Attachment 663003 Details for Bug 884705 – Reviwed final patch

[patch] Reviwed final patch

headerPositionVErification2.patch (text/plain), 16.46 KB, created by jiri vanek on 2012-12-13 14:38:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: jiri vanek

Created: 2012-12-13 14:38:14 UTC

Size: 16.46 KB

patch

obsolete

>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/Launcher.java
>--- a/netx/net/sourceforge/jnlp/Launcher.java	Tue Dec 11 20:32:26 2012 +0100
>+++ b/netx/net/sourceforge/jnlp/Launcher.java	Wed Dec 12 16:22:14 2012 +0100
>@@ -30,7 +30,7 @@
> import java.util.LinkedList;
> import java.util.List;
> import java.util.Map;
>-import java.util.jar.JarFile;
>+import net.sourceforge.jnlp.util.JarFile;
> 
> import net.sourceforge.jnlp.cache.CacheUtil;
> import net.sourceforge.jnlp.cache.UpdatePolicy;
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/resources/Messages.properties
>--- a/netx/net/sourceforge/jnlp/resources/Messages.properties	Tue Dec 11 20:32:26 2012 +0100
>+++ b/netx/net/sourceforge/jnlp/resources/Messages.properties	Wed Dec 12 16:22:14 2012 +0100
>@@ -96,7 +96,7 @@
> LNotVerified=Jars not verified.
> LCancelOnUserRequest=Canceled on user request.
> LFatalVerification=A fatal error occurred while trying to verify jars.
>-LFatalVerificationInfo=
>+LFatalVerificationInfo=Description
> 
> LNotVerifiedDialog=Not all jars could be verified.
> LAskToContinue=Would you still like to continue running this application?
>@@ -188,6 +188,7 @@
> BOViewer    = Shows the trusted certificate viewer.
> BXnofork    = Do not create another JVM.
> BXclearcache= Clean the JNLP application cache.
>+BXignoreheaders= Skip jar header verification.
> BOHelp      = Print this message and exit.
> 
> # Cache
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/resources/Messages_cs_CZ.properties
>--- a/netx/net/sourceforge/jnlp/resources/Messages_cs_CZ.properties	Tue Dec 11 20:32:26 2012 +0100
>+++ b/netx/net/sourceforge/jnlp/resources/Messages_cs_CZ.properties	Wed Dec 12 16:22:14 2012 +0100
>@@ -94,7 +94,7 @@
> LNotVerified=Soubory JAR nebyly ov\u011b\u0159eny.
> LCancelOnUserRequest=Zru\u0161eno u\u017eivatelem.
> LFatalVerification=P\u0159i ov\u011b\u0159ov\u00e1n\u00ed soubor\u016f JAR do\u0161lo k z\u00e1va\u017en\u00e9 chyb\u011b.
>-LFatalVerificationInfo=
>+LFatalVerificationInfo=Popis
> 
> LNotVerifiedDialog=Nemohly b\u00fdt ov\u011b\u0159eny v\u0161echny soubory JAR.
> LAskToContinue=Chcete p\u0159esto pokra\u010dovat ve spou\u0161t\u011bn\u00ed t\u00e9to aplikace?
>@@ -186,6 +186,7 @@
> BOViewer= Zobraz\u00ed prohl\u00ed\u017ee\u010d d\u016fv\u011bryhodn\u00fdch certifik\u00e1t\u016f.
> BXnofork= Zak\u00e1\u017ee vytv\u00e1\u0159en\u00ed jin\u00fdch prost\u0159ed\u00ed JVM.
> BXclearcache= Vy\u010dist\u00ed vyrovn\u00e1vac\u00ed pam\u011b\u0165 aplikace JNLP.
>+BXignoreheaders= Nebude prov\u00e1d\u011bt verifikaci hlavi\u010dek soubor\u016f jar.
> BOHelp= Vyp\u00ed\u0161e zadanou zpr\u00e1vu do konzole a ukon\u010d\u00ed aplikaci.
> 
> # Cache
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/runtime/Boot.java
>--- a/netx/net/sourceforge/jnlp/runtime/Boot.java	Tue Dec 11 20:32:26 2012 +0100
>+++ b/netx/net/sourceforge/jnlp/runtime/Boot.java	Wed Dec 12 16:22:14 2012 +0100
>@@ -102,6 +102,7 @@
>             + "  -strict               " + R("BOStrict") + "\n"
>             + "  -Xnofork              " + R("BXnofork") + "\n"
>             + "  -Xclearcache          " + R("BXclearcache") + "\n"
>+            + "  -Xignoreheaders       " + R("BXignoreheaders") + "\n"
>             + "  -help                 " + R("BOHelp") + "\n";
> 
>     private static final String doubleArgs = "-basedir -jnlp -arg -param -property -update";
>@@ -159,6 +160,9 @@
>         if (null != getOption("-Xtrustall")) {
>             JNLPRuntime.setTrustAll(true);
>         }
>+        if (null != getOption("-Xignoreheaders")) {
>+            JNLPRuntime.setIgnoreHeaders(true);
>+        }
> 
>         JNLPRuntime.setInitialArgments(Arrays.asList(argsIn));
> 
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/runtime/CachedJarFileCallback.java
>--- a/netx/net/sourceforge/jnlp/runtime/CachedJarFileCallback.java	Tue Dec 11 20:32:26 2012 +0100
>+++ b/netx/net/sourceforge/jnlp/runtime/CachedJarFileCallback.java	Wed Dec 12 16:22:14 2012 +0100
>@@ -49,7 +49,7 @@
> import java.security.PrivilegedExceptionAction;
> import java.util.Map;
> import java.util.concurrent.ConcurrentHashMap;
>-import java.util.jar.JarFile;
>+import net.sourceforge.jnlp.util.JarFile;
> 
> import net.sourceforge.jnlp.util.UrlUtils;
> 
>@@ -81,7 +81,7 @@
>     }
> 
>     @Override
>-    public JarFile retrieve(URL url) throws IOException {
>+    public java.util.jar.JarFile retrieve(URL url) throws IOException {
>         URL localUrl = mapping.get(url);
> 
>         if (localUrl == null) {
>@@ -122,8 +122,8 @@
>     /*
>      * This method is a copy of URLJarFile.retrieve() without the callback check.
>      */
>-    private JarFile cacheJarFile(URL url) throws IOException {
>-        JarFile result = null;
>+    private  java.util.jar.JarFile cacheJarFile(URL url) throws IOException {
>+        java.util.jar.JarFile result = null;
> 
>         final int BUF_SIZE = 2048;
> 
>@@ -132,9 +132,9 @@
> 
>         try {
>             result =
>-                    AccessController.doPrivileged(new PrivilegedExceptionAction<JarFile>() {
>+                    AccessController.doPrivileged(new PrivilegedExceptionAction<java.util.jar.JarFile>() {
>                         @Override
>-                        public JarFile run() throws IOException {
>+                        public java.util.jar.JarFile run() throws IOException {
>                             OutputStream out = null;
>                             File tmpFile = null;
>                             try {
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java
>--- a/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java	Tue Dec 11 20:32:26 2012 +0100
>+++ b/netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java	Wed Dec 12 16:22:14 2012 +0100
>@@ -56,7 +56,7 @@
> import java.util.Vector;
> import java.util.concurrent.ConcurrentHashMap;
> import java.util.jar.JarEntry;
>-import java.util.jar.JarFile;
>+import net.sourceforge.jnlp.util.JarFile;
> import java.util.jar.Manifest;
> 
> import net.sourceforge.jnlp.AppletDesc;
>@@ -627,7 +627,7 @@
>                 //to read the cacerts or trusted.certs files.
>                 e.printStackTrace();
>                 throw new LaunchException(null, null, R("LSFatal"),
>-                                        R("LCInit"), R("LFatalVerification"), R("LFatalVerificationInfo"));
>+                                        R("LCInit"), R("LFatalVerification"), R("LFatalVerificationInfo") + ": " +e.getMessage());
>             }
> 
>             //Case when at least one jar has some signing
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/runtime/JNLPRuntime.java
>--- a/netx/net/sourceforge/jnlp/runtime/JNLPRuntime.java	Tue Dec 11 20:32:26 2012 +0100
>+++ b/netx/net/sourceforge/jnlp/runtime/JNLPRuntime.java	Wed Dec 12 16:22:14 2012 +0100
>@@ -87,7 +87,7 @@
>  * @version $Revision: 1.19 $
>  */
> public class JNLPRuntime {
>-
>+    
>     static {
>         loadResources();
>     }
>@@ -142,8 +142,16 @@
>     /** set to false to indicate another JVM should not be spawned, even if necessary */
>     private static boolean forksAllowed = true;
> 
>-    /** all security dialogs will be consumed and pretented as beeing verified by user and allowed.*/
>+    /** all security dialogs will be consumed and pretented as being verified by user and allowed.*/
>     private static boolean trustAll=false;
>+    /** 
>+     * Header is not checked and so eg. gifar exploit is possible
>+     * @see http://en.wikipedia.org/wiki/Gifar for this kind of attack.
>+     * However if jar file is a bit corrupted, then it sometimes can work so 
>+     * this switch can disable the header check.
>+     * 
>+     */
>+    private static boolean ignoreHeaders=false;
> 
>     /** contains the arguments passed to the jnlp runtime */
>     private static List<String> initialArguments;
>@@ -776,4 +784,14 @@
>         return trustAll;
>     }
> 
>+    public static boolean isIgnoreHeaders() {
>+        return ignoreHeaders;
>+    }
>+
>+    public static void setIgnoreHeaders(boolean ignoreHeaders) {
>+        JNLPRuntime.ignoreHeaders = ignoreHeaders;
>+    }
>+    
>+    
>+
> }
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/tools/JarCertVerifier.java
>--- a/netx/net/sourceforge/jnlp/tools/JarCertVerifier.java	Tue Dec 11 20:32:26 2012 +0100
>+++ b/netx/net/sourceforge/jnlp/tools/JarCertVerifier.java	Wed Dec 12 16:22:14 2012 +0100
>@@ -41,7 +41,7 @@
> import java.util.Map;
> import java.util.Vector;
> import java.util.jar.JarEntry;
>-import java.util.jar.JarFile;
>+import net.sourceforge.jnlp.util.JarFile;
> 
> import net.sourceforge.jnlp.JARDesc;
> import net.sourceforge.jnlp.JNLPFile;
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/util/InvalidJarHeaderException.java
>--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
>+++ b/netx/net/sourceforge/jnlp/util/InvalidJarHeaderException.java	Wed Dec 12 16:22:14 2012 +0100
>@@ -0,0 +1,49 @@
>+/*
>+Copyright (C) 2012 Red Hat, Inc.
>+
>+This file is part of IcedTea.
>+
>+IcedTea is free software; you can redistribute it and/or modify
>+it under the terms of the GNU General Public License as published by
>+the Free Software Foundation; either version 2, or (at your option)
>+any later version.
>+
>+IcedTea is distributed in the hope that it will be useful, but
>+WITHOUT ANY WARRANTY; without even the implied warranty of
>+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
>+General Public License for more details.
>+
>+You should have received a copy of the GNU General Public License
>+along with IcedTea; see the file COPYING.  If not, write to the
>+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
>+02110-1301 USA.
>+
>+Linking this library statically or dynamically with other modules is
>+making a combined work based on this library.  Thus, the terms and
>+conditions of the GNU General Public License cover the whole
>+combination.
>+
>+As a special exception, the copyright holders of this library give you
>+permission to link this library with independent modules to produce an
>+executable, regardless of the license terms of these independent
>+modules, and to copy and distribute the resulting executable under
>+terms of your choice, provided that you also meet, for each linked
>+independent module, the terms and conditions of the license of that
>+module.  An independent module is a module which is not derived from
>+or based on this library.  If you modify this library, you may extend
>+this exception to your version of the library, but you are not
>+obligated to do so.  If you do not wish to do so, delete this
>+exception statement from your version. */
>+package net.sourceforge.jnlp.util;
>+
>+/**
>+ * Thrown from net.sourceforge.jnlp.utilJArFile when verification of headers fails
>+ * 
>+ */
>+public class InvalidJarHeaderException extends RuntimeException{
>+
>+    public InvalidJarHeaderException(String string) {
>+        super(string);
>+    }
>+    
>+}
>diff -r 1fe2a4f7981f netx/net/sourceforge/jnlp/util/JarFile.java
>--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
>+++ b/netx/net/sourceforge/jnlp/util/JarFile.java	Wed Dec 12 16:22:14 2012 +0100
>@@ -0,0 +1,153 @@
>+/*
>+ Copyright (C) 2012 Red Hat, Inc.
>+
>+ This file is part of IcedTea.
>+
>+ IcedTea is free software; you can redistribute it and/or modify
>+ it under the terms of the GNU General Public License as published by
>+ the Free Software Foundation; either version 2, or (at your option)
>+ any later version.
>+
>+ IcedTea is distributed in the hope that it will be useful, but
>+ WITHOUT ANY WARRANTY; without even the implied warranty of
>+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
>+ General Public License for more details.
>+
>+ You should have received a copy of the GNU General Public License
>+ along with IcedTea; see the file COPYING.  If not, write to the
>+ Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
>+ 02110-1301 USA.
>+
>+ Linking this library statically or dynamically with other modules is
>+ making a combined work based on this library.  Thus, the terms and
>+ conditions of the GNU General Public License cover the whole
>+ combination.
>+
>+ As a special exception, the copyright holders of this library give you
>+ permission to link this library with independent modules to produce an
>+ executable, regardless of the license terms of these independent
>+ modules, and to copy and distribute the resulting executable under
>+ terms of your choice, provided that you also meet, for each linked
>+ independent module, the terms and conditions of the license of that
>+ module.  An independent module is a module which is not derived from
>+ or based on this library.  If you modify this library, you may extend
>+ this exception to your version of the library, but you are not
>+ obligated to do so.  If you do not wish to do so, delete this
>+ exception statement from your version. */
>+package net.sourceforge.jnlp.util;
>+
>+import java.io.File;
>+import java.io.FileInputStream;
>+import java.io.IOException;
>+import java.io.InputStream;
>+import java.util.zip.ZipFile;
>+import net.sourceforge.jnlp.runtime.JNLPRuntime;
>+
>+public class JarFile extends java.util.jar.JarFile {
>+
>+    public JarFile(String name) throws IOException {
>+       super(name);
>+       verifyZipHeader(new File(name));
>+    }
>+
>+    /**
>+     */
>+    public JarFile(String name, boolean verify) throws IOException {
>+        super(name, verify);
>+        verifyZipHeader(new File(name));
>+    }
>+
>+    /**
>+     */
>+    public JarFile(File file) throws IOException {
>+        super(file);
>+        verifyZipHeader(file);
>+    }
>+
>+    /**
>+     */
>+    public JarFile(File file, boolean verify) throws IOException {
>+        super(file, verify);
>+        verifyZipHeader(file);
>+    }
>+
>+    /*
>+     */
>+    public JarFile(File file, boolean verify, int mode) throws IOException {
>+        super(file, verify, mode);
>+         verifyZipHeader(file);
>+    }
>+    
>+    
>+    
>+    
>+    /**
>+     * According to specification -
>+     * http://www.pkware.com/documents/casestudies/APPNOTE.TXT or just google
>+     * around zip header all entries in zip-compressed must start with well
>+     * known "PK" which is defined as hexa x50 x4b x03 x04, which in decimal are
>+     * 80 75 3 4.
>+     * 
>+     * Note - this is not file-header, it is item-header.
>+     *
>+     * Actually most of compressing formats have some n-bytes header se eg:
>+     * http://www.gzip.org/zlib/rfc-gzip.html#header-trailer for ID1 and ID2 so
>+     * in case that some differently compressed jars will come to play, this is
>+     * the palce where to fix it.
>+     *
>+     */
>+    private static final byte[] ZIP_LOCAL_FILE_HEADER_SIGNATURE = new byte[]{80, 75, 3, 4};
>+
>+    /**
>+     * This method is checking first four bytes of jar-file against
>+     * ZIP_LOCAL_FILE_HEADER_SIGNATURE
>+     *
>+     * Although zip specification allows to skip all corrupted entries, it is
>+     * not safe for jars. If first four bytes of file are not zip
>+     * ZIP_LOCAL_FILE_HEADER_SIGNATURE then exception is thrown
>+     * 
>+     * As noted, ZIP_LOCAL_FILE_HEADER_SIGNATURE is not ile-header, but is item-header.
>+     * Possible attack is using the fact that entries without header are considered
>+     * corrupted and so can be ignoered. However, for other they can have some meaning.
>+     * 
>+     * So for our purposes we must insists on first record to be valid.
>+     *
>+     * @param file
>+     * @throws IOException, InvalidJarHeaderException
>+     */
>+    public static void verifyZipHeader(File file) throws IOException {
>+        if (!JNLPRuntime.isIgnoreHeaders()) {
>+            InputStream s = new FileInputStream(file);
>+            try {
>+                byte[] buffer = new byte[ZIP_LOCAL_FILE_HEADER_SIGNATURE.length];
>+                /*
>+                 * for case that new byte[] will accidently initialize same
>+                 * sequence as zip header and during the read the buffer will not be filled
>+                 */                
>+                for (int i = 0; i < buffer.length; i++) {
>+                    buffer[i] = 0;
>+                }
>+                int toRead = ZIP_LOCAL_FILE_HEADER_SIGNATURE.length;
>+                int readSoFar = 0;
>+                int n = 0;
>+                /*
>+                 * this is used instead of s.read(buffer) for case of block and
>+                 * so returned not-fully-filled dbuffer
>+                 */ 
>+                while ((n = s.read(buffer, readSoFar, buffer.length - readSoFar)) != -1) {
>+                    readSoFar += n;
>+                    if (readSoFar == toRead) {
>+                        break;
>+                    }
>+                }
>+                for (int i = 0; i < buffer.length; i++) {
>+                    if (buffer[i] != ZIP_LOCAL_FILE_HEADER_SIGNATURE[i]) {
>+                        throw new InvalidJarHeaderException("Jar " + file.getName() + " do not heave valid header. You can skip this check by -Xignoreheaders");
>+                    }
>+                }
>+            } finally {
>+                s.close();
>+            }
>+        }
>+    }
>+}

Flags:

jvanek: review+

Actions: View | Diff

Attachments on bug 884705: 659469 | 663002 | 663003