hazendaz / jmockit1 / 476

Committed 08 Nov 2025 10:22PM UTC coverage: 72.229% (+0.002%) from 72.227%

Build # 476

Build Type

push

github

Committed by

hazendaz

Commit Message

Enhance secure random session id support in servlet dependencies

Coverage Stats

5680 of 8360 branches covered (67.94%)

Branch coverage included in aggregate %.

3 of 4 new or added lines in 2 files covered. (75.0%)

11928 of 16018 relevant lines covered (74.47%)

0.74 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

5.38

/main/src/main/java/mockit/internal/injection/full/ServletJavaxDependencies.java

/*
 * Copyright (c) 2006 JMockit developers
 * This file is subject to the terms of the MIT license (see LICENSE.txt).
 */
package mockit.internal.injection.full;

import static java.util.Collections.enumeration;

import edu.umd.cs.findbugs.annotations.NonNull;

import java.io.InputStream;
import java.math.BigInteger;
import java.net.URL;
import java.security.SecureRandom;
import java.util.Enumeration;
import java.util.EventListener;
import java.util.HashMap;
import java.util.Map;
import java.util.Set;

import javax.servlet.Filter;
import javax.servlet.FilterRegistration;
import javax.servlet.RequestDispatcher;
import javax.servlet.Servlet;
import javax.servlet.ServletContext;
import javax.servlet.ServletRegistration;
import javax.servlet.ServletRegistration.Dynamic;
import javax.servlet.SessionCookieConfig;
import javax.servlet.SessionTrackingMode;
import javax.servlet.descriptor.JspConfigDescriptor;
import javax.servlet.http.HttpSession;
import javax.servlet.http.HttpSessionContext;

import mockit.internal.injection.InjectionPoint;
import mockit.internal.injection.InjectionState;

/**
 * Detects and resolves dependencies belonging to the <code>javax.servlet</code> API, namely <code>ServletContext</code>
 * and <code>HttpSession</code>.
 */
final class ServletJavaxDependencies {
    // Use a single SecureRandom instance for all sessions
    private static final SecureRandom SECURE_RANDOM = new SecureRandom();

    static boolean isApplicable(@NonNull Class<?> dependencyType) {
        return dependencyType == HttpSession.class || dependencyType == ServletContext.class;
    }

    @NonNull
    private final InjectionState injectionState;

    ServletJavaxDependencies(@NonNull InjectionState injectionState) {
        this.injectionState = injectionState;
    }

    @NonNull
    Object createAndRegisterDependency(@NonNull Class<?> dependencyType) {
        if (dependencyType == ServletContext.class) {
            return createAndRegisterServletContext();
        }

        return createAndRegisterHttpSession();
    }

    @NonNull
    private ServletContext createAndRegisterServletContext() {
        ServletContext context = new ServletContext() {
            private final Map<String, String> init = new HashMap<>();
            private final Map<String, Object> attrs = new HashMap<>();

            @Override
            public String getContextPath() {
                return "";
            }

            @Override
            public ServletContext getContext(String uriPath) {
                return null;
            }

            @Override
            public int getMajorVersion() {
                return 3;
            }

            @Override
            public int getMinorVersion() {
                return 0;
            }

            @Override
            public int getEffectiveMajorVersion() {
                return 3;
            }

            @Override
            public int getEffectiveMinorVersion() {
                return 0;
            }

            @Override
            public String getMimeType(String file) {
                return null;
            }

            @Override
            public String getRealPath(String path) {
                return null;
            }

            @Override
            public Set<String> getResourcePaths(String path) {
                return null;
            }

            @Override
            public URL getResource(String path) {
                return getClass().getResource(path);
            }

            @Override
            public InputStream getResourceAsStream(String path) {
                return getClass().getResourceAsStream(path);
            }

            @Override
            public RequestDispatcher getRequestDispatcher(String path) {
                return null;
            }

            @Override
            public RequestDispatcher getNamedDispatcher(String name) {
                return null;
            }

            @Override
            public String getServletContextName() {
                return null;
            }

            @Override
            public String getServerInfo() {
                return "JMockit 1.x";
            }

            @Override
            public ClassLoader getClassLoader() {
                return getClass().getClassLoader();
            }

            // Deprecated/logging methods: do nothing.
            @Override
            public Servlet getServlet(String name) {
                return null;
            }

            @Override
            public Enumeration<Servlet> getServlets() {
                return null;
            }

            @Override
            public Enumeration<String> getServletNames() {
                return null;
            }

            @Override
            public void log(String msg) {
            }

            @Override
            public void log(Exception exception, String msg) {
            }

            @Override
            public void log(String message, Throwable throwable) {
            }

            // Context initialization parameters.
            @Override
            public Enumeration<String> getInitParameterNames() {
                return enumeration(init.keySet());
            }

            @Override
            public String getInitParameter(String name) {
                return init.get(name);
            }

            @Override
            public boolean setInitParameter(String name, String value) {
                return init.put(name, value) == null;
            }

            // Context attributes.
            @Override
            public Enumeration<String> getAttributeNames() {
                return enumeration(attrs.keySet());
            }

            @Override
            public Object getAttribute(String name) {
                return attrs.get(name);
            }

            @Override
            public void setAttribute(String name, Object value) {
                attrs.put(name, value);
            }

            @Override
            public void removeAttribute(String name) {
                attrs.remove(name);
            }

            // Un-implemented methods, which may get a non-empty implementation eventually.
            @Override
            public ServletRegistration.Dynamic addServlet(String name, String className) {
                return null;
            }

            @Override
            public ServletRegistration.Dynamic addServlet(String name, Servlet servlet) {
                return null;
            }

            @Override
            public ServletRegistration.Dynamic addServlet(String nm, Class<? extends Servlet> c) {
                return null;
            }

            @Override
            public <T extends Servlet> T createServlet(Class<T> clazz) {
                return null;
            }

            @Override
            public ServletRegistration getServletRegistration(String servletName) {
                return null;
            }

            @Override
            public Map<String, ? extends ServletRegistration> getServletRegistrations() {
                return null;
            }

            @Override
            public FilterRegistration.Dynamic addFilter(String name, String className) {
                return null;
            }

            @Override
            public FilterRegistration.Dynamic addFilter(String name, Filter filter) {
                return null;
            }

            @Override
            public FilterRegistration.Dynamic addFilter(String name, Class<? extends Filter> cl) {
                return null;
            }

            @Override
            public <T extends Filter> T createFilter(Class<T> clazz) {
                return null;
            }

            @Override
            public FilterRegistration getFilterRegistration(String filterName) {
                return null;
            }

            @Override
            public Map<String, ? extends FilterRegistration> getFilterRegistrations() {
                return null;
            }

            @Override
            public SessionCookieConfig getSessionCookieConfig() {
                return null;
            }

            @Override
            public void setSessionTrackingModes(Set<SessionTrackingMode> sessionTrackingModes) {
            }

            @Override
            public Set<SessionTrackingMode> getDefaultSessionTrackingModes() {
                return null;
            }

            @Override
            public Set<SessionTrackingMode> getEffectiveSessionTrackingModes() {
                return null;
            }

            @Override
            public void addListener(String className) {
            }

            @Override
            public <T extends EventListener> void addListener(T t) {
            }

            @Override
            public void addListener(Class<? extends EventListener> listenerClass) {
            }

            @Override
            public <T extends EventListener> T createListener(Class<T> clazz) {
                return null;
            }

            @Override
            public JspConfigDescriptor getJspConfigDescriptor() {
                return null;
            }

            @Override
            public void declareRoles(String... roleNames) {
            }

            @Override
            public String getVirtualServerName() {
                return null;
            }

            // Allow older servlet still (no overrides)
            @Override
            public Dynamic addJspFile(String servletName, String jspFile) {
                return null;
            }

            @Override
            public int getSessionTimeout() {
                return 0;
            }

            @Override
            public void setSessionTimeout(int sessionTimeout) {
            }

            @Override
            public String getRequestCharacterEncoding() {
                return null;
            }

            @Override
            public void setRequestCharacterEncoding(String encoding) {
            }

            @Override
            public String getResponseCharacterEncoding() {
                return null;
            }

            @Override
            public void setResponseCharacterEncoding(String encoding) {
            }
        };

        InjectionPoint injectionPoint = new InjectionPoint(ServletContext.class);
        InjectionState.saveGlobalDependency(injectionPoint, context);
        return context;
    }

    @NonNull
    private HttpSession createAndRegisterHttpSession() {
        HttpSession session = new HttpSession() {
            // Generate a secure random session ID (32 hex chars)
            private final String id = new BigInteger(130, SECURE_RANDOM).toString(32);
            private final long creationTime = System.currentTimeMillis();
            private final Map<String, Object> attrs = new HashMap<>();
            private int maxInactiveInterval;
            private boolean invalidated;

            @Override
            public String getId() {
                return id;
            }

            @Override
            public int getMaxInactiveInterval() {
                return maxInactiveInterval;
            }

            @Override
            public void setMaxInactiveInterval(int interval) {
                maxInactiveInterval = interval;
            }

            @Override
            public long getCreationTime() {
                checkValid();
                return creationTime;
            }

            @Override
            public long getLastAccessedTime() {
                checkValid();
                return creationTime;
            }

            @Override
            public boolean isNew() {
                checkValid();
                return false;
            }

            @Override
            public Enumeration<String> getAttributeNames() {
                checkValid();
                return enumeration(attrs.keySet());
            }

            @Override
            public Object getAttribute(String name) {
                checkValid();
                return attrs.get(name);
            }

            @Override
            public void setAttribute(String name, Object value) {
                checkValid();
                attrs.put(name, value);
            }

            @Override
            public void removeAttribute(String name) {
                checkValid();
                attrs.remove(name);
            }

            @Override
            public void invalidate() {
                checkValid();
                attrs.clear();
                invalidated = true;
            }

            private void checkValid() {
                if (invalidated) {
                    throw new IllegalStateException("Session is invalid");
                }
            }

            @Override
            public ServletContext getServletContext() {
                ServletContext context = InjectionState.getGlobalDependency(new InjectionPoint(ServletContext.class));

                if (context == null) {
                    context = createAndRegisterServletContext();
                }

                return context;
            }

            // Deprecated methods: do nothing.
            @Override
            public Object getValue(String name) {
                return null;
            }

            @Override
            public void putValue(String name, Object value) {
            }

            @Override
            public void removeValue(String name) {
            }

            @Override
            public String[] getValueNames() {
                return null;
            }

            @SuppressWarnings("deprecation")
            @Override
            public HttpSessionContext getSessionContext() {
                return null;
            }
        };

        InjectionPoint injectionPoint = new InjectionPoint(HttpSession.class);
        injectionState.saveInstantiatedDependency(injectionPoint, session);
        return session;
    }
}

1	/*
2	* Copyright (c) 2006 JMockit developers
3	* This file is subject to the terms of the MIT license (see LICENSE.txt).
4	*/
5	package mockit.internal.injection.full;
6
7	import static java.util.Collections.enumeration;
8
9	import edu.umd.cs.findbugs.annotations.NonNull;
10
11	import java.io.InputStream;
12	import java.math.BigInteger;
13	import java.net.URL;
14	import java.security.SecureRandom;
15	import java.util.Enumeration;
16	import java.util.EventListener;
17	import java.util.HashMap;
18	import java.util.Map;
19	import java.util.Set;
20
21	import javax.servlet.Filter;
22	import javax.servlet.FilterRegistration;
23	import javax.servlet.RequestDispatcher;
24	import javax.servlet.Servlet;
25	import javax.servlet.ServletContext;
26	import javax.servlet.ServletRegistration;
27	import javax.servlet.ServletRegistration.Dynamic;
28	import javax.servlet.SessionCookieConfig;
29	import javax.servlet.SessionTrackingMode;
30	import javax.servlet.descriptor.JspConfigDescriptor;
31	import javax.servlet.http.HttpSession;
32	import javax.servlet.http.HttpSessionContext;
33
34	import mockit.internal.injection.InjectionPoint;
35	import mockit.internal.injection.InjectionState;
36
37	/**
38	* Detects and resolves dependencies belonging to the <code>javax.servlet</code> API, namely <code>ServletContext</code>
39	* and <code>HttpSession</code>.
40	*/
41	final class ServletJavaxDependencies {
42	// Use a single SecureRandom instance for all sessions
43	private static final SecureRandom SECURE_RANDOM = new SecureRandom();	1✔
44
45	static boolean isApplicable(@NonNull Class<?> dependencyType) {
46	return dependencyType == HttpSession.class \|\| dependencyType == ServletContext.class;	1!
47	}
48
49	@NonNull
50	private final InjectionState injectionState;
51
52	ServletJavaxDependencies(@NonNull InjectionState injectionState) {	1✔
53	this.injectionState = injectionState;	1✔
54	}	1✔
55
56	@NonNull
57	Object createAndRegisterDependency(@NonNull Class<?> dependencyType) {
58	if (dependencyType == ServletContext.class) {	×
59	return createAndRegisterServletContext();	×
60	}
61
62	return createAndRegisterHttpSession();	×
63	}
64
65	@NonNull
66	private ServletContext createAndRegisterServletContext() {
67	ServletContext context = new ServletContext() {	×
68	private final Map<String, String> init = new HashMap<>();	×
69	private final Map<String, Object> attrs = new HashMap<>();	×
70
71	@Override
72	public String getContextPath() {
73	return "";	×
74	}
75
76	@Override
77	public ServletContext getContext(String uriPath) {
78	return null;	×
79	}
80
81	@Override
82	public int getMajorVersion() {
83	return 3;	×
84	}
85
86	@Override
87	public int getMinorVersion() {
88	return 0;	×
89	}
90
91	@Override
92	public int getEffectiveMajorVersion() {
93	return 3;	×
94	}
95
96	@Override
97	public int getEffectiveMinorVersion() {
98	return 0;	×
99	}
100
101	@Override
102	public String getMimeType(String file) {
103	return null;	×
104	}
105
106	@Override
107	public String getRealPath(String path) {
108	return null;	×
109	}
110
111	@Override
112	public Set<String> getResourcePaths(String path) {
113	return null;	×
114	}
115
116	@Override
117	public URL getResource(String path) {
118	return getClass().getResource(path);	×
119	}
120
121	@Override
122	public InputStream getResourceAsStream(String path) {
123	return getClass().getResourceAsStream(path);	×
124	}
125
126	@Override
127	public RequestDispatcher getRequestDispatcher(String path) {
128	return null;	×
129	}
130
131	@Override
132	public RequestDispatcher getNamedDispatcher(String name) {
133	return null;	×
134	}
135
136	@Override
137	public String getServletContextName() {
138	return null;	×
139	}
140
141	@Override
142	public String getServerInfo() {
143	return "JMockit 1.x";	×
144	}
145
146	@Override
147	public ClassLoader getClassLoader() {
148	return getClass().getClassLoader();	×
149	}
150
151	// Deprecated/logging methods: do nothing.
152	@Override
153	public Servlet getServlet(String name) {
154	return null;	×
155	}
156
157	@Override
158	public Enumeration<Servlet> getServlets() {
159	return null;	×
160	}
161
162	@Override
163	public Enumeration<String> getServletNames() {
164	return null;	×
165	}
166
167	@Override
168	public void log(String msg) {
169	}	×
170
171	@Override
172	public void log(Exception exception, String msg) {
173	}	×
174
175	@Override
176	public void log(String message, Throwable throwable) {
177	}	×
178
179	// Context initialization parameters.
180	@Override
181	public Enumeration<String> getInitParameterNames() {
182	return enumeration(init.keySet());	×
183	}
184
185	@Override
186	public String getInitParameter(String name) {
187	return init.get(name);	×
188	}
189
190	@Override
191	public boolean setInitParameter(String name, String value) {
192	return init.put(name, value) == null;	×
193	}
194
195	// Context attributes.
196	@Override
197	public Enumeration<String> getAttributeNames() {
198	return enumeration(attrs.keySet());	×
199	}
200
201	@Override
202	public Object getAttribute(String name) {
203	return attrs.get(name);	×
204	}
205
206	@Override
207	public void setAttribute(String name, Object value) {
208	attrs.put(name, value);	×
209	}	×
210
211	@Override
212	public void removeAttribute(String name) {
213	attrs.remove(name);	×
214	}	×
215
216	// Un-implemented methods, which may get a non-empty implementation eventually.
217	@Override
218	public ServletRegistration.Dynamic addServlet(String name, String className) {
219	return null;	×
220	}
221
222	@Override
223	public ServletRegistration.Dynamic addServlet(String name, Servlet servlet) {
224	return null;	×
225	}
226
227	@Override
228	public ServletRegistration.Dynamic addServlet(String nm, Class<? extends Servlet> c) {
229	return null;	×
230	}
231
232	@Override
233	public <T extends Servlet> T createServlet(Class<T> clazz) {
234	return null;	×
235	}
236
237	@Override
238	public ServletRegistration getServletRegistration(String servletName) {
239	return null;	×
240	}
241
242	@Override
243	public Map<String, ? extends ServletRegistration> getServletRegistrations() {
244	return null;	×
245	}
246
247	@Override
248	public FilterRegistration.Dynamic addFilter(String name, String className) {
249	return null;	×
250	}
251
252	@Override
253	public FilterRegistration.Dynamic addFilter(String name, Filter filter) {
254	return null;	×
255	}
256
257	@Override
258	public FilterRegistration.Dynamic addFilter(String name, Class<? extends Filter> cl) {
259	return null;	×
260	}
261
262	@Override
263	public <T extends Filter> T createFilter(Class<T> clazz) {
264	return null;	×
265	}
266
267	@Override
268	public FilterRegistration getFilterRegistration(String filterName) {
269	return null;	×
270	}
271
272	@Override
273	public Map<String, ? extends FilterRegistration> getFilterRegistrations() {
274	return null;	×
275	}
276
277	@Override
278	public SessionCookieConfig getSessionCookieConfig() {
279	return null;	×
280	}
281
282	@Override
283	public void setSessionTrackingModes(Set<SessionTrackingMode> sessionTrackingModes) {
284	}	×
285
286	@Override
287	public Set<SessionTrackingMode> getDefaultSessionTrackingModes() {
288	return null;	×
289	}
290
291	@Override
292	public Set<SessionTrackingMode> getEffectiveSessionTrackingModes() {
293	return null;	×
294	}
295
296	@Override
297	public void addListener(String className) {
298	}	×
299
300	@Override
301	public <T extends EventListener> void addListener(T t) {
302	}	×
303
304	@Override
305	public void addListener(Class<? extends EventListener> listenerClass) {
306	}	×
307
308	@Override
309	public <T extends EventListener> T createListener(Class<T> clazz) {
310	return null;	×
311	}
312
313	@Override
314	public JspConfigDescriptor getJspConfigDescriptor() {
315	return null;	×
316	}
317
318	@Override
319	public void declareRoles(String... roleNames) {
320	}	×
321
322	@Override
323	public String getVirtualServerName() {
324	return null;	×
325	}
326
327	// Allow older servlet still (no overrides)
328	@Override
329	public Dynamic addJspFile(String servletName, String jspFile) {
330	return null;	×
331	}
332
333	@Override
334	public int getSessionTimeout() {
335	return 0;	×
336	}
337
338	@Override
339	public void setSessionTimeout(int sessionTimeout) {
340	}	×
341
342	@Override
343	public String getRequestCharacterEncoding() {
344	return null;	×
345	}
346
347	@Override
348	public void setRequestCharacterEncoding(String encoding) {
349	}	×
350
351	@Override
352	public String getResponseCharacterEncoding() {
353	return null;	×
354	}
355
356	@Override
357	public void setResponseCharacterEncoding(String encoding) {
358	}	×
359	};
360
361	InjectionPoint injectionPoint = new InjectionPoint(ServletContext.class);	×
362	InjectionState.saveGlobalDependency(injectionPoint, context);	×
363	return context;	×
364	}
365
366	@NonNull
367	private HttpSession createAndRegisterHttpSession() {
368	HttpSession session = new HttpSession() {	×
369	// Generate a secure random session ID (32 hex chars)
NEW 370	private final String id = new BigInteger(130, SECURE_RANDOM).toString(32);	×
371	private final long creationTime = System.currentTimeMillis();	×
372	private final Map<String, Object> attrs = new HashMap<>();	×
373	private int maxInactiveInterval;
374	private boolean invalidated;
375
376	@Override
377	public String getId() {
378	return id;	×
379	}
380
381	@Override
382	public int getMaxInactiveInterval() {
383	return maxInactiveInterval;	×
384	}
385
386	@Override
387	public void setMaxInactiveInterval(int interval) {
388	maxInactiveInterval = interval;	×
389	}	×
390
391	@Override
392	public long getCreationTime() {
393	checkValid();	×
394	return creationTime;	×
395	}
396
397	@Override
398	public long getLastAccessedTime() {
399	checkValid();	×
400	return creationTime;	×
401	}
402
403	@Override
404	public boolean isNew() {
405	checkValid();	×
406	return false;	×
407	}
408
409	@Override
410	public Enumeration<String> getAttributeNames() {
411	checkValid();	×
412	return enumeration(attrs.keySet());	×
413	}
414
415	@Override
416	public Object getAttribute(String name) {
417	checkValid();	×
418	return attrs.get(name);	×
419	}
420
421	@Override
422	public void setAttribute(String name, Object value) {
423	checkValid();	×
424	attrs.put(name, value);	×
425	}	×
426
427	@Override
428	public void removeAttribute(String name) {
429	checkValid();	×
430	attrs.remove(name);	×
431	}	×
432
433	@Override
434	public void invalidate() {
435	checkValid();	×
436	attrs.clear();	×
437	invalidated = true;	×
438	}	×
439
440	private void checkValid() {
441	if (invalidated) {	×
442	throw new IllegalStateException("Session is invalid");	×
443	}
444	}	×
445
446	@Override
447	public ServletContext getServletContext() {
448	ServletContext context = InjectionState.getGlobalDependency(new InjectionPoint(ServletContext.class));	×
449
450	if (context == null) {	×
451	context = createAndRegisterServletContext();	×
452	}
453
454	return context;	×
455	}
456
457	// Deprecated methods: do nothing.
458	@Override
459	public Object getValue(String name) {
460	return null;	×
461	}
462
463	@Override
464	public void putValue(String name, Object value) {
465	}	×
466
467	@Override
468	public void removeValue(String name) {
469	}	×
470
471	@Override
472	public String[] getValueNames() {
473	return null;	×
474	}
475
476	@SuppressWarnings("deprecation")
477	@Override
478	public HttpSessionContext getSessionContext() {
479	return null;	×
480	}
481	};
482
483	InjectionPoint injectionPoint = new InjectionPoint(HttpSession.class);	×
484	injectionState.saveInstantiatedDependency(injectionPoint, session);	×
485	return session;	×
486	}
487	}

hazendaz / jmockit1 / 476

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous