|
 |
055e32 |
diff --git a/ChangeLog b/ChangeLog
|
|
|
055e32 |
index 0c63dd98..d8e560e0 100644
|
|
|
055e32 |
--- a/ChangeLog
|
|
|
055e32 |
+++ b/ChangeLog
|
|
|
055e32 |
@@ -1,3 +1,29 @@
|
|
|
055e32 |
+2019-06-26 Jiri Vanek <jvanek@redhat.com>
|
|
|
055e32 |
+
|
|
|
055e32 |
+ All files, except signaturre files, are now checked for signatures - CVE-2019-10181
|
|
|
055e32 |
+ * b/netx/net/sourceforge/jnlp/tools/JarCertVerifier.java: (isMetaInfFile) fixed bug, when anything in META-INF was not
|
|
|
055e32 |
+ checked for signature. Now only signature files are skipped
|
|
|
055e32 |
+ * tests/netx/unit/net/sourceforge/jnlp/tools/JarCertVerifierTest.java: added tests for check if file should be skipped from
|
|
|
055e32 |
+ signature check
|
|
|
055e32 |
+
|
|
|
055e32 |
+2019-06-26 Jiri Vanek <jvanek@redhat.com>
|
|
|
055e32 |
+
|
|
|
055e32 |
+ Nested jar, if by relative path point up, is stored as hashed - CVE-2019-10185
|
|
|
055e32 |
+ * tests/netx/unit/net/sourceforge/jnlp/runtime/jar03_dotdotN1.jar: crafted jar with hacked zip entries to be named like ".."
|
|
|
055e32 |
+ * tests/netx/unit/net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp: jnlp to call jar03_dotdotN1.jar
|
|
|
055e32 |
+ * netx/net/sourceforge/jnlp/cache/CacheUtil.jsava: (hex) made public to be reused in JNLPClassLoader
|
|
|
055e32 |
+ * netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java: if nested jar contains .. in path, is extracted as hashed
|
|
|
055e32 |
+
|
|
|
055e32 |
+2019-06-26 Jiri Vanek <jvanek@redhat.com>
|
|
|
055e32 |
+
|
|
|
055e32 |
+ Fixed bug when relative path (..) could leak up (even out of cache) - CVE-2019-10182
|
|
|
055e32 |
+ * netx/net/sourceforge/jnlp/cache/CacheUtil.java: if path or query contains .. is saved to cache via its hash
|
|
|
055e32 |
+ * netx/net/sourceforge/jnlp/util/FileUtils.java: added warning about different behavior on win/linux
|
|
|
055e32 |
+ * tests/netx/unit/net/sourceforge/jnlp/cache/CacheUtilTest.java: added tests for hashing
|
|
|
055e32 |
+ * tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java: added test for .. in path. Added test
|
|
|
055e32 |
+ that verifies encoded .. (%2E%2E) do not leak from cahce
|
|
|
055e32 |
+ * tests/netx/unit/net/sourceforge/jnlp/runtime/up.jnlp: example jnlp with .. full url
|
|
|
055e32 |
+
|
|
|
055e32 |
2018-05-14 Jiri Vanek <jvanek@redhat.com>
|
|
|
055e32 |
|
|
|
055e32 |
* netx/net/sourceforge/jnlp/runtime/AppletEnvironment.java: getDocumentBase now returns codeBase as fallback when
|
|
|
055e32 |
diff --git a/tests/netx/unit/net/sourceforge/jnlp/cache/CacheUtilTest.java b/tests/netx/unit/net/sourceforge/jnlp/cache/CacheUtilTest.java
|
|
|
055e32 |
index 6b0cd256..5dbf2d69 100644
|
|
|
055e32 |
--- a/tests/netx/unit/net/sourceforge/jnlp/cache/CacheUtilTest.java
|
|
|
055e32 |
+++ b/tests/netx/unit/net/sourceforge/jnlp/cache/CacheUtilTest.java
|
|
|
055e32 |
@@ -135,6 +135,14 @@ public class CacheUtilTest {
|
|
|
055e32 |
File r = CacheUtil.urlToPath(u, "/tmp/");
|
|
|
055e32 |
Assert.assertEquals(expected, r);
|
|
|
055e32 |
}
|
|
|
055e32 |
+
|
|
|
055e32 |
+ @Test
|
|
|
055e32 |
+ public void testQueryGotHAshedToo() throws Exception {
|
|
|
055e32 |
+ final URL u = new URL("https://example2.com/something/my.jar?../../harm");
|
|
|
055e32 |
+ final File expected = new File("/tmp/https/example2.com/2844b3c690ea355159ed61de6e727f2e9169ab55bf58b8fa3f4b64f6a25bd7.jar");
|
|
|
055e32 |
+ File r = CacheUtil.urlToPath(u, "/tmp/");
|
|
|
055e32 |
+ Assert.assertEquals(expected, r);
|
|
|
055e32 |
+ }
|
|
|
055e32 |
|
|
|
055e32 |
|
|
|
055e32 |
@Test
|
|
|
055e32 |
diff --git a/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java b/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
|
|
|
055e32 |
index 2b28fb93..d86786ab 100644
|
|
|
055e32 |
--- a/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
|
|
|
055e32 |
+++ b/tests/netx/unit/net/sourceforge/jnlp/runtime/JNLPClassLoaderTest.java
|
|
|
055e32 |
@@ -405,6 +405,8 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
|
|
|
055e32 |
JNLPRuntime.setTrustAll(true);
|
|
|
055e32 |
JNLPRuntime.setSecurityEnabled(false);
|
|
|
055e32 |
JNLPRuntime.setDebug(true);
|
|
|
055e32 |
+ String manifestAttsBackup = JNLPRuntime.getConfiguration().getProperty(DeploymentConfiguration.KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK);
|
|
|
055e32 |
+ JNLPRuntime.getConfiguration().setProperty(DeploymentConfiguration.KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK, "NONE");
|
|
|
055e32 |
try {
|
|
|
055e32 |
final JNLPFile jnlpFile1 = new JNLPFile(new URL("http://localhost:" + port + "/up.jnlp"));
|
|
|
055e32 |
final JNLPClassLoader classLoader1 = JNLPClassLoader.getInstance(jnlpFile1, UpdatePolicy.ALWAYS, false);
|
|
|
055e32 |
@@ -419,6 +421,7 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
|
|
|
055e32 |
JNLPRuntime.setTrustAll(trustBackup);
|
|
|
055e32 |
JNLPRuntime.setSecurityEnabled(securityBAckup);
|
|
|
055e32 |
JNLPRuntime.setDebug(verbose);
|
|
|
055e32 |
+ JNLPRuntime.getConfiguration().setProperty(DeploymentConfiguration.KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK, manifestAttsBackup);
|
|
|
055e32 |
as.stop();
|
|
|
055e32 |
}
|
|
|
055e32 |
|
|
|
055e32 |
@@ -451,6 +454,11 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
|
|
|
055e32 |
JNLPRuntime.setTrustAll(true);
|
|
|
055e32 |
JNLPRuntime.setSecurityEnabled(false);
|
|
|
055e32 |
JNLPRuntime.setDebug(true);
|
|
|
055e32 |
+ //fix of "All files, except signaturre files, are now checked for signatures" make this actually correctly failing ahead of time
|
|
|
055e32 |
+ String ignoreBackup = JNLPRuntime.getConfiguration().getProperty(DeploymentConfiguration.KEY_SECURITY_ITW_IGNORECERTISSUES);
|
|
|
055e32 |
+ JNLPRuntime.getConfiguration().setProperty(DeploymentConfiguration.KEY_SECURITY_ITW_IGNORECERTISSUES, "true");
|
|
|
055e32 |
+ String manifestAttsBackup = JNLPRuntime.getConfiguration().getProperty(DeploymentConfiguration.KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK);
|
|
|
055e32 |
+ JNLPRuntime.getConfiguration().setProperty(DeploymentConfiguration.KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK, "NONE");
|
|
|
055e32 |
try {
|
|
|
055e32 |
//it is invalid jar, so we have to disable checks first
|
|
|
055e32 |
final JNLPFile jnlpFile = new JNLPFile(new URL("http://localhost:" + port + "/jar_03_dotdot_jarN1.jnlp"));
|
|
|
055e32 |
@@ -488,10 +496,102 @@ public class JNLPClassLoaderTest extends NoStdOutErrTest {
|
|
|
055e32 |
JNLPRuntime.setTrustAll(trustBackup);
|
|
|
055e32 |
JNLPRuntime.setSecurityEnabled(securityBAckup);
|
|
|
055e32 |
JNLPRuntime.setDebug(verbose);
|
|
|
055e32 |
+ JNLPRuntime.getConfiguration().setProperty(DeploymentConfiguration.KEY_SECURITY_ITW_IGNORECERTISSUES, ignoreBackup);
|
|
|
055e32 |
+ JNLPRuntime.getConfiguration().setProperty(DeploymentConfiguration.KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK, manifestAttsBackup);
|
|
|
055e32 |
as.stop();
|
|
|
055e32 |
}
|
|
|
055e32 |
|
|
|
055e32 |
}
|
|
|
055e32 |
|
|
|
055e32 |
+ @Test(expected = Exception.class)
|
|
|
055e32 |
+ public void testDifferentSignatureInManifestMf() throws Exception {
|
|
|
055e32 |
+ CacheUtil.clearCache();
|
|
|
055e32 |
+ int port = ServerAccess.findFreePort();
|
|
|
055e32 |
+ File dir = FileTestUtils.createTempDirectory();
|
|
|
055e32 |
+ dir.deleteOnExit();
|
|
|
055e32 |
+ File jar = new File(dir,"jar03_dotdotN1.jar");
|
|
|
055e32 |
+ File jnlp = new File(dir,"jar_03_dotdot_jarN1.jnlp");
|
|
|
055e32 |
+ InputStream is1 = this.getClass().getClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/jar_03_dotdot_jarN1.jnlp");
|
|
|
055e32 |
+ InputStream is2 = this.getClass().getClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/jar03_dotdotN1.jar");
|
|
|
055e32 |
+ OutputStream fos1 = new FileOutputStream(jnlp);
|
|
|
055e32 |
+ OutputStream fos2 = new FileOutputStream(jar);
|
|
|
055e32 |
+ StreamUtils.copyStream(is1, fos1);
|
|
|
055e32 |
+ StreamUtils.copyStream(is2, fos2);
|
|
|
055e32 |
+ fos1.flush();;
|
|
|
055e32 |
+ fos2.flush();
|
|
|
055e32 |
+ fos1.close();
|
|
|
055e32 |
+ fos2.close();
|
|
|
055e32 |
+ ServerLauncher as = ServerAccess.getIndependentInstance(dir.getAbsolutePath(), port);
|
|
|
055e32 |
+ boolean verifyBackup = JNLPRuntime.isVerifying();
|
|
|
055e32 |
+ boolean trustBackup= JNLPRuntime.isTrustAll();
|
|
|
055e32 |
+ boolean securityBAckup= JNLPRuntime.isSecurityEnabled();
|
|
|
055e32 |
+ boolean verbose= JNLPRuntime.isDebug();
|
|
|
055e32 |
+ JNLPRuntime.setVerify(false);
|
|
|
055e32 |
+ JNLPRuntime.setTrustAll(true);
|
|
|
055e32 |
+ JNLPRuntime.setSecurityEnabled(false);
|
|
|
055e32 |
+ JNLPRuntime.setDebug(true);
|
|
|
055e32 |
+ String ignoreBackup = JNLPRuntime.getConfiguration().getProperty(DeploymentConfiguration.KEY_SECURITY_ITW_IGNORECERTISSUES);
|
|
|
055e32 |
+ JNLPRuntime.getConfiguration().setProperty(DeploymentConfiguration.KEY_SECURITY_ITW_IGNORECERTISSUES, "false");
|
|
|
055e32 |
+ try {
|
|
|
055e32 |
+ //it is invalid jar, so we have to disable checks first
|
|
|
055e32 |
+ final JNLPFile jnlpFile = new JNLPFile(new URL("http://localhost:" + port + "/jar_03_dotdot_jarN1.jnlp"));
|
|
|
055e32 |
+ final JNLPClassLoader classLoader = JNLPClassLoader.getInstance(jnlpFile, UpdatePolicy.ALWAYS, false);
|
|
|
055e32 |
+ } finally {
|
|
|
055e32 |
+ JNLPRuntime.setVerify(verifyBackup);
|
|
|
055e32 |
+ JNLPRuntime.setTrustAll(trustBackup);
|
|
|
055e32 |
+ JNLPRuntime.setSecurityEnabled(securityBAckup);
|
|
|
055e32 |
+ JNLPRuntime.setDebug(verbose);
|
|
|
055e32 |
+ JNLPRuntime.getConfiguration().setProperty(DeploymentConfiguration.KEY_SECURITY_ITW_IGNORECERTISSUES, ignoreBackup);
|
|
|
055e32 |
+ as.stop();
|
|
|
055e32 |
+ }
|
|
|
055e32 |
+
|
|
|
055e32 |
+ }
|
|
|
055e32 |
+
|
|
|
055e32 |
+ @Test
|
|
|
055e32 |
+ public void testEncodedPathIsNotDecodedForCache() throws Exception {
|
|
|
055e32 |
+ CacheUtil.clearCache();
|
|
|
055e32 |
+ int port = ServerAccess.findFreePort();
|
|
|
055e32 |
+ File dir = FileTestUtils.createTempDirectory();
|
|
|
055e32 |
+ dir.deleteOnExit();
|
|
|
055e32 |
+ dir = new File(dir,"base");
|
|
|
055e32 |
+ dir.mkdir();
|
|
|
055e32 |
+ File jar = new File(dir,"j1.jar");
|
|
|
055e32 |
+ File jnlp = new File(dir+"/a/b/upEncoded.jnlp");
|
|
|
055e32 |
+ jnlp.getParentFile().mkdirs();
|
|
|
055e32 |
+ InputStream is = this.getClass().getClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/upEncoded.jnlp");
|
|
|
055e32 |
+ String jnlpString = StreamUtils.readStreamAsString(is, true, "utf-8");
|
|
|
055e32 |
+ is.close();
|
|
|
055e32 |
+ jnlpString = jnlpString.replaceAll("8080", ""+port);
|
|
|
055e32 |
+ is = this.getClass().getClassLoader().getResourceAsStream("net/sourceforge/jnlp/runtime/j1.jar");
|
|
|
055e32 |
+ StreamUtils.copyStream(is, new FileOutputStream(jar));
|
|
|
055e32 |
+ Files.write(jnlp.toPath(),jnlpString.getBytes("utf-8"));
|
|
|
055e32 |
+ ServerLauncher as = ServerAccess.getIndependentInstance(jnlp.getParent(), port);
|
|
|
055e32 |
+ boolean verifyBackup = JNLPRuntime.isVerifying();
|
|
|
055e32 |
+ boolean trustBackup= JNLPRuntime.isTrustAll();
|
|
|
055e32 |
+ boolean securityBAckup= JNLPRuntime.isSecurityEnabled();
|
|
|
055e32 |
+ boolean verbose= JNLPRuntime.isDebug();
|
|
|
055e32 |
+ JNLPRuntime.setVerify(false);
|
|
|
055e32 |
+ JNLPRuntime.setTrustAll(true);
|
|
|
055e32 |
+ JNLPRuntime.setSecurityEnabled(false);
|
|
|
055e32 |
+ JNLPRuntime.setDebug(true);
|
|
|
055e32 |
+ try {
|
|
|
055e32 |
+ final JNLPFile jnlpFile1 = new JNLPFile(new URL("http://localhost:" + port + "/upEncoded.jnlp"));
|
|
|
055e32 |
+ final JNLPClassLoader classLoader1 = JNLPClassLoader.getInstance(jnlpFile1, UpdatePolicy.ALWAYS, false);
|
|
|
055e32 |
+ InputStream is1 = classLoader1.getResourceAsStream("Hello1.class");
|
|
|
055e32 |
+ is1.close();
|
|
|
055e32 |
+ is1 = classLoader1.getResourceAsStream("META-INF/MANIFEST.MF");
|
|
|
055e32 |
+ is1.close();
|
|
|
055e32 |
+ Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/0/http/localhost/"+port+"/upEncoded.jnlp").exists());
|
|
|
055e32 |
+ //be aware; if decoding ever come in play here, thios will leak out of cache folder. Thus harm user system. See fix for " Fixed bug when relative path (..) could leak up (even out of cache)"
|
|
|
055e32 |
+ Assert.assertTrue(new File(PathsAndFiles.CACHE_DIR.getFullPath()+"/1/http/localhost/"+port+"/%2E%2E/%2E%2E/%2E%2E/base").exists());
|
|
|
055e32 |
+ } finally {
|
|
|
055e32 |
+ JNLPRuntime.setVerify(verifyBackup);
|
|
|
055e32 |
+ JNLPRuntime.setTrustAll(trustBackup);
|
|
|
055e32 |
+ JNLPRuntime.setSecurityEnabled(securityBAckup);
|
|
|
055e32 |
+ JNLPRuntime.setDebug(verbose);
|
|
|
055e32 |
+ as.stop();
|
|
|
055e32 |
+ }
|
|
|
055e32 |
+
|
|
|
055e32 |
+ }
|
|
|
055e32 |
|
|
|
055e32 |
}
|
|
|
055e32 |
diff --git a/tests/netx/unit/net/sourceforge/jnlp/runtime/upEncoded.jnlp b/tests/netx/unit/net/sourceforge/jnlp/runtime/upEncoded.jnlp
|
|
|
055e32 |
new file mode 100644
|
|
|
055e32 |
index 00000000..f0658bbc
|
|
|
055e32 |
--- /dev/null
|
|
|
055e32 |
+++ b/tests/netx/unit/net/sourceforge/jnlp/runtime/upEncoded.jnlp
|
|
|
055e32 |
@@ -0,0 +1,15 @@
|
|
|
055e32 |
+
|
|
|
055e32 |
+<jnlp spec="6.0+" codebase=".">
|
|
|
055e32 |
+
|
|
|
055e32 |
+ <information><title>1965</title><vendor>Nemzeti Ado- es Vamhivatal</vendor><offline-allowed/></information>
|
|
|
055e32 |
+
|
|
|
055e32 |
+
|
|
|
055e32 |
+ <resources>
|
|
|
055e32 |
+ <j2se href="http://java.sun.com/products/autodl/j2se" version="1.8+" />
|
|
|
055e32 |
+
|
|
|
055e32 |
+ <jar href="http://localhost:8080/%2E%2E/%2E%2E/%2E%2E/base/j1.jar" version="2.0"/>
|
|
|
055e32 |
+ </resources>
|
|
|
055e32 |
+
|
|
|
055e32 |
+ <application-desc main-class="Hello1" />
|
|
|
055e32 |
+
|
|
|
055e32 |
+</jnlp>
|