diff --git a/src/changes/changes.xml b/src/changes/changes.xml index b798cbf7b6a..cad82da81f3 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -8,6 +8,9 @@ + + Security: prevent Rhinos access to Java resources; e.g. call java methods. + Upgrade Apache HttpComponents to 4.5.11. diff --git a/src/test/java/com/gargoylesoftware/htmlunit/javascript/JavaScriptEngine2Test.java b/src/test/java/com/gargoylesoftware/htmlunit/javascript/JavaScriptEngine2Test.java index 877c42edc31..8e93375fec9 100644 --- a/src/test/java/com/gargoylesoftware/htmlunit/javascript/JavaScriptEngine2Test.java +++ b/src/test/java/com/gargoylesoftware/htmlunit/javascript/JavaScriptEngine2Test.java @@ -16,6 +16,8 @@ import static org.junit.Assert.fail; +import java.net.URL; + import org.junit.Test; import org.junit.runner.RunWith; import org.openqa.selenium.By; @@ -891,4 +893,52 @@ public void ctorBooleanDocumentAll() throws Exception { loadPageWithAlerts2(html); } + + /** + * @throws Exception if the test fails + */ + @Test + @Alerts("exception") + public void javaNotAccessable() throws Exception { + final String html = "\n" + + "\n" + + "\n" + + "\n" + + ""; + + loadPageWithAlerts2(html); + } + + /** + * @throws Exception if the test fails + */ + @Test + @Alerts("Received: from worker - exception") + public void javaNotAccessableFromWorker() throws Exception { + final String html = "\n" + + "\n"; + + final String workerJs = "var pi = 'from worker';\n" + + "try {\n" + + " pi = pi + ' - ' + java.lang.Math.PI\n" + + "} catch (e) { pi = pi + ' - ' + 'exception'; }\n" + + "postMessage(pi);\n"; + + getMockWebConnection().setResponse(new URL(URL_FIRST, "worker.js"), workerJs); + + loadPageWithAlerts2(html, 2000); + } }