GHSA-wc96-39fc-566f

@Test public void test() throws Exception { EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory()); try { OCSPRespBuilder respBuilder = new OCSPRespBuilder(); OCSPResp response = respBuilder.build(OCSPRespBuilder.INTERNAL_ERROR, null); byte[] responseEncoded = response.getEncoded(); IoTransport mockTransport = IoTransport.create(group.next(), () -> { NioSocketChannel channel = new NioSocketChannel(); channel.pipeline().addFirst(new ChannelOutboundHandlerAdapter() { @Override public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress, ChannelPromise promise) { promise.setSuccess(); ctx.executor().schedule(() -> { ctx.pipeline().fireChannelActive(); DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse( HttpVersion.HTTP_1_1, HttpResponseStatus.OK, Unpooled.wrappedBuffer(responseEncoded)); httpResponse.headers().set(HttpHeaderNames.CONTENT_TYPE, "application/ocsp-response"); httpResponse.headers().set(HttpHeaderNames.CONTENT_LENGTH, httpResponse.content().readableBytes()); ctx.pipeline().fireChannelRead(httpResponse); }, 500, TimeUnit.MILLISECONDS); } }); return channel; }, NioDatagramChannel::new); X509Bundle caRoot = new CertificateBuilder() .algorithm(CertificateBuilder.Algorithm.rsa2048) .subject("CN=TrustedRootCA") .setIsCertificateAuthority(true) .buildSelfSigned(); GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, "http://localhost/"); AuthorityInformationAccess aia = new AuthorityInformationAccess(new AccessDescription(AccessDescription.id_ad_ocsp, ocspName)); X509Bundle targetCert = new CertificateBuilder() .algorithm(CertificateBuilder.Algorithm.rsa2048) .subject("CN=TargetServer") .addExtensionOctetString("1.3.6.1.5.5.7.1.1", false, aia.getEncoded()) .buildIssuedBy(caRoot); SslContext serverSslCtx = SslContextBuilder.forServer(targetCert.getKeyPair().getPrivate(), targetCert.getCertificate()).build(); CopyOnWriteArrayList<String> receivedData = new CopyOnWriteArrayList<>(); CountDownLatch dataReceivedLatch = new CountDownLatch(1); new ServerBootstrap() .group(group) .channel(NioServerSocketChannel.class) .childHandler(new ChannelInitializer<SocketChannel>() { @Override protected void initChannel(SocketChannel ch) { ch.pipeline().addLast(serverSslCtx.newHandler(ch.alloc())); ch.pipeline().addLast(new SimpleChannelInboundHandler<ByteBuf>() { @Override protected void channelRead0(ChannelHandlerContext ctx, ByteBuf msg) { receivedData.add(msg.toString(CharsetUtil.UTF_8)); dataReceivedLatch.countDown(); } }); } }) .bind(8080) .sync() .channel(); SslContext clientSslCtx = SslContextBuilder.forClient() .trustManager(InsecureTrustManagerFactory.INSTANCE) .build(); DnsNameResolver resolver = OcspServerCertificateValidator.createDefaultResolver(mockTransport); Channel clientChannel = new Bootstrap() .group(group) .channel(NioSocketChannel.class) .handler(new ChannelInitializer<SocketChannel>() { @Override protected void initChannel(SocketChannel ch) { ch.pipeline().addLast(clientSslCtx.newHandler(ch.alloc(), "127.0.0.1", 8080)); ch.pipeline().addLast(new OcspServerCertificateValidator(true, false, mockTransport, resolver)); ch.pipeline().addLast(new ChannelInboundHandlerAdapter() { @Override public void userEventTriggered(ChannelHandlerContext ctx, Object evt) { if (evt instanceof SslHandshakeCompletionEvent) { SslHandshakeCompletionEvent sslEvent = (SslHandshakeCompletionEvent) evt; if (sslEvent.isSuccess()) { ctx.writeAndFlush(Unpooled.copiedBuffer("SECRET_DATA", CharsetUtil.UTF_8)); } } ctx.fireUserEventTriggered(evt); } }); } }) .connect("127.0.0.1", 8080) .sync() .channel(); assertTrue(clientChannel.closeFuture().await(5, TimeUnit.SECONDS)); Thread.sleep(200); assertFalse(receivedData.contains("SECRET_DATA"), "Server should not receive the data."); } finally { group.shutdownGracefully(); } }