8033924: Default permissions are not given for eval code

Reviewed-by: lagergren, jlaskey

2 files changed, 106 insertions, 0 deletions

diff --git a/test/script/sandbox/safeprops.js b/test/script/sandbox/safeprops.js
new file mode 100644
index 00000000..dc12e74f
--- /dev/null
+++ b/test/script/sandbox/safeprops.js
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2014 Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * Try to access System properties safe to read for any code.
+ * No security exception expected.
+ *
+ * @test
+ * @security
+ * @run
+ * @bug 8033924: Default permissions are not given for eval code
+ */
+
+var propNames = [
+   "java.version",
+   "java.vendor",
+   "java.vendor.url",
+   "java.class.version",
+   "os.name",
+   "os.version",
+   "os.arch",
+   "file.separator",
+   "path.separator",
+   "line.separator",
+   "java.specification.version",
+   "java.specification.vendor",
+   "java.specification.name",
+   "java.vm.specification.version",
+   "java.vm.specification.vendor",
+   "java.vm.specification.name",
+   "java.vm.version",
+   "java.vm.vendor",
+   "java.vm.name"
+];
+
+// no security exception expected
+for (var p in propNames) {
+    java.lang.System.getProperty(propNames[p]);
+}
+
+// no security exception expected
+for (var p in propNames) {
+    var name = propNames[p];
+    eval('java.lang.System.getProperty(name)');
+}
diff --git a/test/src/jdk/nashorn/api/scripting/ScriptEngineTest.java b/test/src/jdk/nashorn/api/scripting/ScriptEngineTest.java
index df8696d8..52199145 100644
--- a/test/src/jdk/nashorn/api/scripting/ScriptEngineTest.java
+++ b/test/src/jdk/nashorn/api/scripting/ScriptEngineTest.java
@@ -560,6 +560,47 @@ public class ScriptEngineTest {
         assertTrue(reached[0]);
     }
 
+    // properties that can be read by any code
+    private static String[] propNames = {
+        "java.version",
+        "java.vendor",
+        "java.vendor.url",
+        "java.class.version",
+        "os.name",
+        "os.version",
+        "os.arch",
+        "file.separator",
+        "path.separator",
+        "line.separator",
+        "java.specification.version",
+        "java.specification.vendor",
+        "java.specification.name",
+        "java.vm.specification.version",
+        "java.vm.specification.vendor",
+        "java.vm.specification.name",
+        "java.vm.version",
+        "java.vm.vendor",
+        "java.vm.name"
+    };
+
+    // @bug 8033924: Default permissions are not given for eval code
+    @Test
+    public void checkPropertyReadPermissions() throws ScriptException {
+        final ScriptEngineManager m = new ScriptEngineManager();
+        final ScriptEngine e = m.getEngineByName("nashorn");
+
+        for (final String name : propNames) {
+            checkProperty(e, name);
+        }
+    }
+
+    private static void checkProperty(final ScriptEngine e, final String name)
+        throws ScriptException {
+        String value = System.getProperty(name);
+        e.put("name", name);
+        assertEquals(value, e.eval("java.lang.System.getProperty(name)"));
+    }
+
     private static final String LINE_SEPARATOR = System.getProperty("line.separator");
 
     // Returns String that would be the result of calling PrintWriter.println