Package net.sourceforge.jnlp.util

Class JarFile

  • All Implemented Interfaces:
    java.io.Closeable, java.lang.AutoCloseable
    public class JarFile
extends java.lang.Object
implements java.io.Closeable
    A wrapper over JarFile that verifies zip headers to protect against GIFAR attacks.
    See Also:
    Gifar

    • Constructor Summary

      Constructors 
      Constructor Description
      JarFile​(java.io.File file)  
      JarFile​(java.lang.String file)  

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      void close()  
      private java.util.jar.JarFile createDelegate​(java.io.File file)  
      java.util.Enumeration<java.util.jar.JarEntry> entries()  
      java.io.InputStream getInputStream​(java.util.jar.JarEntry je)  
      java.util.jar.Manifest getManifest()  
      java.util.jar.JarFile getNative()  
      private void verifyZipHeader​(java.io.File file)
      Verify the header for the zip entry.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • JAVA9_OR_GREATER

        private static final boolean JAVA9_OR_GREATER

      • runtimeVersion

        private final LazyLoaded<java.lang.Object> runtimeVersion

      • constructor

        private final LazyLoaded<java.lang.reflect.Constructor<java.util.jar.JarFile>> constructor

      • delegate

        private final java.util.jar.JarFile delegate

      • ZIP_ENTRY_HEADER_SIGNATURE

        private static final byte[] ZIP_ENTRY_HEADER_SIGNATURE
        The ZIP specification requires that the zip header for all entries in a zip-compressed archive must start with a well known "PK" which is defined as hex x50 x4b x03 x04.

        Note - this is not file-header, it is item-header.

        Actually most of compressing formats have some n-bytes headers. Eg: http://www.gzip.org/zlib/rfc-gzip.html#header-trailer for ID1 and ID2 so in case that some differently compressed jars will come to play, this is the place where to fix it.

        See Also:
        ZIP Specification

      • HEADER_LENGTH

        private static final int HEADER_LENGTH

    • Constructor Detail

      • JarFile

        public JarFile​(java.lang.String file)
        throws java.io.IOException
        Throws:
        java.io.IOException

      • JarFile

        public JarFile​(java.io.File file)
        throws java.io.IOException
        Throws:
        java.io.IOException

    • Method Detail

      • createDelegate

        private java.util.jar.JarFile createDelegate​(java.io.File file)
                                      throws java.io.IOException
        Throws:
        java.io.IOException

      • getManifest

        public java.util.jar.Manifest getManifest()
                                   throws java.io.IOException
        Throws:
        java.io.IOException

      • entries

        public java.util.Enumeration<java.util.jar.JarEntry> entries()

      • getInputStream

        public java.io.InputStream getInputStream​(java.util.jar.JarEntry je)
                                   throws java.io.IOException
        Throws:
        java.io.IOException

      • close

        public void close()
           throws java.io.IOException
        Specified by:
        close in interface java.lang.AutoCloseable
        Specified by:
        close in interface java.io.Closeable
        Throws:
        java.io.IOException

      • getNative

        public java.util.jar.JarFile getNative()

      • verifyZipHeader

        private void verifyZipHeader​(java.io.File file)
                      throws java.io.IOException
        Verify the header for the zip entry.

        Although zip specification allows to skip all corrupted entries, it is not safe for jars since it allows a different format to fake itself as a Jar.

        Throws:
        java.io.IOException