spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2026-09-17 12:09:16 +00:00
Code Issues Projects Releases Wiki Activity

Merge branch '4.0.x'

Browse Source 
Closes gh-50298
This commit is contained in:
Phillip Webb
2026-05-05 11:35:27 -07:00
parent bcf4c32426 031cf98084
commit fae5a098f7
9 changed files with 238 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
loader/spring-boot-loader/src/main/java/org/springframework/boot/loader/zip/ZipContent.java
+53 -17
View File
@@ -26,10 +26,12 @@ import java.nio.channels.ClosedChannelException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Path;
import java.util.Arrays;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.function.BiFunction;
import java.util.function.Function;
import java.util.stream.Stream;
import java.util.zip.ZipEntry;
import org.springframework.boot.loader.log.DebugLogger;
@@ -62,10 +64,6 @@ import org.springframework.boot.loader.log.DebugLogger;
*/
public final class ZipContent implements Closeable {
private static final String META_INF = "META-INF/";
private static final byte[] SIGNATURE_SUFFIX = ".DSA".getBytes(StandardCharsets.UTF_8);
private static final DebugLogger debug = DebugLogger.get(ZipContent.class);
private static final Map<Source, ZipContent> cache = new ConcurrentHashMap<>();
@@ -601,26 +599,16 @@ public final class ZipContent implements Closeable {
throw new IllegalStateException("Too many zip entries in " + source);
}
Loader loader = new Loader(source, null, data, centralDirectoryPos, (int) numberOfEntries);
ByteBuffer signatureNameSuffixBuffer = ByteBuffer.allocate(SIGNATURE_SUFFIX.length);
boolean hasJarSignatureFile = false;
SignatureFiles signatureFiles = new SignatureFiles();
long pos = centralDirectoryPos;
for (int i = 0; i < numberOfEntries; i++) {
ZipCentralDirectoryFileHeaderRecord centralRecord = ZipCentralDirectoryFileHeaderRecord.load(data, pos);
if (!hasJarSignatureFile) {
long filenamePos = pos + ZipCentralDirectoryFileHeaderRecord.FILE_NAME_OFFSET;
if (centralRecord.fileNameLength() > SIGNATURE_SUFFIX.length && ZipString.startsWith(loader.buffer,
data, filenamePos, centralRecord.fileNameLength(), META_INF) >= 0) {
signatureNameSuffixBuffer.clear();
data.readFully(signatureNameSuffixBuffer,
filenamePos + centralRecord.fileNameLength() - SIGNATURE_SUFFIX.length);
hasJarSignatureFile = Arrays.equals(SIGNATURE_SUFFIX, signatureNameSuffixBuffer.array());
}
}
signatureFiles.detect(centralRecord, data, pos, loader.buffer);
loader.add(centralRecord, pos, false);
pos += centralRecord.size();
}
long commentPos = locatedEocd.pos() + ZipEndOfCentralDirectoryRecord.COMMENT_OFFSET;
return loader.finish(kind, commentPos, eocd.commentLength(), hasJarSignatureFile);
return loader.finish(kind, commentPos, eocd.commentLength(), signatureFiles.detected());
}
/**
@@ -689,6 +677,54 @@ public final class ZipContent implements Closeable {
}
/**
* Detection logic for signature files.
*/
private static class SignatureFiles {
private static final String META_INF = "META-INF/";
private static final List<byte[]> SUFFIXES = Stream.of(".DSA", ".RSA", ".EC")
.map((string) -> string.getBytes(StandardCharsets.UTF_8))
.toList();
private final ByteBuffer buffer;
private boolean detected;
SignatureFiles() {
this.buffer = ByteBuffer.allocate(4);
}
void detect(ZipCentralDirectoryFileHeaderRecord centralRecord, FileDataBlock data, long pos,
ByteBuffer loadeBuffer) throws IOException {
if (!this.detected) {
long filenamePos = pos + ZipCentralDirectoryFileHeaderRecord.FILE_NAME_OFFSET;
if (centralRecord.fileNameLength() > this.buffer.capacity() && ZipString.startsWith(loadeBuffer, data,
filenamePos, centralRecord.fileNameLength(), META_INF) >= 0) {
this.buffer.clear();
data.readFully(this.buffer, filenamePos + centralRecord.fileNameLength() - this.buffer.capacity());
this.detected = bufferEndsWithSignatureSuffix();
}
}
}
private boolean bufferEndsWithSignatureSuffix() {
byte[] bytes = this.buffer.array();
for (byte[] suffix : SUFFIXES) {
if (Arrays.equals(bytes, bytes.length - suffix.length, bytes.length, suffix, 0, suffix.length)) {
return true;
}
}
return false;
}
boolean detected() {
return this.detected;
}
}
/**
* A single zip content entry.
*/
loader/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/SecurityInfoTests.java
+1 -1
View File
@@ -57,7 +57,7 @@ class SecurityInfoTests {
@Test
void getWhenHasSignatureFileButNoSecurityMaterialReturnsNone() throws Exception {
File file = new File(this.temp, "test.jar");
TestJar.create(file, false, true);
TestJar.create(file, false, "DSA");
try (ZipContent content = ZipContent.open(file.toPath())) {
assertThat(content.hasJarSignatureFile()).isTrue();
SecurityInfo info = SecurityInfo.get(content);
loader/spring-boot-loader/src/test/java/org/springframework/boot/loader/testsupport/TestJar.java
+7 -4
View File
@@ -28,6 +28,8 @@ import java.util.jar.Manifest;
import java.util.zip.CRC32;
import java.util.zip.ZipEntry;
import org.jspecify.annotations.Nullable;
/**
* Support class to create or get test jars.
*
@@ -44,16 +46,17 @@ public abstract class TestJar {
}
public static void create(File file, boolean unpackNested) throws Exception {
create(file, unpackNested, false);
create(file, unpackNested, null);
}
public static void create(File file, boolean unpackNested, boolean addSignatureFile) throws Exception {
public static void create(File file, boolean unpackNested, @Nullable String additionalSignedFileExtension)
throws Exception {
FileOutputStream fileOutputStream = new FileOutputStream(file);
try (JarOutputStream jarOutputStream = new JarOutputStream(fileOutputStream)) {
jarOutputStream.setComment("outer");
writeManifest(jarOutputStream, "j1");
if (addSignatureFile) {
writeEntry(jarOutputStream, "META-INF/some.DSA", 0);
if (additionalSignedFileExtension != null) {
writeEntry(jarOutputStream, "META-INF/some." + additionalSignedFileExtension, 0);
}
writeEntry(jarOutputStream, "1.dat", 1);
writeEntry(jarOutputStream, "2.dat", 2);
loader/spring-boot-loader/src/test/java/org/springframework/boot/loader/zip/ZipContentTests.java
+36
View File
@@ -381,6 +381,42 @@ class ZipContentTests {
}
}
@Test
void detectUnsigned() throws Exception {
File file = new File(this.tempDir, "testunsigned.jar");
TestJar.create(file);
try (ZipContent zip = ZipContent.open(this.file.toPath())) {
assertThat(zip.hasJarSignatureFile()).isFalse();
}
}
@Test
void detectSignedWithDsaFile() throws Exception {
File file = new File(this.tempDir, "testsigned.jar");
TestJar.create(file, false, "DSA");
try (ZipContent zip = ZipContent.open(file.toPath())) {
assertThat(zip.hasJarSignatureFile()).isTrue();
}
}
@Test
void detectSignedWithRsaFile() throws Exception {
File file = new File(this.tempDir, "testsigned.jar");
TestJar.create(file, false, "RSA");
try (ZipContent zip = ZipContent.open(file.toPath())) {
assertThat(zip.hasJarSignatureFile()).isTrue();
}
}
@Test
void detectSignedWithEcFile() throws Exception {
File file = new File(this.tempDir, "testsigned.jar");
TestJar.create(file, false, "EC");
try (ZipContent zip = ZipContent.open(file.toPath())) {
assertThat(zip.hasJarSignatureFile()).isTrue();
}
}
private File createZipFileWithEpochTimeOfZero() throws Exception {
File file = new File(this.tempDir, "temp.zip");
String comment = "outer";