Chore: Add unit tests for architectural and AOP analysis

pom.xml

@@ -57,6 +57,12 @@
             <artifactId>junit-platform-launcher</artifactId>
             <version>${junit-platform-version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-inline</artifactId>
+            <version>5.2.0</version>
+            <scope>test</scope>
+        </dependency>
         <!-- Logging framework -->
         <dependency>
             <groupId>ch.qos.logback</groupId>

src/main/java/de/tum/cit/ase/ares/api/architecture/java/archunit/FileHandlerConstants.java

@@ -17,6 +17,7 @@ public class FileHandlerConstants {
     public static final Path JAVA_REFLECTION_METHODS = FileTools.resolveOnResources("templates", "architecture" , "java", "archunit", "methods", "reflection-methods.txt");
     public static final Path JAVA_COMMAND_EXECUTION_METHODS = FileTools.resolveOnResources("templates", "architecture" , "java", "archunit", "methods", "command-execution-methods.txt");
     public static final Path JAVA_THREAD_CREATION_METHODS = FileTools.resolveOnResources("templates", "architecture" , "java", "archunit", "methods", "thread-creation-methods.txt");
+    public static final Path JAVA_CLASSLOADER_METHODS = FileTools.resolveOnResources("templates", "architecture" , "java", "archunit", "methods", "classloader-methods.txt");
 
     private FileHandlerConstants() {
         throw new UnsupportedOperationException(localized("security.general.utility.initialization"));

src/main/java/de/tum/cit/ase/ares/api/architecture/java/archunit/JavaArchUnitSecurityTestCase.java

@@ -6,6 +6,7 @@
 import de.tum.cit.ase.ares.api.architecture.java.archunit.postcompile.JavaArchitectureTestCaseCollection;
 import de.tum.cit.ase.ares.api.policy.SecurityPolicy.PackagePermission;
 
+import javax.annotation.Nonnull;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.stream.Collectors;
@@ -42,7 +43,7 @@ public class JavaArchUnitSecurityTestCase implements ArchitectureSecurityTestCas
      *
      * @param javaArchitectureTestCaseSupported Selects the supported architecture test case in the Java programming language
      */
-    public JavaArchUnitSecurityTestCase(JavaArchUnitTestCaseSupported javaArchitectureTestCaseSupported) {
+    public JavaArchUnitSecurityTestCase(@Nonnull JavaArchUnitTestCaseSupported javaArchitectureTestCaseSupported) {
         super();
         this.javaArchitectureTestCaseSupported = javaArchitectureTestCaseSupported;
         this.allowedPackages = new HashSet<>();

src/main/java/de/tum/cit/ase/ares/api/architecture/java/archunit/postcompile/JavaArchitectureTestCaseCollection.java

@@ -153,4 +153,11 @@ public boolean test(JavaAccess<?> javaAccess) {
             FileHandlerConstants.JAVA_THREAD_CREATION_METHODS
     );
     //</editor-fold>
+
+    //<editor-fold desc="ClassLoader related rule">
+    public static final ArchRule NO_CLASSES_SHOULD_USE_CLASSLOADERS = createNoClassShouldHaveMethodRule(
+            "uses ClassLoaders",
+            FileHandlerConstants.JAVA_CLASSLOADER_METHODS
+    );
+    //</editor-fold>
 }

src/main/java/de/tum/cit/ase/ares/api/architecture/java/archunit/postcompile/TransitivelyAccessesMethodsCondition.java

@@ -14,7 +14,6 @@
 import java.util.Optional;
 import java.util.Set;
 import java.util.HashSet;
-import java.util.Collections;
 
 import static com.tngtech.archunit.lang.ConditionEvent.createMessage;
 import static com.tngtech.archunit.thirdparty.com.google.common.base.Preconditions.checkNotNull;
@@ -54,17 +53,12 @@ public TransitivelyAccessesMethodsCondition(DescribedPredicate<? super JavaAcces
      */
     @Override
     public void check(JavaClass item, ConditionEvents events) {
-        boolean hastTransitiveAccess = false;
         for (JavaAccess<?> target : item.getAccessesFromSelf()) {
             List<JavaAccess<?>> dependencyPath = transitiveAccessPath.findPathTo(target);
             if (!dependencyPath.isEmpty()) {
                 events.add(newTransitiveAccessPathFoundEvent(target, dependencyPath));
-                hastTransitiveAccess = true;
             }
         }
-        if (!hastTransitiveAccess) {
-            events.add(newNoTransitiveDependencyPathFoundEvent(item));
-        }
     }
 
     /**
@@ -85,18 +79,12 @@ private static ConditionEvent newTransitiveAccessPathFoundEvent(JavaAccess<?> ja
         return SimpleConditionEvent.satisfied(javaClass, createMessage(javaClass, message));
     }
 
-    /**
-     * @return a violated event if no transitive dependency path was found
-     */
-    private static ConditionEvent newNoTransitiveDependencyPathFoundEvent(JavaClass javaClass) {
-        return SimpleConditionEvent.violated(javaClass, createMessage(javaClass, "does not transitively depend on any matching class"));
-    }
-
-    private class TransitiveAccessPath {
+    public class TransitiveAccessPath {
         /**
          * @return some outgoing transitive dependency path to the supplied class or empty if there is none
          */
-        List<JavaAccess<?>> findPathTo(JavaAccess<?> method) {
+        @SuppressWarnings("java:S1452")
+        public List<JavaAccess<?>> findPathTo(JavaAccess<?> method) {
             ImmutableList.Builder<JavaAccess<?>> transitivePath = ImmutableList.builder();
             addAccessesToPathFrom(method, transitivePath, new HashSet<>());
             return transitivePath.build().reverse();
@@ -138,18 +126,10 @@ private Set<JavaAccess<?>> getDirectAccessTargetsOutsideOfAnalyzedClasses(JavaAc
             JavaClass resolvedTarget = resolveTargetOwner(item.getTargetOwner());
 
             // Match the accesses to the target
+            // TODO Sarp: This is a workaround use Wala to get the actual call graph!!!!
             Set<JavaClass> subclasses = resolvedTarget.getSubclasses().stream().map(this::resolveTargetOwner).collect(toSet());
             subclasses.add(resolvedTarget);
 
-            /**
-             * If the number of subclasses is more than 20, return an empty set.
-             * These classes are always generic interfaces or abstract classes
-             * TODO: Check if this is also the case for foreign packages
-             */
-            if (subclasses.size() > 20 || isExceptionOrError(resolvedTarget)) {
-                return Collections.emptySet();
-            }
-
             return subclasses.stream()
                     .map(javaClass ->
                             getAccessesFromClass(javaClass, item.getTarget().getFullName().substring(item.getTargetOwner().getFullName().length())))
@@ -172,9 +152,5 @@ private JavaClass resolveTargetOwner(JavaClass targetOwner) {
             Optional<JavaClass> resolvedTarget = CustomClassResolver.tryResolve(targetOwner.getFullName());
             return resolvedTarget.orElse(targetOwner);
         }
-
-        private boolean isExceptionOrError(JavaClass javaClass) {
-            return javaClass.isAssignableTo(Exception.class) || javaClass.isAssignableTo(Error.class);
-        }
     }
 }

src/main/java/de/tum/cit/ase/ares/api/securitytest/java/JavaSecurityTestCaseFactoryAndBuilder.java

@@ -217,7 +217,7 @@ private void createSecurityTestCases() {
                 (Supplier<List<?>>) resourceAccesses::regardingFileSystemInteractions,
                 (Supplier<List<?>>) resourceAccesses::regardingNetworkConnections,
                 (Supplier<List<?>>) resourceAccesses::regardingCommandExecutions,
-//                (Supplier<List<?>>) resourceAccesses::regardingThreadCreations,
+                (Supplier<List<?>>) resourceAccesses::regardingThreadCreations,
         };
         IntStream
                 .range(0, methods.length)
@@ -323,6 +323,7 @@ public void executeSecurityTestCases() {
         //<editor-fold desc="Enforce fixed rules code">
         JavaArchitectureTestCaseCollection.NO_CLASSES_SHOULD_USE_REFLECTION.check(classes);
         JavaArchitectureTestCaseCollection.NO_CLASSES_SHOULD_TERMINATE_JVM.check(classes);
+        JavaArchitectureTestCaseCollection.NO_CLASSES_SHOULD_USE_CLASSLOADERS.check(classes);
         //</editor-fold>
 
         //<editor-fold desc="Enforce variable rules code">

src/main/resources/de/tum/cit/ase/ares/api/templates/architecture/java/archunit/methods/classloader-methods.txt

@@ -0,0 +1 @@
+java.lang.ClassLoader

src/main/resources/de/tum/cit/ase/ares/api/templates/architecture/java/archunit/methods/reflection-methods.txt

@@ -74,6 +74,7 @@ java.lang.Class.getDeclaringClass()
 java.lang.ClassLoader.getParent()
 java.lang.ClassLoader.getSystemClassLoader()
 java.lang.ClassLoader.getPlatformClassLoader()
+java.lang.ClassLoader
 java.lang.Module.addReads(java.lang.Module)
 java.lang.Module.getResourceAsStream(java.lang.String)
 java.lang.Module.addExports(java.lang.String, java.lang.Module)

src/main/resources/de/tum/cit/ase/ares/api/templates/architecture/java/archunit/methods/thread-creation-methods.txt

@@ -153,6 +153,7 @@ java.util.concurrent.DelayQueue.take()
 java.util.concurrent.ExecutorService.close()
 java.util.concurrent.ForkJoinPool.managedBlock(java.util.concurrent.ForkJoinPool$ManagedBlocker)
 java.util.concurrent.ForkJoinPool.close()
+java.util.concurrent.ForkJoinPool
 java.util.concurrent.ForkJoinTask.inForkJoinPool()
 java.util.concurrent.ForkJoinTask.fork()
 java.util.concurrent.ForkJoinTask.getPool()

src/test/java/de/tum/cit/ase/ares/aop/JavaAOPModeTest.java

@@ -0,0 +1,75 @@
+package de.tum.cit.ase.ares.aop;
+
+import de.tum.cit.ase.ares.api.aop.java.JavaAOPMode;
+import de.tum.cit.ase.ares.api.util.FileTools;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+
+import java.lang.reflect.Method;
+import java.nio.file.Path;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class JavaAOPModeTest {
+
+    private JavaAOPMode instrumentationMode;
+    private JavaAOPMode aspectjMode;
+
+    @BeforeEach
+    void setUp() {
+        instrumentationMode = JavaAOPMode.INSTRUMENTATION;
+        aspectjMode = JavaAOPMode.ASPECTJ;
+    }
+
+    @Test
+    void testEnumValues() {
+        assertNotNull(instrumentationMode);
+        assertNotNull(aspectjMode);
+    }
+
+    @Test
+    void testFilesToCopy_InstrumentationMode() {
+        try (MockedStatic<FileTools> mockedFileTools = mockStatic(FileTools.class)) {
+            mockedFileTools.when(() -> FileTools.resolveOnResources(any(String[].class)))
+                    .thenReturn(mock(Path.class));
+            instrumentationMode.filesToCopy();
+            mockedFileTools.verify(() -> FileTools.resolveOnResources(any(String[].class)), times(13));
+        }
+    }
+
+    @Test
+    void testFilesToCopy_AspectJMode() {
+        try (MockedStatic<FileTools> mockedFileTools = mockStatic(FileTools.class)) {
+            mockedFileTools.when(() -> FileTools.resolveOnResources(any(String[].class)))
+                    .thenReturn(mock(Path.class));
+            aspectjMode.filesToCopy();
+            mockedFileTools.verify(() -> FileTools.resolveOnResources(any(String[].class)), times(2));
+        }
+    }
+
+    @Test
+    void testFileValues_InstrumentationMode() {
+        try (MockedStatic<FileTools> mockedFileTools = mockStatic(FileTools.class)) {
+            mockedFileTools.when(() -> FileTools.generatePackageNameArray(anyString(), anyInt()))
+                    .thenReturn(new String[]{"mocked", "array"});
+            instrumentationMode.fileValues("com.example", "MainClass");
+            mockedFileTools.verify(() -> FileTools.generatePackageNameArray(anyString(), anyInt()), times(12));
+        }
+    }
+
+    @Test
+    void testReset() {
+        try {
+            ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
+            Class<?> settingsClass = Class.forName("de.tum.cit.ase.ares.api.aop.java.JavaSecurityTestCaseSettings", true, classLoader);
+            Method resetMethod = settingsClass.getDeclaredMethod("reset");
+            resetMethod.setAccessible(true);
+            resetMethod.invoke(null);
+        } catch (Exception e) {
+            fail("Exception should not have been thrown: " + e.getMessage());
+        }
+    }
+}

src/test/java/de/tum/cit/ase/ares/aop/JavaSecurityTestCaseSettingsTest.java

@@ -0,0 +1,65 @@
+package de.tum.cit.ase.ares.aop;
+
+import de.tum.cit.ase.ares.api.aop.java.JavaSecurityTestCaseSettings;
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class JavaSecurityTestCaseSettingsTest {
+
+    @Test
+    void testConstructorThrowsException() {
+        try {
+            Constructor<JavaSecurityTestCaseSettings> constructor = JavaSecurityTestCaseSettings.class.getDeclaredConstructor();
+            constructor.setAccessible(true);
+            constructor.newInstance();
+            fail("Expected SecurityException to be thrown");
+        } catch (InvocationTargetException e) {
+            assertInstanceOf(SecurityException.class, e.getCause());
+            assertEquals("Ares Security Error (Reason: Ares-Code; Stage: Creation): JavaSecurityTestCaseSettings is a utility class and should not be instantiated.", e.getCause().getMessage());
+        } catch (Exception e) {
+            fail("Unexpected exception: " + e);
+        }
+    }
+
+    @Test
+    void testResetMethod() {
+        try {
+            Field aopModeField = JavaSecurityTestCaseSettings.class.getDeclaredField("aopMode");
+            Field allowedListedClassesField = JavaSecurityTestCaseSettings.class.getDeclaredField("allowedListedClasses");
+            Field portsAllowedToBeConnectedToField = JavaSecurityTestCaseSettings.class.getDeclaredField("portsAllowedToBeConnectedTo");
+
+            aopModeField.setAccessible(true);
+            allowedListedClassesField.setAccessible(true);
+            portsAllowedToBeConnectedToField.setAccessible(true);
+
+            aopModeField.set(null, "test");
+            allowedListedClassesField.set(null, new String[]{"testClass"});
+            portsAllowedToBeConnectedToField.set(null, new int[]{8080});
+
+            Method resetMethod = JavaSecurityTestCaseSettings.class.getDeclaredMethod("reset");
+            resetMethod.setAccessible(true);
+            resetMethod.invoke(null);
+
+            assertNull(aopModeField.get(null));
+            assertNull(allowedListedClassesField.get(null));
+            assertNull(portsAllowedToBeConnectedToField.get(null));
+
+            Field pathsAllowedToBeReadField = JavaSecurityTestCaseSettings.class.getDeclaredField("pathsAllowedToBeRead");
+            pathsAllowedToBeReadField.setAccessible(true);
+            assertNull(pathsAllowedToBeReadField.get(null));
+
+            Field pathsAllowedToBeOverwrittenField = JavaSecurityTestCaseSettings.class.getDeclaredField("pathsAllowedToBeOverwritten");
+            pathsAllowedToBeOverwrittenField.setAccessible(true);
+            assertNull(pathsAllowedToBeOverwrittenField.get(null));
+
+        } catch (Exception e) {
+            fail("Unexpected exception: " + e);
+        }
+    }
+}

src/test/java/de/tum/cit/ase/ares/aop/JavaSecurityTestCaseTest.java

@@ -0,0 +1,80 @@
+package de.tum.cit.ase.ares.aop;
+
+import de.tum.cit.ase.ares.api.aop.java.JavaSecurityTestCase;
+import de.tum.cit.ase.ares.api.aop.java.JavaSecurityTestCaseSupported;
+import de.tum.cit.ase.ares.api.policy.SecurityPolicy.ResourceAccesses;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.MockedStatic;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class JavaSecurityTestCaseTest {
+
+    private JavaSecurityTestCase javaSecurityTestCase;
+    private ResourceAccesses resourceAccesses;
+
+    @BeforeEach
+    void setUp() {
+        JavaSecurityTestCaseSupported supported = JavaSecurityTestCaseSupported.FILESYSTEM_INTERACTION;
+        resourceAccesses = mock(ResourceAccesses.class);
+        javaSecurityTestCase = new JavaSecurityTestCase(supported, resourceAccesses);
+    }
+
+    @Test
+    void testWriteAOPSecurityTestCase() {
+        String result = javaSecurityTestCase.writeAOPSecurityTestCase("INSTRUMENTATION");
+        assertEquals("", result);
+    }
+
+    @Test
+    void testWriteAOPSecurityTestCaseFile() {
+        List<String> allowedListedClasses = List.of("TestClass");
+        List<JavaSecurityTestCase> javaSecurityTestCases = List.of(javaSecurityTestCase);
+
+        String result = JavaSecurityTestCase.writeAOPSecurityTestCaseFile(
+                "INSTRUMENTATION",
+                "de.tum.cit",
+                allowedListedClasses,
+                javaSecurityTestCases
+        );
+
+        assertTrue(result.contains("private static String aopMode"));
+        assertTrue(result.contains("private static String restrictedPackage"));
+        assertTrue(result.contains("private static String[] allowedListedClasses"));
+    }
+
+    @Test
+    void testExecuteAOPSecurityTestCase() {
+        try (MockedStatic<JavaSecurityTestCase> mockedStatic = mockStatic(JavaSecurityTestCase.class)) {
+            javaSecurityTestCase.executeAOPSecurityTestCase("INSTRUMENTATION");
+            mockedStatic.verify(() -> JavaSecurityTestCase.setJavaAdviceSettingValue(anyString(), any(), eq("INSTRUMENTATION")), atLeastOnce());
+        }
+    }
+
+    @Test
+    void testGetPermittedFilePaths() throws Exception {
+        Method method = JavaSecurityTestCase.class.getDeclaredMethod("getPermittedFilePaths", String.class);
+        method.setAccessible(true);
+        List<String> filePaths = (List<String>) method.invoke(javaSecurityTestCase, "read");
+        assertEquals(filePaths.size(), 0);
+    }
+
+    @Test
+    void testGenerateAdviceSettingValue() throws Exception {
+        Method method = JavaSecurityTestCase.class.getDeclaredMethod("generateAdviceSettingValue", String.class, String.class, Object.class);
+        method.setAccessible(true);
+        String result = (String) method.invoke(null, "String", "testAdvice", "testValue");
+        assertEquals("private static String testAdvice = \"testValue\";\n", result);
+        result = (String) method.invoke(null, "String[]", "testAdviceArray", List.of("value1", "value2"));
+        assertEquals("private static String[] testAdviceArray = new String[] {\"value1\", \"value2\"};\n", result);
+        InvocationTargetException thrown = assertThrows(InvocationTargetException.class, () -> {
+            method.invoke(null, "UnknownType", "testAdvice", "value");
+        });
+        assertEquals(SecurityException.class, thrown.getCause().getClass());
+    }
+}