|
|
719156 |
commit b4232ae35d2b86592a945a56c948f107fe7efabe
|
|
|
719156 |
Author: Jiri Vanek <jvanek@redhat.com>
|
|
|
719156 |
Date: Wed Jun 26 13:46:45 2019 +0200
|
|
|
719156 |
|
|
|
719156 |
Nested jar, if by relative path point up, is stored as hashed
|
|
|
719156 |
|
|
|
719156 |
diff --git a/netx/net/sourceforge/jnlp/cache/CacheUtil.java b/netx/net/sourceforge/jnlp/cache/CacheUtil.java
|
|
|
719156 |
index a972eb8e..5c8652b6 100644
|
|
|
719156 |
--- a/netx/net/sourceforge/jnlp/cache/CacheUtil.java
|
|
|
719156 |
+++ b/netx/net/sourceforge/jnlp/cache/CacheUtil.java
|
|
|
719156 |
@@ -741,7 +741,7 @@
|
|
|
719156 |
}
|
|
|
719156 |
}
|
|
|
719156 |
|
|
|
719156 |
- private static String hex(String origName, String candidate) throws NoSuchAlgorithmException {
|
|
|
719156 |
+ public static String hex(String origName, String candidate) throws NoSuchAlgorithmException {
|
|
|
719156 |
MessageDigest md = MessageDigest.getInstance("SHA-256");
|
|
|
719156 |
byte[] sum = md.digest(candidate.getBytes(StandardCharsets.UTF_8));
|
|
|
719156 |
//convert the byte to hex format method 2
|
|
|
719156 |
diff --git a/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java b/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
|
|
|
719156 |
index e015f348..117163f3 100644
|
|
|
719156 |
--- a/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
|
|
|
719156 |
+++ b/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
|
|
|
719156 |
@@ -1340,7 +1340,11 @@
|
|
|
719156 |
// (inline loading with "jar:..!/..." path will not work
|
|
|
719156 |
// with standard classloader methods)
|
|
|
719156 |
|
|
|
719156 |
- String extractedJarLocation = localFile + ".nested/" + je.getName();
|
|
|
719156 |
+ String name = je.getName();
|
|
|
719156 |
+ if (name.contains("..")){
|
|
|
719156 |
+ name=CacheUtil.hex(name, name);
|
|
|
719156 |
+ }
|
|
|
719156 |
+ String extractedJarLocation = localFile + ".nested/" + name;
|
|
|
719156 |
File parentDir = new File(extractedJarLocation).getParentFile();
|
|
|
719156 |
if (!parentDir.isDirectory() && !parentDir.mkdirs()) {
|
|
|
719156 |
throw new RuntimeException(R("RNestedJarExtration"));
|
|
|
719156 |
diff --git a/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java b/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
|
|
|
719156 |
index 7580d23b..a20a1d8f 100644
|
|
|
719156 |
--- a/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
|
|
|
719156 |
+++ b/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
|
|
|
719156 |
@@ -43,6 +43,8 @@
|
|
|
719156 |
import java.io.File;
|
|
|
719156 |
import java.io.FileOutputStream;
|
|
|
719156 |
import java.io.InputStream;
|
|
|
719156 |
+import java.io.OutputStream;
|
|
|
719156 |
+import net.sourceforge.jnlp.ResourcesDesc;
|
|
|
719156 |
import java.net.URL;
|
|
|
719156 |
import java.nio.charset.Charset;
|
|
|
719156 |
import java.nio.file.Files;
|
|
|
719156 |
@@ -407,13 +409,7 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
|
|
|
719156 |
JNLPRuntime.setDebug(true);
|
|
|
719156 |
try {
|
|
|
719156 |
final JNLPFile jnlpFile1 = new JNLPFile(new URL("http://localhost:" + port + "/up.jnlp"));
|
|
|
719156 |
- final JNLPClassLoader classLoader1 = new JNLPClassLoader(jnlpFile1, UpdatePolicy.ALWAYS) {
|
|
|
719156 |
- @Override
|
|
|
719156 |
- protected void activateJars(List<JARDesc> jars) {
|
|
|
719156 |
- super.activateJars(jars);
|
|
|
719156 |
- }
|
|
|
719156 |
-
|
|
|
719156 |
- };
|
|
|
719156 |
+ final JNLPClassLoader classLoader1 = JNLPClassLoader.getInstance(jnlpFile1, UpdatePolicy.ALWAYS, false);
|
|
|
719156 |
InputStream is1 = classLoader1.getResourceAsStream("Hello1.class");
|
|
|
719156 |
is1.close();
|
|
|
719156 |
is1 = classLoader1.getResourceAsStream("META-INF/MANIFEST.MF");
|
|
|
719156 |
@@ -430,4 +426,74 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
|
|
|
719156 |
|
|
|
719156 |
}
|
|
|
719156 |
|
|
|
719156 |
+ @Test
|
|
|
719156 |
+ public void testRelativePathInNestedJars() throws Exception {
|
|
|
719156 |
+ CacheUtil.clearCache();
|
|
|
719156 |
+ int port = ServerAccess.findFreePort();
|
|
|
719156 |
+ File dir = FileTestUtils.createTempDirectory();
|
|
|
719156 |
+ dir.deleteOnExit();
|
|
|
719156 |
+ File jar = new File(dir,"jar03_dotdotN1.jar");
|
|
|
719156 |
+ File jnlp = new File(dir,"jar_03_dotdot_jarN1.jnlp");
|
|
|
719156 |
+ InputStream is1 = ClassLoader.getSystemClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp");
|
|
|
719156 |
+ InputStream is2 = ClassLoader.getSystemClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/jar03_dotdotN1.jar");
|
|
|
719156 |
+ OutputStream fos1 = new FileOutputStream(jnlp);
|
|
|
719156 |
+ OutputStream fos2 = new FileOutputStream(jar);
|
|
|
719156 |
+ StreamUtils.copyStream(is1, fos1);
|
|
|
719156 |
+ StreamUtils.copyStream(is2, fos2);
|
|
|
719156 |
+ fos1.flush();;
|
|
|
719156 |
+ fos2.flush();
|
|
|
719156 |
+ fos1.close();
|
|
|
719156 |
+ fos2.close();
|
|
|
719156 |
+ ServerLauncher as = ServerAccess.getIndependentInstance(dir.getAbsolutePath(), port);
|
|
|
719156 |
+ boolean verifyBackup = JNLPRuntime.isVerifying();
|
|
|
719156 |
+ boolean trustBackup= JNLPRuntime.isTrustAll();
|
|
|
719156 |
+ boolean securityBAckup= JNLPRuntime.isSecurityEnabled();
|
|
|
719156 |
+ boolean verbose= JNLPRuntime.isDebug();
|
|
|
719156 |
+ JNLPRuntime.setVerify(false);
|
|
|
719156 |
+ JNLPRuntime.setTrustAll(true);
|
|
|
719156 |
+ JNLPRuntime.setSecurityEnabled(false);
|
|
|
719156 |
+ JNLPRuntime.setDebug(true);
|
|
|
719156 |
+ try {
|
|
|
719156 |
+ //it is invalid jar, so we have to disable checks first
|
|
|
719156 |
+ final JNLPFile jnlpFile = new JNLPFile(new URL("http://localhost:" + port + "/jar_03_dotdot_jarN1.jnlp"));
|
|
|
719156 |
+ final JNLPClassLoader classLoader = JNLPClassLoader.getInstance(jnlpFile, UpdatePolicy.ALWAYS, false);
|
|
|
719156 |
+
|
|
|
719156 |
+ //ThreadGroup group = Thread.currentThread().getThreadGroup();
|
|
|
719156 |
+ //ApplicationInstance app = new ApplicationInstance(jnlpFile, group, classLoader);
|
|
|
719156 |
+ //classLoader.setApplication(app);
|
|
|
719156 |
+ //app.initialize();
|
|
|
719156 |
+
|
|
|
719156 |
+ //this test is actually not testing mutch. The app must be accessing the nested jar in plugin-like way
|
|
|
719156 |
+ InputStream is = classLoader.getResourceAsStream("application/abev/nyomtatvanyinfo/1965.teminfo.enyk");
|
|
|
719156 |
+ is.close();
|
|
|
719156 |
+ is = classLoader.getResourceAsStream("META-INF/MANIFEST.MF");
|
|
|
719156 |
+ is.close();
|
|
|
719156 |
+ is = classLoader.getResourceAsStream("META-INF/j1.jar");
|
|
|
719156 |
+ is.close();
|
|
|
719156 |
+ is = classLoader.getResourceAsStream("META-INF/../../jar01_to_be_injected.jar");
|
|
|
719156 |
+ //the .. is not recognized correctly
|
|
|
719156 |
+ //is.close();
|
|
|
719156 |
+ //Class c = classLoader.getClass().forName("Hello1");
|
|
|
719156 |
+ // in j1.jar
|
|
|
719156 |
+ is = classLoader.getResourceAsStream("Hello1.class");
|
|
|
719156 |
+ //is.close(); nested jar is not on defualt CP
|
|
|
719156 |
+ //in jar01
|
|
|
719156 |
+ //c = classLoader.getClass().forName("com.devdaily.FileUtilities");
|
|
|
719156 |
+ is = classLoader.getResourceAsStream("com/devdaily/FileUtilities.class");
|
|
|
719156 |
+ // is.close(); nested jar is not on defualt CP
|
|
|
719156 |
+ Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/0/http/localhost/"+port+"/jar_03_dotdot_jarN1.jnlp").exists());
|
|
|
719156 |
+ Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar").exists());
|
|
|
719156 |
+ Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar.nested/99a90686bfbe84e3f9dbeed8127bba85672ed73688d3c69191aa1ee70916a.jar").exists());
|
|
|
719156 |
+ Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar.nested/META-INF/j1.jar").exists());
|
|
|
719156 |
+ } finally {
|
|
|
719156 |
+ JNLPRuntime.setVerify(verifyBackup);
|
|
|
719156 |
+ JNLPRuntime.setTrustAll(trustBackup);
|
|
|
719156 |
+ JNLPRuntime.setSecurityEnabled(securityBAckup);
|
|
|
719156 |
+ JNLPRuntime.setDebug(verbose);
|
|
|
719156 |
+ as.stop();
|
|
|
719156 |
+ }
|
|
|
719156 |
+
|
|
|
719156 |
+ }
|
|
|
719156 |
+
|
|
|
719156 |
+
|
|
|
719156 |
}
|
|
|
719156 |
diff --git a/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp b/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp
|
|
|
719156 |
new file mode 100644
|
|
|
719156 |
index 00000000..71bdea87
|
|
|
719156 |
--- /dev/null
|
|
|
719156 |
+++ b/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp
|
|
|
719156 |
@@ -0,0 +1,15 @@
|
|
|
719156 |
+
|
|
|
719156 |
+<jnlp spec="6.0+" >
|
|
|
719156 |
+
|
|
|
719156 |
+<information><title>1965</title><vendor>Nemzeti Ado- es Vamhivatal</vendor><offline-allowed/></information>
|
|
|
719156 |
+
|
|
|
719156 |
+<security><all-permissions/></security>
|
|
|
719156 |
+
|
|
|
719156 |
+<resources>
|
|
|
719156 |
+ <j2se href="http://java.sun.com/products/autodl/j2se" version="1.8+" />
|
|
|
719156 |
+ <jar href="jar03_dotdotN1.jar" version="2.0"/>
|
|
|
719156 |
+</resources>
|
|
|
719156 |
+
|
|
|
719156 |
+<application-desc main-class="http://localhost/jar01.jar!META-INF/jar01_to_be_injected.jar!METAxINF.Test" />
|
|
|
719156 |
+
|
|
|
719156 |
+</jnlp>
|