Version 4.4.1 |
|
---|---|
December 09, 2011 |
These release notes describe the JavaTest™ Architect's release, version 4.4.1 . This is a maintenance release that fixes issues in various areas. For a detailed list, see Bugs Fixed in Release 4.4.1 below.
It is extremely important to note that the JavaTest installation and runtime system is fundamentally a developer system that is not specifically designed to guard against any malicious attacks from outside intruders. If sample code or tests you author make a network call, you can expose the JavaTest operating environment during execution. For this reason, it is critically important to observe the precautions outlined in the following security guidelines when installing and running JavaTest.
The harness itself is self-contained in javatest.jar
. The only external dependency is jh.jar
, which should be placed either on the classpath or in the same directory as javatest.jar
. If desired, the following optional parts of the binary distribution can be deleted:
examples/
directory.doc/
directory.lib/jt-junit.jar
which is an optional binary component.To maintain optimum network security, JavaTest can be installed and run in a "closed" network operating environment, meaning JavaTest is not connected directly to the Internet, or to a company Intranet environment that could introduce unwanted exposure to malicious intrusion. This is the ideal secure operating environment when it is possible.
JavaTest does not require an "Intranet" connection that supports network connections to systems outside the JavaTest architecture to intra-company resources, but, for example, some Java ME applications in a test suite might use an HTTP connection. If JavaTest or applications launched from JavaTest are open to any network access you must observe the following precautions to protect valuable resources from malicious intrusion:
Install JavaTest behind a secure firewall that strictly limits unauthorized network access to the Java ME SDK file system and services. Limit access privileges to those that are required for JavaTest usage while allowing all the I-directional local network communications that are necessary for JavaTest functionality. The firewall configuration must support these requirements to run JavaTest while also addressing them from a security standpoint.
Follow the principle of "least privilege" by assigning the minimum set of system access permissions required for installation and execution of JavaTest.
Do not store any data sensitive information on the same file system that is hosting JavaTest.
To maintain the maximum level of security, make sure the operating system patches are up-to-date on the JavaTest host machine.
When using Java 7 on Windows, the harness might experience problems executing particular parts of the Java 7 APIs because, by default, the harness security manager denies access to certain properties. The problem might manifest as one of the Known Exceptions reproduced below (see java.io.IOException and Socket Exception Error).
There are three ways to workaround the security exceptions:
Use the Java 6 runtime instead. Java 6 is the target execution platform for the harness and is also the minimum Java version supported by the harness.
Set the javatest.security.allowPropertiesAccess
system property to "true"
at startup. The harness security manager (JavaTestSecurityManager) is automatically installed at startup, and its default settings deny access to the System Properties object. You can manually allow access to harness properties as follows:
java -Djavatest.security.allowPropertiesAccess=true ...
Enable and disable property access programatically. The following code temporarily allows properties access until after the code in the try
block is executed. Beware of race conditions when using this code.
SecurityManager sm = System.getSecurityManager(); JavaTestSecurityManager jtSm = null; boolean prev = false; if (sm != null && sm instanceof JavaTestSecurityManager) { jtSm = (JavaTestSecurityManager) sm; prev = jtSm.setAllowPropertiesAccess(true); } try { // execute exception causing actions here } finally { if (jtSm != null) { jtSm.setAllowPropertiesAccess(prev); } }
The following exceptions might be seen if you use the harness with the Java 7 platform on the Windows operating system. Use one of the above workarounds to avoid these exceptions.
java.io.IOException: The requested operation cannot be performed on a file with a user-mapped section open at sun.nio.ch.FileDispatcherImpl.truncate0(Native Method) at sun.nio.ch.FileDispatcherImpl.truncate(FileDispatcherImpl.java:xxx) at sun.nio.ch.FileChannelImpl.truncate(FileChannelImpl.java:xxx)
java.lang.NoClassDefFoundError: Could not initialize class java.net.SocksSocketImpl at java.net.ServerSocket.setImpl(ServerSocket.java:xxx) at java.net.ServerSocket.<init>(ServerSocket.java:xxx) at java.net.ServerSocket.<init>(ServerSocket.java:xxx) at com.sun.jck.lib.multijvm.group.TaskManager.run(TaskManager.java:xxx) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:xxx) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:xxx) at java.lang.Thread.run(Thread.java:xxx) or with the following exception: java.lang.ExceptionInInitializerError at java.net.ServerSocket.setImpl(ServerSocket.java:xxx) at java.net.ServerSocket.<init>(ServerSocket.java:xxx) at java.net.ServerSocket.<init>(ServerSocket.java:xxx) at com.sun.jck.lib.multijvm.group.TaskManager.run(TaskManager.java:xxx) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:xxx) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:xxx) at java.lang.Thread.run(Thread.java:xxx ) Caused by: java.lang.SecurityException: Action forbidden by JavaTest Harness: checkPropertiesAccess at com.sun.javatest.JavaTestSecurityManager.checkPropertiesAccess(JavaTestSecurityManager.java:xxx) at java.lang.System.getProperties(System.java:xxx) at java.net.PlainSocketImpl$1.run(PlainSocketImpl.java:xxx) at java.security.AccessController.doPrivileged(Native Method) at java.net.PlainSocketImpl.<clinit>(PlainSocketImpl.java:xxx)
This release of the JavaTest harness contains fixes for the following bugs of interest to test suite architects:
Bug ID | Description |
---|---|
6909123 | ResourceTable class deadlocks if lock name is duplicated. |
6994793 | Source file path name normalization in test description. |
7024690 | Memory leak in test suite properties dialog. |
7036583 | Invalid File to URL conversion in TestSuite.open0. |
7060753 | Need an ability to show big amount of information in ErrorQuestion. |
7085889 | Fix multiple issues with Architect's guide - updates, formatting, etcetera. |
Multiple IDs | Protect against possible NPEs, initialization, synchrronization, invalid conversion and finalization problems. |
This release of the JavaTest harness contains the following bugs of interest to test suite architects:
Bug ID | Description |
---|---|
6221569 | ExcludeList class is not thread safe to use. |
6243792 | JavaTest agent class loader should implement getResource(). |
6243817 | Tests with empty resources can't pass agentClassLoader. |
6286663 | Accessing security-sensitive APIs in Agent commands causes failures for concurrent runs. |
6371560 | Need a way to map directory names containing spaces. |
6376929 | PropertiesQuestion.setConstraints() throws NPE if question is invalid. |
6488854 | PropertiesQuestion should be rendered without combo boxes in some cases. |
6511056 | File URL is incorrectly formed by putUrlAndFile(), class com.sun.javatest.TestEnvironment. |
6525534 | TestEnvironment.lookup(String) returns empty array for empty value. |
6535329 | Failed to load resource bundles located in windows denoted shared(\\server\path). |
6612902 | ValueConstraints - isValid() implementation contradicts isUnsetAllowed(). |
6701547 | IntegerQuestionRenderer handles resizing poorly. |
Copyright © 1996, 2011, Oracle and/or its affiliates. All rights reserved.