStream ba = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(ba)) {
- oos.writeObject(o);
- return ba.toByteArray();
- }
- }
-
- private static Object deserialize(byte[] buffer) throws IOException, ClassNotFoundException {
- Object obj;
- try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(buffer))) {
- obj = ois.readObject();
- }
- return obj;
- }
-
/**
* Copies a specified Object by serializing then deserializing the object.
*
@@ -50,7 +37,7 @@ private static Object deserialize(byte[] buffer) throws IOException, ClassNotFou
* @return copy of obj
*/
private static Object serialCopy(Object obj) throws IOException, ClassNotFoundException {
- return deserialize(serialize(obj));
+ return Serial.deserialize(Serial.serialize(obj));
} // end serialCopy()
public static void main(String[] args) throws IOException, ClassNotFoundException {
diff --git a/JavaSCR/src/main/java/ser03j/Singleton.java b/JavaSCR9/src/main/java/ser03j/Singleton.java
similarity index 96%
rename from JavaSCR/src/main/java/ser03j/Singleton.java
rename to JavaSCR9/src/main/java/ser03j/Singleton.java
index 802de84..77e415a 100644
--- a/JavaSCR/src/main/java/ser03j/Singleton.java
+++ b/JavaSCR9/src/main/java/ser03j/Singleton.java
@@ -22,10 +22,6 @@
package ser03j;
-import java.io.IOException;
-import java.io.NotSerializableException;
-import java.io.ObjectStreamException;
-
public final class Singleton extends Number {
private static final long serialVersionUID = 1L;
private static final Singleton INSTANCE = new Singleton();
diff --git a/JavaSCR/src/main/java/ser04j/Hometown.java b/JavaSCR9/src/main/java/ser04j/Hometown.java
similarity index 64%
rename from JavaSCR/src/main/java/ser04j/Hometown.java
rename to JavaSCR9/src/main/java/ser04j/Hometown.java
index 1fb0885..9482744 100644
--- a/JavaSCR/src/main/java/ser04j/Hometown.java
+++ b/JavaSCR9/src/main/java/ser04j/Hometown.java
@@ -1,6 +1,6 @@
// The MIT License (MIT)
//
-// Copyright (c) 2018 Robert C. Seacord
+// Copyright (c) 2022 Robert C. Seacord
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
@@ -22,14 +22,9 @@
package ser04j;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
-import java.io.Serializable;
-import java.nio.file.AccessDeniedException;
+import java.io.*;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.*;
public final class Hometown implements Serializable {
private static final long serialVersionUID = 6515419803685137985L;
@@ -64,7 +59,6 @@ public void setTown(String newTown) throws AccessDeniedException {
@SuppressWarnings("static-method")
private void writeObject(ObjectOutputStream out) throws IOException {
- System.out.println("writeObject called");
out.defaultWriteObject();
}
@@ -75,14 +69,63 @@ private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundE
this.town = readTown;
}
+ // tamper with the serialized data to change home town to Moscow
+ public static void makeWarsawMoscow(String fileName) throws IOException {
+ RandomAccessFile hometownFile = new RandomAccessFile(fileName, "rw");
+ byte[] buffer1 = new byte[100];
+ byte[] buffer2 = new byte[4];
+ byte[] moscowBytes = "Moscow".getBytes(StandardCharsets.US_ASCII);
+
+ // home town name starts 68 bytes in
+ hometownFile.readFully(buffer1, 0, 67);
+
+ // skip over "Warsaw" in file
+ if (moscowBytes.length != hometownFile.skipBytes(moscowBytes.length)) {
+ throw new RuntimeException("Failed to modify hometown file.");
+ }
+
+ // read the rest of the file
+ int endLength = hometownFile.read(buffer2);
+
+ hometownFile.close();
+
+ // copy moscow to serialization data
+ System.arraycopy(moscowBytes, 0, buffer1, 67, moscowBytes.length);
+
+ // copy the end of the serialized data
+ System.arraycopy(buffer2, 0, buffer1, 67+moscowBytes.length, endLength);
+
+ // delete the original serialized file
+ // new File(fileName).delete();
+
+ try {
+ Files.delete(Paths.get(fileName));
+ } catch (NoSuchFileException x) {
+ System.err.format("%s: no such" + " file or directory%n", fileName);
+ } catch (DirectoryNotEmptyException x) {
+ System.err.format("%s not empty%n", fileName);
+ } catch (IOException x) {
+ // File permission problems are caught here.
+ System.err.format("File permission error deleting %s%n", fileName);
+ }
+
+ // create a new serialized file with our modified hometown
+ FileOutputStream serialOS = new FileOutputStream(fileName);
+ serialOS.write(buffer1);
+ serialOS.close();
+ }
+
public static void main(String[] args) throws IOException, ClassNotFoundException {
// Create Hometown object
Hometown ht = new Hometown("Warsaw");
- System.out.println("Home town is " + ht.getTown());
+ System.out.println("My home town is " + ht.getTown());
try (ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("tempdata.ser"))
) {
oos.writeObject(ht);
}
+
+ makeWarsawMoscow("tempdata.ser");
+
// Construct a new object through deserialization
try (
// Edit tempdata.ser in %userprofile%\git\JavaSCR
@@ -90,7 +133,7 @@ public static void main(String[] args) throws IOException, ClassNotFoundExceptio
) {
ht = (Hometown) ois.readObject();
}
- System.out.println("My town is " + ht.getTown());
+ System.out.println("My home town is " + ht.getTown());
// Clean up the file
if (!new File("tempdata.ser").delete()) {
diff --git a/JavaSCR/src/main/java/ser06j/SerialDOS.java b/JavaSCR9/src/main/java/ser06j/SerialDOS.java
similarity index 74%
rename from JavaSCR/src/main/java/ser06j/SerialDOS.java
rename to JavaSCR9/src/main/java/ser06j/SerialDOS.java
index b8c61ad..5f95244 100644
--- a/JavaSCR/src/main/java/ser06j/SerialDOS.java
+++ b/JavaSCR9/src/main/java/ser06j/SerialDOS.java
@@ -1,6 +1,6 @@
// The MIT License (MIT)
//
-// Copyright (c) 2017 Robert C. Seacord
+// Copyright (c) 2019 Robert C. Seacord
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
@@ -22,28 +22,15 @@
package ser06j;
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
+import ser09j.Bicycle;
import java.io.IOException;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
import java.util.HashSet;
import java.util.Set;
+import serial.Serial;
// java serialization DoS
public class SerialDOS {
- static byte[] serialize(Object o) throws IOException {
- try (ByteArrayOutputStream ba = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(ba)) {
- oos.writeObject(o);
- return ba.toByteArray();
- }
- }
-
- static Object deserialize(byte[] bytes) throws ClassNotFoundException, IOException {
- return new ObjectInputStream(new ByteArrayInputStream(bytes)).readObject();
- }
-
// Deserializing the HashSet will recurse indefinitely, consuming CPU
static byte[] DoSpayload() throws IOException {
Set