Allow URL.of(uri, null) in TCK permission checker.

Author: tzezula

substratevm/src/com.oracle.svm.truffle.tck/src/com/oracle/svm/truffle/tck/PermissionsFeature.java

@@ -32,6 +32,9 @@
 import java.lang.reflect.Method;
 import java.lang.reflect.Proxy;
 import java.math.BigInteger;
+import java.net.URI;
+import java.net.URL;
+import java.net.URLStreamHandler;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
@@ -57,7 +60,9 @@
 
 import com.oracle.svm.hosted.code.FactoryMethod;
 import com.oracle.svm.util.LogUtils;
+import jdk.graal.compiler.nodes.ConstantNode;
 import jdk.graal.compiler.nodes.virtual.AllocatedObjectNode;
+import jdk.vm.ci.meta.JavaConstant;
 import org.graalvm.nativeimage.ImageSingletons;
 import org.graalvm.nativeimage.hosted.Feature;
 import org.graalvm.polyglot.io.FileSystem;
@@ -244,7 +249,8 @@ public void beforeAnalysis(BeforeAnalysisAccess access) {
         contextFilters = new HashSet<>();
         Collections.addAll(contextFilters, new SafeInterruptRecognizer(bb), new SafePrivilegedRecognizer(bb),
                         new SafeReflectionRecognizer(bb), new SafeSetThreadNameRecognizer(bb),
-                        new SafeLocaleServiceProvider(bb), new SafeSystemGetProperty(bb));
+                        new SafeLocaleServiceProvider(bb), new SafeSystemGetProperty(bb),
+                        new SafeURLOf(bb));
 
         /*
          * Ensure methods which are either deniedMethods or on the allow list are never inlined into
@@ -1069,6 +1075,61 @@ public Collection<AnalysisMethod> getInspectedMethods() {
         }
     }
 
+    /**
+     * A call to {@code URL.of(URI, URLStreamHandler)} is only considered safe when the specified
+     * {@link URLStreamHandler} is {@code null}.
+     */
+    private static final class SafeURLOf implements CallGraphFilter {
+
+        private final SVMHost hostVM;
+        private final AnalysisMethodNode of;
+
+        SafeURLOf(BigBang bigBang) {
+            this.hostVM = (SVMHost) bigBang.getHostVM();
+            Set<AnalysisMethodNode> methods = findMethods(bigBang, URL.class, (m) -> {
+                if (!"of".equals(m.getName())) {
+                    return false;
+                }
+                ResolvedJavaMethod.Parameter[] parameters = m.getParameters();
+                if (parameters.length != 2) {
+                    return false;
+                }
+                if (!bigBang.getMetaAccess().lookupJavaType(URI.class).getWrapped().equals(parameters[0].getType())) {
+                    return false;
+                }
+                return bigBang.getMetaAccess().lookupJavaType(URLStreamHandler.class).getWrapped().equals(parameters[1].getType());
+            });
+            if (methods.size() != 1) {
+                throw new IllegalStateException("Failed to lookup URL.of(URI, URLStreamHandler).");
+            }
+            this.of = methods.iterator().next();
+        }
+
+        @Override
+        public boolean test(BaseMethodNode methodNode, BaseMethodNode callerNode, List<BaseMethodNode> trace) {
+            if (!of.equals(methodNode)) {
+                return false;
+            }
+            AnalysisMethod method = methodNode.getMethod();
+            AnalysisMethod caller = callerNode.getMethod();
+            StructuredGraph graph = hostVM.getAnalysisGraph(caller);
+            Boolean res = null;
+            for (Invoke invoke : graph.getInvokes()) {
+                if (method.equals(invoke.callTarget().targetMethod())) {
+                    NodeInputList<ValueNode> args = invoke.callTarget().arguments();
+                    ValueNode arg1 = args.get(1);
+                    res = arg1 instanceof ConstantNode constantNode && constantNode.getValue() == JavaConstant.NULL_POINTER;
+                }
+            }
+            return res != null && res;
+        }
+
+        @Override
+        public Collection<AnalysisMethod> getInspectedMethods() {
+            return List.of(of.getMethod());
+        }
+    }
+
     abstract static class BaseMethodNode {
         abstract StackTraceElement asStackTraceElement();
 

truffle/mx.truffle/suite.py

@@ -870,7 +870,7 @@
         "jdk.unsupported", # sun.misc.Unsafe
       ],
       "checkstyle" : "com.oracle.truffle.api",
-      "javaCompliance" : "17+",
+      "javaCompliance" : "20+",
       "annotationProcessors" : ["TRUFFLE_DSL_PROCESSOR"],
       "workingSets" : "Truffle,Test",
       "jacoco" : "exclude",
@@ -2028,7 +2028,7 @@
 
     "TRUFFLE_TCK_TESTS_LANGUAGE" : {
       "subDir" : "src",
-      "javaCompliance" : "17+",
+      "javaCompliance" : "20+",
       "dependencies" : [
         "com.oracle.truffle.tck.tests.language"
       ],

truffle/src/com.oracle.truffle.tck.tests.language/src/com/oracle/truffle/tck/tests/language/TCKSmokeTestLanguage.java

@@ -41,6 +41,7 @@
 package com.oracle.truffle.tck.tests.language;
 
 import com.oracle.truffle.api.CallTarget;
+import com.oracle.truffle.api.CompilerDirectives;
 import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.TruffleLanguage;
 import com.oracle.truffle.api.TruffleLanguage.Registration;
@@ -64,6 +65,8 @@
 import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URL;
+import java.net.URLConnection;
+import java.net.URLStreamHandler;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ServiceLoader;
@@ -88,7 +91,11 @@ protected CallTarget parse(ParsingRequest request) {
             Thread thread = new Thread(() -> {
             });
             URL url = URI.create("http://localhost").toURL();
-            RootNode root = new RootNodeImpl(this, new PrivilegedCallNode(thread, url), new UnsafeCallNode());
+            RootNode root = new RootNodeImpl(this,
+                            new PrivilegedCallNode(thread, url),
+                            new UnsafeCallNode(),
+                            new AllowedURLNode(),
+                            new DeniedURLNode());
             return root.getCallTarget();
         } catch (MalformedURLException urlException) {
             throw new AssertionError(urlException);
@@ -270,4 +277,60 @@ static void doBehindBoundaryUnsafeAccess() {
             assert i == result;
         }
     }
+
+    private static final class AllowedURLNode extends BaseNode {
+
+        private final URI currentWorkingDirectory;
+
+        AllowedURLNode() {
+            this.currentWorkingDirectory = Path.of("").toAbsolutePath().toUri();
+        }
+
+        @Override
+        void execute(VirtualFrame frame) {
+            doURLOf();
+        }
+
+        @TruffleBoundary
+        private void doURLOf() {
+            try {
+                URL.of(currentWorkingDirectory, null);
+            } catch (MalformedURLException e) {
+                throw CompilerDirectives.shouldNotReachHere(e);
+            }
+        }
+    }
+
+    private static final class DeniedURLNode extends BaseNode {
+
+        private final URLStreamHandler handler;
+        private final URI currentWorkingDirectory;
+
+        DeniedURLNode() {
+            this.handler = new MockURLStreamHandler();
+            this.currentWorkingDirectory = Path.of("").toAbsolutePath().toUri();
+        }
+
+        @Override
+        void execute(VirtualFrame frame) {
+            doURLOf();
+        }
+
+        @TruffleBoundary
+        private void doURLOf() {
+            try {
+                URL.of(currentWorkingDirectory, handler);
+            } catch (MalformedURLException e) {
+                throw CompilerDirectives.shouldNotReachHere(e);
+            }
+        }
+
+        private static final class MockURLStreamHandler extends URLStreamHandler {
+
+            @Override
+            protected URLConnection openConnection(URL u) {
+                throw new UnsupportedOperationException();
+            }
+        }
+    }
 }

vm/mx.vm/mx_vm_gate.py

@@ -620,6 +620,7 @@ def _collect_excludes(suite, suite_import, excludes):
     excludes = []
     language_distribution.suite.visit_imports(_collect_excludes, excludes=excludes)
     svmbuild = mkdtemp()
+    success = False
     try:
         report_file = join(svmbuild, "language_permissions.log")
         options = mx.get_runtime_jvm_args(dists, exclude_names=['substratevm:SVM']) + [
@@ -647,8 +648,11 @@ def _collect_excludes(suite, suite_import, excludes):
                 mx.abort(message)
             else:
                 return message
+        else:
+            success = True
     finally:
-        mx.rmtree(svmbuild)
+        if success:
+            mx.rmtree(svmbuild)
     return None
 
 
@@ -663,7 +667,7 @@ def gate_truffle_native_tck_smoke_test(tasks):
                 if not 'Failed: Language TCKSmokeTestLanguage performs following privileged calls' in result:
                     mx.abort("Expected failure, log:\n" + result)
 
-                expected_methods = [
+                must_have_methods = [
                     'PrivilegedCallNode.callConstructorReflectively',
                     'PrivilegedCallNode.callMethodHandle',
                     'PrivilegedCallNode.callMethodReflectively',
@@ -674,11 +678,17 @@ def gate_truffle_native_tck_smoke_test(tasks):
                     'ServiceImpl.execute',
                     'UnsafeCallNode.doBehindBoundaryUnsafeAccess',
                     'UnsafeCallNode.doUnsafeAccess',
+                    'DeniedURLNode.doURLOf'
                 ]
-                for expected_method in expected_methods:
-                    if expected_method not in result:
-                        mx.abort(f"Missing {expected_method} call in the log.\nLog content:\n" + result)
-
+                must_not_have_methods = [
+                    'AllowedURLNode.doURLOf'
+                ]
+                for method in must_have_methods:
+                    if method not in result:
+                        mx.abort(f"Missing {method} call in the log.\nLog content:\n" + result)
+                for method in must_not_have_methods:
+                    if method in result:
+                        mx.abort(f"Found {method} call in the log.\nLog content:\n" + result)
 
 def gate_truffle_native_tck_js(tasks):
     with Task('JavaScript Truffle Native TCK', tasks, tags=[VmGateTasks.truffle_native_tck_js]) as t: