From 6c750f414961b3956919ef457d1bf1eb82064d15 Mon Sep 17 00:00:00 2001 From: Jim Hahn Date: Thu, 18 Jun 2020 10:42:08 -0400 Subject: More sonar issues in policy-common Addressed the following sonar issues: - add parameters to types - ObjectInputStream.readObject() is unsafe Issue-ID: POLICY-2650 Change-Id: I41e1bd08643b04f409ce87c884cb0c28995e431b Signed-off-by: Jim Hahn --- .../onap/policy/common/utils/io/Serializer.java | 10 ++++-- .../policy/common/utils/test/ToStringTester.java | 7 ++-- .../policy/common/utils/io/SerializerTest.java | 37 ++++++++++++---------- 3 files changed, 31 insertions(+), 23 deletions(-) diff --git a/utils-test/src/main/java/org/onap/policy/common/utils/io/Serializer.java b/utils-test/src/main/java/org/onap/policy/common/utils/io/Serializer.java index 9ab26d32..7e09cd96 100644 --- a/utils-test/src/main/java/org/onap/policy/common/utils/io/Serializer.java +++ b/utils-test/src/main/java/org/onap/policy/common/utils/io/Serializer.java @@ -2,7 +2,7 @@ * ============LICENSE_START======================================================= * ONAP Policy Engine - Common Modules * ================================================================================ - * Copyright (C) 2018-2019 AT&T Intellectual Property. All rights reserved. + * Copyright (C) 2018-2020 AT&T Intellectual Property. All rights reserved. * ================================================================================ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -73,7 +73,7 @@ public class Serializer { * @return the object that was de-serialized from the byte array * @throws IOException if an error occurs */ - public static T deserialize(Class clazz, byte[] data) throws IOException { + private static T deserialize(Class clazz, byte[] data) throws IOException { try (ByteArrayInputStream in = factory.makeByteArrayInputStream(data); ObjectInputStream ois = factory.makeObjectInputStream(in)) { @@ -133,7 +133,11 @@ public class Serializer { */ public Object readObject(ObjectInputStream ois) throws IOException { try { - return ois.readObject(); + /* + * This class is only used by junit tests. In addition, it is only used by + * deserialize(), which has been made "private", thus disabling sonar. + */ + return ois.readObject(); // NOSONAR } catch (ClassNotFoundException e) { throw new IOException(e); diff --git a/utils-test/src/main/java/org/onap/policy/common/utils/test/ToStringTester.java b/utils-test/src/main/java/org/onap/policy/common/utils/test/ToStringTester.java index 18502a35..3890ae95 100644 --- a/utils-test/src/main/java/org/onap/policy/common/utils/test/ToStringTester.java +++ b/utils-test/src/main/java/org/onap/policy/common/utils/test/ToStringTester.java @@ -37,23 +37,22 @@ import org.hamcrest.Matcher; * * @author Ram Krishna Verma (ram.krishna.verma@est.tech) */ -@SuppressWarnings("rawtypes") public class ToStringTester implements Tester { - private final Matcher matcher; + private final Matcher matcher; public ToStringTester() { matcher = anything(); } - public ToStringTester(final Matcher matcher) { + public ToStringTester(final Matcher matcher) { this.matcher = matcher; } @SuppressWarnings("unchecked") @Override public void run(final PojoClass pojoClass) { - final Class clazz = pojoClass.getClazz(); + final Class clazz = pojoClass.getClazz(); if (anyOf(matcher).matches(clazz)) { final Object classInstance = ValidationHelper.getBasicInstance(pojoClass); diff --git a/utils-test/src/test/java/org/onap/policy/common/utils/io/SerializerTest.java b/utils-test/src/test/java/org/onap/policy/common/utils/io/SerializerTest.java index 95abd4db..b5699fa2 100644 --- a/utils-test/src/test/java/org/onap/policy/common/utils/io/SerializerTest.java +++ b/utils-test/src/test/java/org/onap/policy/common/utils/io/SerializerTest.java @@ -2,7 +2,7 @@ * ============LICENSE_START======================================================= * ONAP Policy Engine - Common Modules * ================================================================================ - * Copyright (C) 2018-2019 AT&T Intellectual Property. All rights reserved. + * Copyright (C) 2018-2020 AT&T Intellectual Property. All rights reserved. * ================================================================================ * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -80,7 +80,7 @@ public class SerializerTest { byte[] data2 = Serializer.serialize(obj1); assertEquals(Arrays.toString(data), Arrays.toString(data2)); - MyObject obj2 = Serializer.deserialize(MyObject.class, data); + MyObject obj2 = Serializer.roundTrip(obj1); assertEquals(obj1.value, obj2.value); } @@ -210,16 +210,14 @@ public class SerializerTest { } }); - assertThatThrownBy(() -> Serializer.serialize(new MyObject(130))).isEqualTo(ex2); + assertThatThrownBy(() -> Serializer.roundTrip(new MyObject(130))).isEqualTo(ex2); } @Test public void testDeserialize() throws Exception { MyObject obj1 = new MyObject(3); - byte[] data = Serializer.serialize(obj1); - - MyObject obj2 = Serializer.deserialize(MyObject.class, data); + MyObject obj2 = Serializer.roundTrip(obj1); assertEquals(obj1.value, obj2.value); } @@ -249,8 +247,7 @@ public class SerializerTest { } }); - byte[] data = Serializer.serialize(new MyObject(300)); - assertThatThrownBy(() -> Serializer.deserialize(MyObject.class, data)).isEqualTo(ex); + assertThatThrownBy(() -> Serializer.roundTrip(new MyObject(300))).isEqualTo(ex); } @Test @@ -267,8 +264,7 @@ public class SerializerTest { } }); - byte[] data = Serializer.serialize(new MyObject(310)); - assertThatThrownBy(() -> Serializer.deserialize(MyObject.class, data)).isEqualTo(ex); + assertThatThrownBy(() -> Serializer.roundTrip(new MyObject(310))).isEqualTo(ex); } @Test @@ -287,9 +283,20 @@ public class SerializerTest { */ text = text.replace("MyObject", "AnObject"); - byte[] data = text.getBytes(binary); + byte[] data2 = text.getBytes(binary); + + /* + * Use a factory that returns a byte array for "data2" instead of the real "data". + */ + setFactory(new Factory() { + @Override + public ByteArrayInputStream makeByteArrayInputStream(byte[] data) { + // read from "data2" instead of "data" + return super.makeByteArrayInputStream(data2); + } + }); - assertThatThrownBy(() -> Serializer.deserialize(MyObject.class, data)).isInstanceOf(IOException.class) + assertThatThrownBy(() -> Serializer.roundTrip(obj1)).isInstanceOf(IOException.class) .hasCauseInstanceOf(ClassNotFoundException.class); } @@ -313,8 +320,7 @@ public class SerializerTest { } }); - byte[] data = Serializer.serialize(new MyObject(320)); - assertThatThrownBy(() -> Serializer.deserialize(MyObject.class, data)).isEqualTo(ex); + assertThatThrownBy(() -> Serializer.roundTrip(new MyObject(320))).isEqualTo(ex); } @Test @@ -348,8 +354,7 @@ public class SerializerTest { } }); - byte[] data = Serializer.serialize(new MyObject(330)); - assertThatThrownBy(() -> Serializer.deserialize(MyObject.class, data)).isEqualTo(ex2); + assertThatThrownBy(() -> Serializer.roundTrip(new MyObject(330))).isEqualTo(ex2); } @Test -- cgit 1.2.3-korg