/*
 * Copyright (C) 2013 XStream Committers.
 * All rights reserved.
 *
 * The software in this package is published under the terms of the BSD
 * style license a copy of which has been included with this distribution in
 * the LICENSE.txt file.
 * 
 * Created on 23. December 2013 by Joerg Schaible
 */
package com.thoughtworks.acceptance;

import java.beans.EventHandler;

import com.thoughtworks.xstream.XStreamException;
import com.thoughtworks.xstream.converters.ConversionException;
import com.thoughtworks.xstream.converters.reflection.ReflectionConverter;

/**
 * @author J&ouml;rg Schaible
 */
public class SecurityVulnerabilityTest extends AbstractAcceptanceTest {

    private final static StringBuffer BUFFER = new StringBuffer();
    
    protected void setUp() throws Exception {
        super.setUp();
        BUFFER.setLength(0);
    }

    public void testCannotInjectEventHandler() {
        String xml = ""
                + "<string class='set'>\n"
                + "  <dynamic-proxy>\n"
                + "    <interface>java.lang.Comparable</interface>\n"
                + "    <handler class='java.beans.EventHandler'>\n"
                + "      <target class='com.thoughtworks.acceptance.SecurityVulnerabilityTest$Run'/>\n"
                + "      <action>run</action>\n"
                + "    </handler>\n"
                + "  </dynamic-proxy>\n"
                + "</string>";
        
        try {
            xstream.fromXML(xml);
            fail("Thrown " + XStreamException.class.getName() + " expected");
        } catch (final XStreamException e) {
            assertTrue(e.getMessage().contains(EventHandler.class.getName()));
        }
        assertEquals(0, BUFFER.length());
    }

    public void testExplicitlyConvertEventHandler() {
        String xml = ""
                + "<string class='tree-set'>\n"
                + "  <dynamic-proxy>\n"
                + "    <interface>java.lang.Comparable</interface>\n"
                + "    <handler class='java.beans.EventHandler'>\n"
                + "      <target class='com.thoughtworks.acceptance.SecurityVulnerabilityTest$Run'/>\n"
                + "      <action>run</action>\n"
                + "    </handler>\n"
                + "  </dynamic-proxy>\n"
                + "  <object/>\n"
                + "</string>";

        xstream.registerConverter(new ReflectionConverter(xstream.getMapper(), xstream
            .getReflectionProvider(), EventHandler.class));
        try {
            xstream.fromXML(xml);
            fail("Thrown " + ConversionException.class.getName() + " expected");
        } catch (final ConversionException e) {
            assertEquals(RuntimeException.class, e.getCause().getClass());
        }
        
        assertEquals("Did run!", BUFFER.toString());
    }
    
    public static class Run implements Runnable {

        public void run() {
            BUFFER.append("Did run!");
        }
    }
}

@@ -2667,62 +2667,53 @@
 sert
-Equals(RuntimeException.class, e.getCause().getClass()
+True(e.getCause() instanceof RuntimeException
 );%0A 

Fix for Java 6 and 7.