Add back test for Security Manager

gson/src/main/java/com/google/gson/internal/bind/TypeAdapters.java

@@ -17,6 +17,7 @@
 package com.google.gson.internal.bind;
 
 import java.io.IOException;
+import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Field;
 import java.math.BigDecimal;
 import java.math.BigInteger;
@@ -759,22 +760,31 @@ private static final class EnumTypeAdapter<T extends Enum<T>> extends TypeAdapte
     private final Map<String, T> nameToConstant = new HashMap<String, T>();
     private final Map<T, String> constantToName = new HashMap<T, String>();
 
-    public EnumTypeAdapter(Class<T> classOfT) {
+    public EnumTypeAdapter(final Class<T> classOfT) {
       try {
-        for (final Field field : classOfT.getDeclaredFields()) {
-          if (!field.isEnumConstant()) {
-            continue;
-          }
-          AccessController.doPrivileged(new PrivilegedAction<Void>() {
-            @Override public Void run() {
-              field.setAccessible(true);
-              return null;
+        // Uses reflection to find enum constants to work around name mismatches for obfuscated classes
+        // Reflection access might throw SecurityException, therefore run this in privileged context;
+        // should be acceptable because this only retrieves enum constants, but does not expose anything else
+        Field[] constantFields = AccessController.doPrivileged(new PrivilegedAction<Field[]>() {
+          @Override public Field[] run() {
+            Field[] fields = classOfT.getDeclaredFields();
+            ArrayList<Field> constantFieldsList = new ArrayList<Field>(fields.length);
+            for (Field f : fields) {
+              if (f.isEnumConstant()) {
+                constantFieldsList.add(f);
+              }
             }
-          });
+
+            Field[] constantFields = constantFieldsList.toArray(new Field[0]);
+            AccessibleObject.setAccessible(constantFields, true);
+            return constantFields;
+          }
+        });
+        for (Field constantField : constantFields) {
           @SuppressWarnings("unchecked")
-          T constant = (T)(field.get(null));
+          T constant = (T)(constantField.get(null));
           String name = constant.name();
-          SerializedName annotation = field.getAnnotation(SerializedName.class);
+          SerializedName annotation = constantField.getAnnotation(SerializedName.class);
           if (annotation != null) {
             name = annotation.value();
             for (String alternate : annotation.alternate()) {

gson/src/test/java/com/google/gson/functional/EnumTest.java

@@ -16,12 +16,6 @@
 
 package com.google.gson.functional;
 
-import java.lang.reflect.Type;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.EnumSet;
-import java.util.Set;
-
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import com.google.gson.JsonDeserializationContext;
@@ -34,7 +28,11 @@
 import com.google.gson.annotations.SerializedName;
 import com.google.gson.common.MoreAsserts;
 import com.google.gson.reflect.TypeToken;
-
+import java.lang.reflect.Type;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.EnumSet;
+import java.util.Set;
 import junit.framework.TestCase;
 /**
  * Functional tests for Java 5.0 enums.
@@ -200,17 +198,17 @@ public enum Gender {
   }
 
   public void testEnumClassWithFields() {
-	  assertEquals("\"RED\"", gson.toJson(Color.RED));
-	  assertEquals("red", gson.fromJson("RED", Color.class).value);
+    assertEquals("\"RED\"", gson.toJson(Color.RED));
+    assertEquals("red", gson.fromJson("RED", Color.class).value);
   }
 
   public enum Color {
-	  RED("red", 1), BLUE("blue", 2), GREEN("green", 3);
-	  String value;
-	  int index;
-	  private Color(String value, int index) {
-		  this.value = value;
-		  this.index = index;
-	  }
+    RED("red", 1), BLUE("blue", 2), GREEN("green", 3);
+    String value;
+    int index;
+    private Color(String value, int index) {
+      this.value = value;
+      this.index = index;
+    }
   }
 }

gson/src/test/java/com/google/gson/functional/ReflectionAccessTest.java

@@ -1,15 +1,96 @@
 package com.google.gson.functional;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
 import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
 import com.google.gson.JsonIOException;
+import com.google.gson.TypeAdapter;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+import java.io.IOException;
+import java.lang.reflect.ReflectPermission;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.security.Permission;
 import java.util.Collections;
+import java.util.concurrent.atomic.AtomicBoolean;
 import org.junit.Test;
 
 public class ReflectionAccessTest {
+  @SuppressWarnings("unused")
+  private static class ClassWithPrivateMembers {
+    private String s;
+
+    private ClassWithPrivateMembers() {
+    }
+  }
+
+  private static Class<?> loadClassWithDifferentClassLoader(Class<?> c) throws Exception {
+    URL url = c.getProtectionDomain().getCodeSource().getLocation();
+    URLClassLoader classLoader = new URLClassLoader(new URL[] { url }, null);
+    return classLoader.loadClass(c.getName());
+  }
+
+  @Test
+  public void testRestrictiveSecurityManager() throws Exception {
+    // Must use separate class loader, otherwise permission is not checked, see Class.getDeclaredFields()
+    Class<?> clazz = loadClassWithDifferentClassLoader(ClassWithPrivateMembers.class);
+
+    final Permission accessDeclaredMembers = new RuntimePermission("accessDeclaredMembers");
+    final Permission suppressAccessChecks = new ReflectPermission("suppressAccessChecks");
+    SecurityManager original = System.getSecurityManager();
+    SecurityManager restrictiveManager = new SecurityManager() {
+      @Override
+      public void checkPermission(Permission perm) {
+        if (accessDeclaredMembers.equals(perm)) {
+          throw new SecurityException("Gson: no-member-access");
+        }
+        if (suppressAccessChecks.equals(perm)) {
+          throw new SecurityException("Gson: no-suppress-access-check");
+        }
+      }
+    };
+    System.setSecurityManager(restrictiveManager);
+
+    try {
+      Gson gson = new Gson();
+      try {
+        // Getting reflection based adapter should fail
+        gson.getAdapter(clazz);
+        fail();
+      } catch (SecurityException e) {
+        assertEquals("Gson: no-member-access", e.getMessage());
+      }
+
+      final AtomicBoolean wasReadCalled = new AtomicBoolean(false);
+      gson = new GsonBuilder()
+        .registerTypeAdapter(clazz, new TypeAdapter<Object>() {
+          @Override
+          public void write(JsonWriter out, Object value) throws IOException {
+            out.value("custom-write");
+          }
+
+          @Override
+          public Object read(JsonReader in) throws IOException {
+            in.skipValue();
+            wasReadCalled.set(true);
+            return null;
+          }}
+        )
+        .create();
+
+      assertEquals("\"custom-write\"", gson.toJson(null, clazz));
+      assertNull(gson.fromJson("{}", clazz));
+      assertTrue(wasReadCalled.get());
+    } finally {
+      System.setSecurityManager(original);
+    }
+  }
+
   /**
    * Test serializing an instance of a non-accessible internal class, but where
    * Gson supports serializing one of its superinterfaces.