File CVE-2019-10185.patch of Package icedtea-web

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2019-10185.patch of Package icedtea-web (Revision f1e903b31e97f9c5686384f8b59c68b9)

Currently displaying revision f1e903b31e97f9c5686384f8b59c68b9 , Show latest

commit b4232ae35d2b86592a945a56c948f107fe7efabe
Author: Jiri Vanek <jvanek@redhat.com>
Date:   Wed Jun 26 13:46:45 2019 +0200

Nested jar, if by relative path point up, is stored as hashed

diff --git a/netx/net/sourceforge/jnlp/cache/CacheUtil.java b/netx/net/sourceforge/jnlp/cache/CacheUtil.java
index a972eb8e..5c8652b6 100644
--- a/netx/net/sourceforge/jnlp/cache/CacheUtil.java
+++ b/netx/net/sourceforge/jnlp/cache/CacheUtil.java
@@ -741,7 +741,7 @@
         }
     }
 
-    private static String hex(String origName, String candidate) throws NoSuchAlgorithmException {
+    public static String hex(String origName, String candidate) throws NoSuchAlgorithmException {
         MessageDigest md = MessageDigest.getInstance("SHA-256");
         byte[] sum = md.digest(candidate.getBytes(StandardCharsets.UTF_8));
         //convert the byte to hex format method 2
diff --git a/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java b/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
index e015f348..117163f3 100644
--- a/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
+++ b/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
@@ -1340,7 +1340,11 @@
                                         // (inline loading with "jar:..!/..." path will not work
                                         // with standard classloader methods)
 
-                                        String extractedJarLocation = localFile + ".nested/" + je.getName();
+                                        String name = je.getName();
+                                        if (name.contains("..")){
+                                            name=CacheUtil.hex(name, name);
+                                        }
+                                        String extractedJarLocation = localFile + ".nested/" + name;
                                         File parentDir = new File(extractedJarLocation).getParentFile();
                                         if (!parentDir.isDirectory() && !parentDir.mkdirs()) {
                                             throw new RuntimeException(R("RNestedJarExtration"));
diff --git a/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java b/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
index 7580d23b..a20a1d8f 100644
--- a/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
+++ b/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
@@ -43,6 +43,8 @@
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.InputStream;
+import java.io.OutputStream;
+import net.sourceforge.jnlp.ResourcesDesc;
 import java.net.URL;
 import java.nio.charset.Charset;
 import java.nio.file.Files;
@@ -407,13 +409,7 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
         JNLPRuntime.setDebug(true);
         try {
             final JNLPFile jnlpFile1 = new JNLPFile(new URL("http://localhost:" + port + "/up.jnlp"));
-            final JNLPClassLoader classLoader1 = new JNLPClassLoader(jnlpFile1, UpdatePolicy.ALWAYS) {
-                @Override
-                protected void activateJars(List<JARDesc> jars) {
-                    super.activateJars(jars);
-                }
-
-            };
+            final JNLPClassLoader classLoader1 = JNLPClassLoader.getInstance(jnlpFile1, UpdatePolicy.ALWAYS, false);
             InputStream is1 = classLoader1.getResourceAsStream("Hello1.class");
             is1.close();
             is1 = classLoader1.getResourceAsStream("META-INF/MANIFEST.MF");
@@ -430,4 +426,74 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
 
     }
 
+    @Test
+    public void testRelativePathInNestedJars() throws Exception {
+        CacheUtil.clearCache();
+        int port = ServerAccess.findFreePort();
+        File dir = FileTestUtils.createTempDirectory();
+        dir.deleteOnExit();
+        File jar = new File(dir,"jar03_dotdotN1.jar");
+        File jnlp = new File(dir,"jar_03_dotdot_jarN1.jnlp");
+        InputStream is1 = ClassLoader.getSystemClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp");
+        InputStream is2 = ClassLoader.getSystemClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/jar03_dotdotN1.jar");
+        OutputStream fos1 = new FileOutputStream(jnlp);
+        OutputStream fos2 = new FileOutputStream(jar);
+        StreamUtils.copyStream(is1, fos1);
+        StreamUtils.copyStream(is2, fos2);
+        fos1.flush();;
+        fos2.flush();
+        fos1.close();
+        fos2.close();
+        ServerLauncher as = ServerAccess.getIndependentInstance(dir.getAbsolutePath(), port);
+        boolean verifyBackup = JNLPRuntime.isVerifying();
+        boolean trustBackup= JNLPRuntime.isTrustAll();
+        boolean securityBAckup= JNLPRuntime.isSecurityEnabled();
+        boolean verbose= JNLPRuntime.isDebug();
+        JNLPRuntime.setVerify(false);
+        JNLPRuntime.setTrustAll(true);
+        JNLPRuntime.setSecurityEnabled(false);
+        JNLPRuntime.setDebug(true);
+        try {
+            //it is invalid jar, so we have to disable checks first
+            final JNLPFile jnlpFile = new JNLPFile(new URL("http://localhost:" + port + "/jar_03_dotdot_jarN1.jnlp"));
+            final JNLPClassLoader classLoader = JNLPClassLoader.getInstance(jnlpFile, UpdatePolicy.ALWAYS, false);
+
+            //ThreadGroup group = Thread.currentThread().getThreadGroup();
+            //ApplicationInstance app = new ApplicationInstance(jnlpFile, group, classLoader);
+            //classLoader.setApplication(app);
+            //app.initialize();
+
+            //this test is actually not testing mutch. The app must be accessing the nested jar in plugin-like way
+            InputStream is = classLoader.getResourceAsStream("application/abev/nyomtatvanyinfo/1965.teminfo.enyk");
+            is.close();
+            is = classLoader.getResourceAsStream("META-INF/MANIFEST.MF");
+            is.close();
+            is = classLoader.getResourceAsStream("META-INF/j1.jar");
+            is.close();
+            is = classLoader.getResourceAsStream("META-INF/../../jar01_to_be_injected.jar");
+            //the .. is not recognized correctly
+            //is.close();
+            //Class c = classLoader.getClass().forName("Hello1");
+            // in j1.jar
+            is = classLoader.getResourceAsStream("Hello1.class");
+            //is.close(); nested jar is not on defualt CP
+            //in  jar01
+            //c = classLoader.getClass().forName("com.devdaily.FileUtilities");
+            is = classLoader.getResourceAsStream("com/devdaily/FileUtilities.class");
+            // is.close(); nested jar is not on defualt CP
+            Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/0/http/localhost/"+port+"/jar_03_dotdot_jarN1.jnlp").exists());
+            Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar").exists());
+            Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar.nested/99a90686bfbe84e3f9dbeed8127bba85672ed73688d3c69191aa1ee70916a.jar").exists());
+            Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/jar03_dotdotN1.jar.nested/META-INF/j1.jar").exists());
+        } finally {
+            JNLPRuntime.setVerify(verifyBackup);
+            JNLPRuntime.setTrustAll(trustBackup);
+            JNLPRuntime.setSecurityEnabled(securityBAckup);
+            JNLPRuntime.setDebug(verbose);
+            as.stop();
+        }
+
+    }
+
+
 }
diff --git a/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp b/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp
new file mode 100644
index 00000000..71bdea87
--- /dev/null
+++ b/tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<jnlp spec="6.0+" >
+
+<information><title>1965</title><vendor>Nemzeti Ado- es Vamhivatal</vendor><offline-allowed/></information>
+
+<security><all-permissions/></security>
+
+<resources>
+  <j2se href="http://java.sun.com/products/autodl/j2se" version="1.8+" />
+  <jar href="jar03_dotdotN1.jar" version="2.0"/>
+</resources>
+
+<application-desc main-class="http://localhost/jar01.jar!META-INF/jar01_to_be_injected.jar!METAxINF.Test" />
+
+</jnlp>

Places

File CVE-2019-10185.patch of Package icedtea-web (Revision f1e903b31e97f9c5686384f8b59c68b9)

Places