Blame SOURCES/issue3.patch

719156
commit b4232ae35d2b86592a945a56c948f107fe7efabe
719156
Author: Jiri Vanek <jvanek@redhat.com>
719156
Date:   Wed Jun 26 13:46:45 2019 +0200
719156
719156
    Nested jar, if by relative path point up, is stored as hashed
719156
719156
diff --git a/netx/net/sourceforge/jnlp/cache/CacheUtil.java b/netx/net/sourceforge/jnlp/cache/CacheUtil.java
719156
index a972eb8e..5c8652b6 100644
719156
--- a/netx/net/sourceforge/jnlp/cache/CacheUtil.java
719156
+++ b/netx/net/sourceforge/jnlp/cache/CacheUtil.java
719156
@@ -741,7 +741,7 @@
719156
         }
719156
     }
719156
 
719156
-    private static String hex(String origName, String candidate) throws NoSuchAlgorithmException {
719156
+    public static String hex(String origName, String candidate) throws NoSuchAlgorithmException {
719156
         MessageDigest md = MessageDigest.getInstance("SHA-256");
719156
         byte[] sum = md.digest(candidate.getBytes(StandardCharsets.UTF_8));
719156
         //convert the byte to hex format method 2
719156
diff --git a/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java b/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
719156
index e015f348..117163f3 100644
719156
--- a/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
719156
+++ b/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
719156
@@ -1340,7 +1340,11 @@
719156
                                         // (inline loading with "jar:..!/..." path will not work
719156
                                         // with standard classloader methods)
719156
                                         
719156
-                                        String extractedJarLocation = localFile + ".nested/" + je.getName();
719156
+                                        String name = je.getName();
719156
+                                        if (name.contains("..")){
719156
+                                            name=CacheUtil.hex(name, name);
719156
+                                        }
719156
+                                        String extractedJarLocation = localFile + ".nested/" + name;
719156
                                         File parentDir = new File(extractedJarLocation).getParentFile();
719156
                                         if (!parentDir.isDirectory() && !parentDir.mkdirs()) {
719156
                                             throw new RuntimeException(R("RNestedJarExtration"));
719156
diff --git a/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java b/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
719156
index 7580d23b..a20a1d8f 100644
719156
--- a/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
719156
+++ b/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
719156
@@ -43,6 +43,8 @@
719156
 import java.io.File;
719156
 import java.io.FileOutputStream;
719156
 import java.io.InputStream;
719156
+import java.io.OutputStream;
719156
+import net.sourceforge.jnlp.ResourcesDesc;
719156
 import java.net.URL;
719156
 import java.nio.charset.Charset;
719156
 import java.nio.file.Files;
719156
@@ -407,13 +409,7 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
719156
         JNLPRuntime.setDebug(true);
719156
         try {
719156
             final JNLPFile jnlpFile1 = new JNLPFile(new URL("http://localhost:" + port + "/up.jnlp"));
719156
-            final JNLPClassLoader classLoader1 = new JNLPClassLoader(jnlpFile1, UpdatePolicy.ALWAYS) {
719156
-                @Override
719156
-                protected void activateJars(List<JARDesc> jars) {
719156
-                    super.activateJars(jars);
719156
-                }
719156
-
719156
-            };
719156
+            final JNLPClassLoader classLoader1 = JNLPClassLoader.getInstance(jnlpFile1, UpdatePolicy.ALWAYS, false);
719156
             InputStream is1 = classLoader1.getResourceAsStream("Hello1.class");
719156
             is1.close();
719156
             is1 = classLoader1.getResourceAsStream("META-INF/MANIFEST.MF");
719156
@@ -430,4 +426,74 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
719156
 
719156
     }
719156
 
719156
+    @Test
719156
+    public void testRelativePathInNestedJars() throws Exception {
719156
+        CacheUtil.clearCache();
719156
+        int port = ServerAccess.findFreePort();
719156
+        File dir = FileTestUtils.createTempDirectory();
719156
+        dir.deleteOnExit();
719156
+        File jar = new File(dir,"jar03_dotdotN1.jar");
719156
+        File jnlp = new File(dir,"jar_03_dotdot_jarN1.jnlp");
719156
+        InputStream is1 = ClassLoader.getSystemClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp");
719156
+        InputStream is2 = ClassLoader.getSystemClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/jar03_dotdotN1.jar");
719156
+        OutputStream fos1 = new FileOutputStream(jnlp);
719156
+        OutputStream fos2 = new FileOutputStream(jar);
719156
+        StreamUtils.copyStream(is1, fos1);
719156
+        StreamUtils.copyStream(is2, fos2);
719156
+        fos1.flush();;
719156
+        fos2.flush();
719156
+        fos1.close();
719156
+        fos2.close();
719156
+        ServerLauncher as = ServerAccess.getIndependentInstance(dir.getAbsolutePath(), port);
719156
+        boolean verifyBackup = JNLPRuntime.isVerifying();
719156
+        boolean trustBackup= JNLPRuntime.isTrustAll();
719156
+        boolean securityBAckup= JNLPRuntime.isSecurityEnabled();
719156
+        boolean verbose= JNLPRuntime.isDebug();
719156
+        JNLPRuntime.setVerify(false);
719156
+        JNLPRuntime.setTrustAll(true);
719156
+        JNLPRuntime.setSecurityEnabled(false);
719156
+        JNLPRuntime.setDebug(true);
719156
+        try {
719156
+            //it is invalid jar, so we have to disable checks first
719156
+            final JNLPFile jnlpFile = new JNLPFile(new URL("http://localhost:" + port + "/jar_03_dotdot_jarN1.jnlp"));
719156
+            final JNLPClassLoader classLoader = JNLPClassLoader.getInstance(jnlpFile, UpdatePolicy.ALWAYS, false);
719156
+
719156
+            //ThreadGroup group = Thread.currentThread().getThreadGroup();
719156
+            //ApplicationInstance app = new ApplicationInstance(jnlpFile, group, classLoader);
719156
+            //classLoader.setApplication(app);
719156
+            //app.initialize();
719156
+
719156
+            //this test is actually not testing mutch. The app must be accessing the nested jar in plugin-like way
719156
+            InputStream is = classLoader.getResourceAsStream("application/abev/nyomtatvanyinfo/1965.teminfo.enyk");
719156
+            is.close();
719156
+            is = classLoader.getResourceAsStream("META-INF/MANIFEST.MF");
719156
+            is.close();
719156
+            is = classLoader.getResourceAsStream("META-INF/j1.jar");
719156
+            is.close();
719156
+            is = classLoader.getResourceAsStream("META-INF/../../jar01_to_be_injected.jar");
719156
+            //the .. is not recognized correctly
719156
+            //is.close();
719156
+            //Class c = classLoader.getClass().forName("Hello1");
719156
+            // in j1.jar
719156
+            is = classLoader.getResourceAsStream("Hello1.class");
719156
+            //is.close(); nested jar is not on defualt CP
719156
+            //in  jar01
719156
+            //c = classLoader.getClass().forName("com.devdaily.FileUtilities");
719156
+            is = classLoader.getResourceAsStream("com/devdaily/FileUtilities.class");
719156
+            // is.close(); nested jar is not on defualt CP
719156
+            Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/0/http/localhost/"+port+"/jar_03_dotdot_jarN1.jnlp").exists());
719156
+            Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar").exists());
719156
+            Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar.nested/99a90686bfbe84e3f9dbeed8127bba85672ed73688d3c69191aa1ee70916a.jar").exists());
719156
+            Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar.nested/META-INF/j1.jar").exists());
719156
+        } finally {
719156
+            JNLPRuntime.setVerify(verifyBackup);
719156
+            JNLPRuntime.setTrustAll(trustBackup);
719156
+            JNLPRuntime.setSecurityEnabled(securityBAckup);
719156
+            JNLPRuntime.setDebug(verbose);
719156
+            as.stop();
719156
+        }
719156
+
719156
+    }
719156
+
719156
+
719156
 }
719156
diff --git a/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp b/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp
719156
new file mode 100644
719156
index 00000000..71bdea87
719156
--- /dev/null
719156
+++ b/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp
719156
@@ -0,0 +1,15 @@
719156
+
719156
+<jnlp spec="6.0+" >
719156
+
719156
+<information><title>1965</title><vendor>Nemzeti Ado- es Vamhivatal</vendor><offline-allowed/></information>
719156
+
719156
+<security><all-permissions/></security>
719156
+
719156
+<resources>
719156
+  <j2se href="http://java.sun.com/products/autodl/j2se" version="1.8+" />
719156
+  <jar href="jar03_dotdotN1.jar" version="2.0"/>
719156
+</resources>
719156
+
719156
+<application-desc main-class="http://localhost/jar01.jar!META-INF/jar01_to_be_injected.jar!METAxINF.Test" />
719156
+
719156
+</jnlp>