MaliciousJvmSerializationTest.kt

/*
 * Copyright 2019-2025 JetBrains s.r.o. and contributors.
 * Use of this source code is governed by the Apache 2.0 License that can be found in the LICENSE.txt file.
 */

package kotlinx.datetime

import kotlinx.datetime.MaliciousJvmSerializationTest.SerDat.Streams
import java.io.ByteArrayInputStream
import java.io.ObjectInputStream
import java.io.Serializable
import kotlin.reflect.KClass
import kotlin.test.Test
import kotlin.test.assertEquals
import kotlin.test.assertFailsWith
import kotlin.test.fail

// TODO investigate other null stream (it's different from the one I got) from this comment:
//  https://github.com/Kotlin/kotlinx-datetime/pull/373#discussion_r2009789491
//  aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c44617465618443f17dae33e70200014c00097472756556616c75657400154c6a6176612f74696d652f4c6f63616c446174653b787070

class MaliciousJvmSerializationTest {

    /**
     * This data was generated by running the following Java code (`X` was replaced with the simple name of [clazz]):
     * ```java
     * package kotlinx.datetime;
     *
     * import java.io.*;
     * import java.util.*;
     *
     * public class X implements Serializable {
     *     private final java.time.X <delegate field name> = ...;
     *
     *     @Serial
     *     private static final long serialVersionUID = ...;
     *
     *     public static void main(String[] args) throws IOException {
     *         var bos = new ByteArrayOutputStream();
     *         try (var oos = new ObjectOutputStream(bos)) {
     *             oos.writeObject(new X());
     *         }
     *         System.out.println(HexFormat.of().formatHex(bos.toByteArray()));
     *     }
     * }
     * ```
     */
    private class SerDat(
        val clazz: KClass<out Serializable>,
        /** serialVersionUID had the correct value in the Java code. */
        val withCorrectSVUID: Streams,
        /** serialVersionUID had an incorrect value (42) in the Java code. */
        val withSVUID42: Streams,
    ) {
        class Streams(
            /** <delegate field name> was set to `null` in the Java code. */
            val delegateNull: String,
            /** <delegate field name> was set to a valid (non-null) instance in the Java code. */
            val delegateValid: String,
        )
    }

    @Suppress("RemoveRedundantQualifierName")
    private val data = listOf(
        SerDat(
            kotlinx.datetime.LocalDate::class,
            // generated using "value" as <delegate field name> and
            // java.time.LocalDate.of(2025, 4, 26) as the valid delegate
            withCorrectSVUID = Streams(
                delegateValid = "aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c44617465618443f17dae33e70200014c000576616c75657400154c6a6176612f74696d652f4c6f63616c446174653b78707372000d6a6176612e74696d652e536572955d84ba1b2248b20c00007870770703000007e9041a78",
                delegateNull = "aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c44617465618443f17dae33e70200014c000576616c75657400154c6a6176612f74696d652f4c6f63616c446174653b787070",
            ),
            withSVUID42 = Streams(
                delegateValid = "aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c44617465000000000000002a0200014c000576616c75657400154c6a6176612f74696d652f4c6f63616c446174653b78707372000d6a6176612e74696d652e536572955d84ba1b2248b20c00007870770703000007e9041a78",
                delegateNull = "aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c44617465000000000000002a0200014c000576616c75657400154c6a6176612f74696d652f4c6f63616c446174653b787070",
            ),
        ),
        SerDat(
            kotlinx.datetime.LocalDateTime::class,
            // generated using "value" as <delegate field name> and
            // java.time.LocalDateTime.of(2025, 4, 26, 11, 18) as the valid delegate
            withCorrectSVUID = Streams(
                delegateValid = "aced00057372001e6b6f746c696e782e6461746574696d652e4c6f63616c4461746554696d65c4db3d89c7126e690200014c000576616c75657400194c6a6176612f74696d652f4c6f63616c4461746554696d653b78707372000d6a6176612e74696d652e536572955d84ba1b2248b20c00007870770905000007e9041a0bed78",
                delegateNull = "aced00057372001e6b6f746c696e782e6461746574696d652e4c6f63616c4461746554696d65c4db3d89c7126e690200014c000576616c75657400194c6a6176612f74696d652f4c6f63616c4461746554696d653b787070",
            ),
            withSVUID42 = Streams(
                delegateValid = "aced00057372001e6b6f746c696e782e6461746574696d652e4c6f63616c4461746554696d65000000000000002a0200014c000576616c75657400194c6a6176612f74696d652f4c6f63616c4461746554696d653b78707372000d6a6176612e74696d652e536572955d84ba1b2248b20c00007870770905000007e9041a0bed78",
                delegateNull = "aced00057372001e6b6f746c696e782e6461746574696d652e4c6f63616c4461746554696d65000000000000002a0200014c000576616c75657400194c6a6176612f74696d652f4c6f63616c4461746554696d653b787070",
            ),
        ),
        SerDat(
            kotlinx.datetime.LocalTime::class,
            // generated using "value" as <delegate field name> and
            // java.time.LocalTime.of(11, 18) as the valid delegate
            withCorrectSVUID = Streams(
                delegateValid = "aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c54696d65fb1c8ed97ff0a5fd0200014c000576616c75657400154c6a6176612f74696d652f4c6f63616c54696d653b78707372000d6a6176612e74696d652e536572955d84ba1b2248b20c000078707703040bed78",
                delegateNull = "aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c54696d65fb1c8ed97ff0a5fd0200014c000576616c75657400154c6a6176612f74696d652f4c6f63616c54696d653b787070",
            ),
            withSVUID42 = Streams(
                delegateValid = "aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c54696d65000000000000002a0200014c000576616c75657400154c6a6176612f74696d652f4c6f63616c54696d653b78707372000d6a6176612e74696d652e536572955d84ba1b2248b20c000078707703040bed78",
                delegateNull = "aced00057372001a6b6f746c696e782e6461746574696d652e4c6f63616c54696d65000000000000002a0200014c000576616c75657400154c6a6176612f74696d652f4c6f63616c54696d653b787070",
            ),
        ),
        SerDat(
            kotlinx.datetime.UtcOffset::class,
            // generated using "zoneOffset" as <delegate field name> and
            // java.time.ZoneOffset.UTC as the valid delegate
            withCorrectSVUID = Streams(
                delegateValid = "aced00057372001a6b6f746c696e782e6461746574696d652e5574634f6666736574a3e571cbd0a1face0200014c000a7a6f6e654f66667365747400164c6a6176612f74696d652f5a6f6e654f66667365743b78707372000d6a6176612e74696d652e536572955d84ba1b2248b20c000078707702080078",
                delegateNull = "aced00057372001a6b6f746c696e782e6461746574696d652e5574634f6666736574a3e571cbd0a1face0200014c000a7a6f6e654f66667365747400164c6a6176612f74696d652f5a6f6e654f66667365743b787070",
            ),
            withSVUID42 = Streams(
                delegateValid = "aced00057372001a6b6f746c696e782e6461746574696d652e5574634f6666736574000000000000002a0200014c000a7a6f6e654f66667365747400164c6a6176612f74696d652f5a6f6e654f66667365743b78707372000d6a6176612e74696d652e536572955d84ba1b2248b20c000078707702080078",
                delegateNull = "aced00057372001a6b6f746c696e782e6461746574696d652e5574634f6666736574000000000000002a0200014c000a7a6f6e654f66667365747400164c6a6176612f74696d652f5a6f6e654f66667365743b787070",
            ),
        ),
    )

    @OptIn(ExperimentalStdlibApi::class)
    private fun deserialize(stream: String): Any? {
        val bis = ByteArrayInputStream(stream.hexToByteArray())
        return ObjectInputStream(bis).use { ois ->
            ois.readObject()
        }
    }

    @Test
    fun deserializeMaliciousStreams() {
        for (d in data) {
            val className = d.clazz.qualifiedName!!
            testStreamsWithCorrectSVUID(className, d.withCorrectSVUID)
            testStreamsWithSVUID42(d.clazz, className, d.withSVUID42)
        }
    }

    private fun testStreamsWithCorrectSVUID(className: String, streams: Streams) {
        val testMessage = "Deserialization of a serial stream that tries to bypass kotlinx.datetime.Ser and has the " +
            "correct serialVersionUID for $className should fail"

        val expectedIOEMessage = "$className must be deserialized via kotlinx.datetime.Ser"

        // this would actually create a valid instance, but serialization should always go through the proxy
        val ioe1 = assertFailsWith<java.io.InvalidObjectException>(testMessage) {
            deserialize(streams.delegateValid)
        }
        assertEquals(expectedIOEMessage, ioe1.message)

        // this would create an instance that has null in a non-nullable field (e.g., the field
        // kotlinx.datetime.LocalDate.value)
        // see https://github.com/Kotlin/kotlinx-datetime/pull/373#discussion_r2008922681
        val ioe2 = assertFailsWith<java.io.InvalidObjectException>(testMessage) {
            deserialize(streams.delegateNull)
        }
        assertEquals(expectedIOEMessage, ioe2.message)
    }

    private fun testStreamsWithSVUID42(clazz: KClass<out Serializable>, className: String, streams: Streams) {
        val testMessage = "Deserialization of a serial stream that tries to bypass kotlinx.datetime.Ser but has a " +
            "wrong serialVersionUID for $className should fail"

        val serialVersionUID = clazz.java
            .getDeclaredField("serialVersionUID")
            .apply { isAccessible = true }
            .get(null) as Long
        if (serialVersionUID == 42L) {
            fail("This test assumes that the tested classes don't have a serialVersionUID of 42 but $className does.")
        }

        val expectedICEMessage = "$className; local class incompatible: stream classdesc serialVersionUID = 42, " +
            "local class serialVersionUID = $serialVersionUID"

        val ice1 = assertFailsWith<java.io.InvalidClassException>(testMessage) {
            deserialize(streams.delegateValid)
        }
        assertEquals(expectedICEMessage, ice1.message)

        val ice2 = assertFailsWith<java.io.InvalidClassException>(testMessage) {
            deserialize(streams.delegateNull)
        }
        assertEquals(expectedICEMessage, ice2.message)
    }
}