Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ArtemisSecurityManager fails to prevent network connections #376

Open
angatha opened this issue Sep 28, 2024 · 0 comments
Open

ArtemisSecurityManager fails to prevent network connections #376

angatha opened this issue Sep 28, 2024 · 0 comments

Comments

@angatha
Copy link

angatha commented Sep 28, 2024

Describe the bug
Given a test not annotated with @AllowLocalPort, it is still possible for student code to acces the internet and local ports. (The local port part is not tested in artemis itself but locally but I'm more conserned with internet access.)

To Reproduce

  1. Create a new programming exercise
  2. Clear all classes in tests and solution
  3. Add in solution repository:
package xyz;

import java.io.IOException;
import java.net.HttpURLConnection;
import java.net.URL;

public class ReachingWeb {
    public static int googleCode() throws IOException {
        URL url = new URL("http://google.com");
        HttpURLConnection con = (HttpURLConnection) url.openConnection();
        con.setRequestMethod("GET");
        return con.getResponseCode();
    }
}
  1. Add in test repository
package xyz;

import org.junit.jupiter.api.*;
import static org.junit.jupiter.api.Assertions.*;

import java.io.IOException;

import de.tum.in.test.api.BlacklistPath;
import de.tum.in.test.api.StrictTimeout;
import de.tum.in.test.api.WhitelistPath;
import de.tum.in.test.api.jqwik.Public;

@Public
@WhitelistPath("target")
@BlacklistPath("target/test-classes")
class ReachingWebTest {

    @Test
    @StrictTimeout(1)
    void testReachWeb() throws IOException {
        int temp = ReachingWeb.googleCode();
        if(temp != 200) {
            fail("Google is not Reachable. Erwartete Code 200, habe " + temp + " erhalten.");
        }
    }
}
  1. The test succeeds

Expected behavior
Security manager should prevent internet acces.

Desktop (please complete the following information):

  • OS: Windows
  • IDE: IntelliJ
  • Ares-Version: 1.13.0

Also applies to docker image ls1tum/artemis-maven-template:java17-21

Additional context
In the security manager, checkForNonWhitelistedStackFrames gets called but getNonWhitelistedStackFrames does not return the stackframe from ReachingWeb because a takeWhile cuts it of:

image

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant