Closed
Description
Description
Socket.connect method call is not sandboxed by Security Manager as expected.
Default settings, no additional permissions were added.
To Reproduce
Steps to reproduce the behavior:
- Open IntelliJ IDEA with installed UTBot plugin (with Security Manager turned on)
- Open/create a project with JDK 8/11
- Add the following class:
import java.io.IOException;
import java.net.InetSocketAddress;
import java.net.Socket;
public class SecurityCheck {
public int connect(Socket socket) throws IOException {
socket.connect(new InetSocketAddress("0.0.0.0", 22));
return 0;
}
}
- Generate tests for this class
Expected behavior
Generated test is supposed to be disabled with sandbox-related comment.
Actual behavior
Successful test is generated.
Visual proofs (screenshots, logs, images)
public class SecurityCheckTest {
///region Test suites for executable SecurityCheck.connect
///region
@Test
@DisplayName("connect: socket = Socket(String, int, boolean) -> throw SocketException")
public void testConnectThrowsSE() throws IOException {
SecurityCheck securityCheck = new SecurityCheck();
Socket socket = new Socket("", 0, false);
assertThrows(SocketException.class, () -> securityCheck.connect(socket));
}
///endregion
///region Errors report for connect
public void testConnect_errors() {
// Couldn't generate some tests. List of errors:
//
// 4 occurrences of:
// Default concrete execution failed
}
///endregion
///endregion
}
4 InvocationTargetException are present in Concrete executor log
Environment
IntelliJ IDEA 2022.1 - 2022.1.4
JDK 8/11
Additional context
Same result with Fuzzing only and default settings.
Metadata
Metadata
Assignees
Type
Projects
Status
Done