archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 23:04:50 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8300140: ZipFile.isSignatureRelated returns true for files in META-INF subdirectories

Browse source 
Reviewed-by: weijun
This commit is contained in:
Eirik Bjorsnos 2023-01-27 22:47:51 +00:00 • committed by Weijun Wang
parent 5c59de52a3
commit 5dfc4ec7d9
6 changed files with 422 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

34
src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -81,6 +81,8 @@ public class SignatureFileVerifier {
/** ConstraintsParameters for checking disabled algorithms */
private JarConstraintsParameters params;
private static final String META_INF = "META-INF/";
/**
* Create the named SignatureFileVerifier.
*
@ -141,6 +143,18 @@ public class SignatureFileVerifier {
this.sfBytes = sfBytes;
}
/**
* Utility method used by JarVerifier and JarSigner
* to determine if a path is located directly in the
* META-INF/ directory
*
* @param name the path name to check
* @return true if the path resides in META-INF directly, ignoring case
*/
public static boolean isInMetaInf(String name) {
return name.regionMatches(true, 0, META_INF, 0, META_INF.length())
&& name.lastIndexOf('/') < META_INF.length();
}
/**
* Utility method used by JarVerifier and JarSigner
* to determine the signature file names and PKCS7 block
@ -153,7 +167,7 @@ public class SignatureFileVerifier {
*/
public static boolean isBlockOrSF(String s) {
// Note: keep this in sync with j.u.z.ZipFile.Source#isSignatureRelated
// we currently only support DSA and RSA PKCS7 blocks
// we currently only support DSA, RSA or EC PKCS7 blocks
return s.endsWith(".SF")
|| s.endsWith(".DSA")
|| s.endsWith(".RSA")
@ -191,19 +205,15 @@ public class SignatureFileVerifier {
* @return true if the input file name is signature related
*/
public static boolean isSigningRelated(String name) {
if (!isInMetaInf(name)) {
return false;
}
name = name.toUpperCase(Locale.ENGLISH);
if (!name.startsWith("META-INF/")) {
return false;
}
name = name.substring(9);
if (name.indexOf('/') != -1) {
return false;
}
if (isBlockOrSF(name) || name.equals("MANIFEST.MF")) {
if (isBlockOrSF(name) || name.equals("META-INF/MANIFEST.MF")) {
return true;
} else if (name.startsWith("SIG-")) {
} else if (name.startsWith("SIG-", META_INF.length())) {
// check filename extension
// see http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#Digital_Signatures
// see https://docs.oracle.com/en/java/javase/19/docs/specs/jar/jar.html#digital-signatures
// for what filename extensions are legal
int extIndex = name.lastIndexOf('.');
if (extIndex != -1) {