From 5243adce22061126ac87aa76b9f4c19a82875af0 Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Wed, 30 May 2018 18:12:20 -0700 Subject: [PATCH 1/3] Restore Java 1.6 compatibility --- .../boot/autoconfigure/web/ServerProperties.java | 2 +- .../org/springframework/boot/web/support/ErrorPageFilter.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java index fe8dac9a37..a87f0ade86 100644 --- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java +++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java @@ -864,7 +864,7 @@ public class ServerProperties .getIncludeStacktrace() == ErrorProperties.IncludeStacktrace.NEVER) { customizeErrorReportValve(factory); } - Cookie cookie = serverProperties.getSession().getCookie(); + final Cookie cookie = serverProperties.getSession().getCookie(); if (cookie.getHttpOnly() != null) { factory.addContextCustomizers(new TomcatContextCustomizer() { diff --git a/spring-boot/src/main/java/org/springframework/boot/web/support/ErrorPageFilter.java b/spring-boot/src/main/java/org/springframework/boot/web/support/ErrorPageFilter.java index 41826d1bdb..999969310f 100644 --- a/spring-boot/src/main/java/org/springframework/boot/web/support/ErrorPageFilter.java +++ b/spring-boot/src/main/java/org/springframework/boot/web/support/ErrorPageFilter.java @@ -84,7 +84,7 @@ public class ErrorPageFilter implements Filter, ErrorPageRegistry { private static final Set> CLIENT_ABORT_EXCEPTIONS; static { - Set> clientAbortExceptions = new HashSet<>(); + Set> clientAbortExceptions = new HashSet>(); addClassIfPresent(clientAbortExceptions, "org.apache.catalina.connector.ClientAbortException"); CLIENT_ABORT_EXCEPTIONS = Collections.unmodifiableSet(clientAbortExceptions); From 55d0611bc3fce7352d934f4c9f4494e6a39edfb6 Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Wed, 30 May 2018 19:59:56 -0700 Subject: [PATCH 2/3] Guard against JarURLConnection with wrong JAR Update `JarURLConnection.get()` to guard against the wrong nested JAR being used as context. Closes gh-11367 --- .../boot/loader/jar/JarURLConnection.java | 10 +++++++--- .../boot/loader/jar/JarURLConnectionTests.java | 10 ++++++++++ 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/jar/JarURLConnection.java b/spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/jar/JarURLConnection.java index 59ee3f8f1e..4a81ed10bc 100644 --- a/spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/jar/JarURLConnection.java +++ b/spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/jar/JarURLConnection.java @@ -255,6 +255,10 @@ final class JarURLConnection extends java.net.JarURLConnection { static JarURLConnection get(URL url, JarFile jarFile) throws IOException { String spec = extractFullSpec(url, jarFile.getPathFromRoot()); + if (spec == null) { + return (Boolean.TRUE.equals(useFastExceptions.get()) ? NOT_FOUND_CONNECTION + : new JarURLConnection(url, null, EMPTY_JAR_ENTRY_NAME)); + } int separator; int index = 0; while ((separator = spec.indexOf(SEPARATOR, index)) > 0) { @@ -264,7 +268,7 @@ final class JarURLConnection extends java.net.JarURLConnection { return JarURLConnection.notFound(jarFile, entryName); } jarFile = jarFile.getNestedJarFile(jarEntry); - index += separator + SEPARATOR.length(); + index = separator + SEPARATOR.length(); } JarEntryName jarEntryName = JarEntryName.get(spec, index); if (Boolean.TRUE.equals(useFastExceptions.get())) { @@ -279,8 +283,8 @@ final class JarURLConnection extends java.net.JarURLConnection { private static String extractFullSpec(URL url, String pathFromRoot) { String file = url.getFile(); int separatorIndex = file.indexOf(SEPARATOR); - if (separatorIndex < 0) { - return ""; + if (separatorIndex < 0 || !file.startsWith(pathFromRoot, separatorIndex)) { + return null; } int specIndex = separatorIndex + SEPARATOR.length() + pathFromRoot.length(); return file.substring(specIndex); diff --git a/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/JarURLConnectionTests.java b/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/JarURLConnectionTests.java index 28d8dae188..d35faac08e 100644 --- a/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/JarURLConnectionTests.java +++ b/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/JarURLConnectionTests.java @@ -18,6 +18,7 @@ package org.springframework.boot.loader.jar; import java.io.ByteArrayInputStream; import java.io.File; +import java.io.FileNotFoundException; import java.net.URL; import org.junit.Before; @@ -152,6 +153,15 @@ public class JarURLConnectionTests { .hasSameContentAs(new ByteArrayInputStream(new byte[] { 3 })); } + @Test(expected = FileNotFoundException.class) + public void connectionToEntryUsingWrongAbsoluteUrlForEntryFromNestedJarFile() + throws Exception { + URL url = new URL("jar:file:" + getAbsolutePath() + "!/w.jar!/3.dat"); + JarFile nested = this.jarFile + .getNestedJarFile(this.jarFile.getEntry("nested.jar")); + JarURLConnection.get(url, nested).getInputStream(); + } + @Test public void getContentLengthReturnsLengthOfUnderlyingEntry() throws Exception { URL url = new URL(new URL("jar", null, -1, From bb0550ab95c817301cf1e435abfeaa6c246eb73b Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Wed, 30 May 2018 20:28:50 -0700 Subject: [PATCH 3/3] Polish --- .../springframework/boot/loader/jar/JarURLConnectionTests.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/JarURLConnectionTests.java b/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/JarURLConnectionTests.java index d35faac08e..3c9bf214bf 100644 --- a/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/JarURLConnectionTests.java +++ b/spring-boot-tools/spring-boot-loader/src/test/java/org/springframework/boot/loader/jar/JarURLConnectionTests.java @@ -153,12 +153,13 @@ public class JarURLConnectionTests { .hasSameContentAs(new ByteArrayInputStream(new byte[] { 3 })); } - @Test(expected = FileNotFoundException.class) + @Test public void connectionToEntryUsingWrongAbsoluteUrlForEntryFromNestedJarFile() throws Exception { URL url = new URL("jar:file:" + getAbsolutePath() + "!/w.jar!/3.dat"); JarFile nested = this.jarFile .getNestedJarFile(this.jarFile.getEntry("nested.jar")); + this.thrown.expect(FileNotFoundException.class); JarURLConnection.get(url, nested).getInputStream(); }