You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2016/05/04 12:50:41 UTC
svn commit: r1742269 - in /tomcat/tc8.5.x/trunk: ./
java/org/apache/tomcat/util/scan/StandardJarScanner.java
webapps/docs/changelog.xml
Author: markt
Date: Wed May 4 12:50:40 2016
New Revision: 1742269
URL: http://svn.apache.org/viewvc?rev=1742269&view=rev
Log:
Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=59226
Switch to using a Deque for the calss path URLs to it can be added to
Add processing of Manifests for JARs
Modified:
tomcat/tc8.5.x/trunk/ (props changed)
tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/scan/StandardJarScanner.java
tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml
Propchange: tomcat/tc8.5.x/trunk/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Wed May 4 12:50:40 2016
@@ -1 +1 @@
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409,1741501,1741677
,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742250,1742263-1742264
+/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409,1741501,1741677
,1741892,1741896,1741984,1742023,1742042,1742071,1742090,1742093,1742101,1742105,1742111,1742139,1742146,1742148,1742166,1742181,1742184,1742187,1742246,1742248-1742251,1742263-1742264,1742268
Modified: tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/scan/StandardJarScanner.java
URL: http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/scan/StandardJarScanner.java?rev=1742269&r1=1742268&r2=1742269&view=diff
==============================================================================
--- tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/scan/StandardJarScanner.java (original)
+++ tomcat/tc8.5.x/trunk/java/org/apache/tomcat/util/scan/StandardJarScanner.java Wed May 4 12:50:40 2016
@@ -19,12 +19,19 @@ package org.apache.tomcat.util.scan;
import java.io.File;
import java.io.IOException;
import java.net.MalformedURLException;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.net.URL;
import java.net.URLClassLoader;
+import java.util.Arrays;
import java.util.Collections;
+import java.util.Deque;
import java.util.HashSet;
import java.util.Iterator;
+import java.util.LinkedList;
import java.util.Set;
+import java.util.jar.Attributes;
+import java.util.jar.Manifest;
import javax.servlet.ServletContext;
@@ -173,7 +180,7 @@ public class StandardJarScanner implemen
try {
url = context.getResource(path);
processedURLs.add(url);
- process(scanType, callback, url, path, true);
+ process(scanType, callback, url, path, true, null);
} catch (IOException e) {
log.warn(sm.getString("jarScan.webinflibFail", url), e);
}
@@ -232,9 +239,18 @@ public class StandardJarScanner implemen
if (isWebapp) {
isWebapp = isWebappClassLoader(classLoader);
}
- URL[] urls = ((URLClassLoader) classLoader).getURLs();
- for (int i=0; i<urls.length; i++) {
- if (processedURLs.contains(urls[i])) {
+
+ // Use a Deque so URLs can be removed as they are processed
+ // and new URLs can be added as they are discovered during
+ // processing.
+ Deque<URL> classPathUrlsToProcess = new LinkedList<>();
+ classPathUrlsToProcess.addAll(
+ Arrays.asList(((URLClassLoader) classLoader).getURLs()));
+
+ while (!classPathUrlsToProcess.isEmpty()) {
+ URL url = classPathUrlsToProcess.pop();
+
+ if (processedURLs.contains(url)) {
// Skip this URL it has already been processed
continue;
}
@@ -243,7 +259,7 @@ public class StandardJarScanner implemen
// on the extent to which Java 8 supports the
// Java 9 file formats since this code MUST run on
// Java 8.
- ClassPathEntry cpe = new ClassPathEntry(urls[i]);
+ ClassPathEntry cpe = new ClassPathEntry(url);
// JARs are scanned unless the filter says not to.
// Directories are scanned for pluggability scans or
@@ -255,17 +271,17 @@ public class StandardJarScanner implemen
getJarScanFilter().check(scanType,
cpe.getName())) {
if (log.isDebugEnabled()) {
- log.debug(sm.getString("jarScan.classloaderJarScan", urls[i]));
+ log.debug(sm.getString("jarScan.classloaderJarScan", url));
}
try {
- process(scanType, callback, urls[i], null, isWebapp);
+ process(scanType, callback, url, null, isWebapp, classPathUrlsToProcess);
} catch (IOException ioe) {
- log.warn(sm.getString("jarScan.classloaderFail", urls[i]), ioe);
+ log.warn(sm.getString("jarScan.classloaderFail", url), ioe);
}
} else {
// JAR / directory has been skipped
if (log.isTraceEnabled()) {
- log.trace(sm.getString("jarScan.classloaderJarNoScan", urls[i]));
+ log.trace(sm.getString("jarScan.classloaderJarNoScan", url));
}
}
}
@@ -300,7 +316,8 @@ public class StandardJarScanner implemen
* and all directories.
*/
private void process(JarScanType scanType, JarScannerCallback callback,
- URL url, String webappPath, boolean isWebapp) throws IOException {
+ URL url, String webappPath, boolean isWebapp, Deque<URL> classPathUrlsToProcess)
+ throws IOException {
if (log.isTraceEnabled()) {
log.trace(sm.getString("jarScan.jarUrlStart", url));
@@ -308,6 +325,7 @@ public class StandardJarScanner implemen
if ("jar".equals(url.getProtocol()) || url.getPath().endsWith(Constants.JAR_EXT)) {
try (Jar jar = JarFactory.newInstance(url)) {
+ processManifest(jar, isWebapp, classPathUrlsToProcess);
callback.scan(jar, webappPath, isWebapp);
}
} else if ("file".equals(url.getProtocol())) {
@@ -318,6 +336,7 @@ public class StandardJarScanner implemen
// Treat this file as a JAR
URL jarURL = UriUtil.buildJarUrl(f);
try (Jar jar = JarFactory.newInstance(jarURL)) {
+ processManifest(jar, isWebapp, classPathUrlsToProcess);
callback.scan(jar, webappPath, isWebapp);
}
} else if (f.isDirectory()) {
@@ -340,6 +359,54 @@ public class StandardJarScanner implemen
}
}
+
+ private static void processManifest(Jar jar, boolean isWebapp,
+ Deque<URL> classPathUrlsToProcess) throws IOException {
+
+ // Not processed for web application JARs nor if the caller did not
+ // provide a Deque of URLs to append to.
+ if (isWebapp || classPathUrlsToProcess == null) {
+ return;
+ }
+
+ Manifest manifest = jar.getManifest();
+ Attributes attributes = manifest.getMainAttributes();
+ String classPathAttribute = attributes.getValue("Class-Path");
+ if (classPathAttribute == null) {
+ return;
+ }
+ String[] classPathEntries = classPathAttribute.split(" ");
+ for (String classPathEntry : classPathEntries) {
+ classPathEntry = classPathEntry.trim();
+ if (classPathEntry.length() == 0) {
+ continue;
+ }
+ URL jarURL = jar.getJarFileURL();
+ URI jarURI;
+ try {
+ jarURI = jarURL.toURI();
+ } catch (URISyntaxException e) {
+ if (log.isDebugEnabled()) {
+ log.debug(sm.getString("jarScan.invalidUri", jarURL));
+ }
+ continue;
+ }
+ /*
+ * Note: Resolving the relative URLs from the manifest has the
+ * potential to introduce security concerns. However, since
+ * only JARs provided by the container and NOT those provided
+ * by web applications are processed, there should be no
+ * issues.
+ * If this feature is ever extended to include JARs provided
+ * by web applications, checks should be added to ensure that
+ * any relative URL does not step outside the web application.
+ */
+ URI classPathEntryURI = jarURI.resolve(classPathEntry);
+ URL classPathEntryURL = classPathEntryURI.toURL();
+ classPathUrlsToProcess.add(classPathEntryURL);
+ }
+ }
+
private static class ClassPathEntry {
Modified: tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml
URL: http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml?rev=1742269&r1=1742268&r2=1742269&view=diff
==============================================================================
--- tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml Wed May 4 12:50:40 2016
@@ -84,6 +84,11 @@
committed. (markt)
</fix>
<fix>
+ <bug>59226</bug>: Process the <code>Class-Path</code> attribute from
+ JAR manifests for JARs on the class path excluding JARs packaged in
+ <code>WEB-INF/lib</code>. (markt)
+ </fix>
+ <fix>
<bug>59255</bug>: Fix possible NPE in mapper. (kkolinko/remm)
</fix>
<fix>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org