remove serialization-stage secmgr to avoid spurious errors due to ext…

…ra surefire thread
Ramos-dev · Nov 15, 2018 · 4088b8c · 4088b8c
1 parent a1a40d2
commit 4088b8c
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 4 deletions.
diff --git a/src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java b/src/main/java/ysoserial/secmgr/ExecCheckingSecurityManager.java
@@ -6,6 +6,7 @@
 import java.util.List;
 import java.util.concurrent.Callable;
 
+// TODO per-thread secmgr
 public class ExecCheckingSecurityManager extends SecurityManager {
 	public ExecCheckingSecurityManager() {
 		this(true);
@@ -41,7 +42,6 @@ public void checkExec(final String cmd) {
 		}
 	};
 
-
 	@SuppressWarnings("serial")
 	public static class ExecException extends RuntimeException {
 		private final String threadName = Thread.currentThread().getName();

diff --git a/src/test/java/ysoserial/payloads/CommandExecTest.java b/src/test/java/ysoserial/payloads/CommandExecTest.java
@@ -16,7 +16,6 @@ public class CommandExecTest implements CustomTest {
     @Override
     public void run(Callable<Object> payload) throws Exception {
         Assert.assertFalse("test file should not exist", testFile.exists());
-        Exception err;
         try {
             payload.call();
         } catch (Exception e) {

diff --git a/src/test/java/ysoserial/payloads/PayloadsTest.java b/src/test/java/ysoserial/payloads/PayloadsTest.java
@@ -107,8 +107,8 @@ public static void testPayload ( final Class<? extends ObjectPayload<?>> payload
             customDeserializer = ((CustomDeserializer)testHarness).getCustomDeserializer();
         }
 
-        ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
-        final byte[] serialized = sm.callWrapped(makeSerializeCallable(payloadClass, payloadCommand));
+        // TODO per-thread secmgr to enforce no detonation during deserialization
+        final byte[] serialized = makeSerializeCallable(payloadClass, payloadCommand).call();
         Callable<Object> callable = makeDeserializeCallable(t, addlClassesForClassLoader, deps, serialized, customDeserializer);
         if ( testHarness instanceof WrappedTest ) {
             callable = ( (WrappedTest) testHarness ).createCallable(callable);