From 2696d370971964e20a78a24d0e05378d4beffe80 Mon Sep 17 00:00:00 2001
From: Phillip Webb <pwebb@pivotal.io>
Date: Wed, 5 Nov 2014 21:03:10 -0800
Subject: [PATCH] Protect against transitive additional meta-data

Update ConfigurationMetadataAnnotationProcessor to ensure that only
local `additional-spring-configuration-metadata.json` files are merged
with the final output.

See gh-1830
---
 .../ConfigurationMetadataAnnotationProcessor.java             | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/spring-boot-tools/spring-boot-configuration-processor/src/main/java/org/springframework/boot/configurationprocessor/ConfigurationMetadataAnnotationProcessor.java b/spring-boot-tools/spring-boot-configuration-processor/src/main/java/org/springframework/boot/configurationprocessor/ConfigurationMetadataAnnotationProcessor.java
index ab6581e285..5fe5c3e2e9 100644
--- a/spring-boot-tools/spring-boot-configuration-processor/src/main/java/org/springframework/boot/configurationprocessor/ConfigurationMetadataAnnotationProcessor.java
+++ b/spring-boot-tools/spring-boot-configuration-processor/src/main/java/org/springframework/boot/configurationprocessor/ConfigurationMetadataAnnotationProcessor.java
@@ -275,6 +275,10 @@ public class ConfigurationMetadataAnnotationProcessor extends AbstractProcessor
 			FileObject manualMetadata = this.processingEnv.getFiler().getResource(
 					StandardLocation.CLASS_PATH, "",
 					"META-INF/additional-spring-configuration-metadata.json");
+			if (!"file".equals(manualMetadata.toUri().getScheme())) {
+				// We only wan't local files, not any classpath jars
+				return metadata;
+			}
 			InputStream inputStream = manualMetadata.openInputStream();
 			try {
 				ConfigurationMetadata merged = new ConfigurationMetadata(metadata);