|
 |
9e6051 |
From 10955c0d72fc11324cebcb2bd8fe4bf56f0f8887 Mon Sep 17 00:00:00 2001
|
|
|
9e6051 |
From: Mikolaj Izdebski <mizdebsk@redhat.com>
|
|
|
9e6051 |
Date: Fri, 27 Sep 2013 12:49:53 +0200
|
|
|
9e6051 |
Subject: [PATCH] Do not use algorithm name as regular expression
|
|
|
9e6051 |
|
|
|
9e6051 |
In org.codehaus.plexus.digest.DigestUtils.cleanChecksum(String,
|
|
|
9e6051 |
String, String), the second parameter is used as part of the regular
|
|
|
9e6051 |
expression. Compiling the resulting regular expression can result in
|
|
|
9e6051 |
a VM error with a crafted algorithm name. The regular expression
|
|
|
9e6051 |
should be a constant, with a capture group for the algorithm name, and
|
|
|
9e6051 |
the name should be checked after matching.
|
|
|
9e6051 |
|
|
|
9e6051 |
Originally reported by Florian Weimer in:
|
|
|
9e6051 |
https://bugzilla.redhat.com/show_bug.cgi?id=959454
|
|
|
9e6051 |
---
|
|
|
9e6051 |
src/main/java/org/codehaus/plexus/digest/DigestUtils.java | 9 +++++----
|
|
|
9e6051 |
1 file changed, 5 insertions(+), 4 deletions(-)
|
|
|
9e6051 |
|
|
|
9e6051 |
diff --git a/src/main/java/org/codehaus/plexus/digest/DigestUtils.java b/src/main/java/org/codehaus/plexus/digest/DigestUtils.java
|
|
|
9e6051 |
index a54a8c0..430c3a8 100644
|
|
|
9e6051 |
--- a/src/main/java/org/codehaus/plexus/digest/DigestUtils.java
|
|
|
9e6051 |
+++ b/src/main/java/org/codehaus/plexus/digest/DigestUtils.java
|
|
|
9e6051 |
@@ -51,16 +51,17 @@ public class DigestUtils
|
|
|
9e6051 |
String trimmedChecksum = checksum.replace( '\n', ' ' ).trim();
|
|
|
9e6051 |
|
|
|
9e6051 |
// Free-BSD / openssl
|
|
|
9e6051 |
- String regex = algorithm.replaceAll( "-", "" ) + "\\s*\\((.*?)\\)\\s*=\\s*([a-fA-F0-9]+)";
|
|
|
9e6051 |
+ algorithm = algorithm.replaceAll( "-", "" );
|
|
|
9e6051 |
+ String regex = "(.{" + algorithm.length() + "})\\s*\\((.*?)\\)\\s*=\\s*([a-fA-F0-9]+)";
|
|
|
9e6051 |
Matcher m = Pattern.compile( regex ).matcher( trimmedChecksum );
|
|
|
9e6051 |
- if ( m.matches() )
|
|
|
9e6051 |
+ if ( m.matches() && m.group( 1 ).equals( algorithm ) )
|
|
|
9e6051 |
{
|
|
|
9e6051 |
- String filename = m.group( 1 );
|
|
|
9e6051 |
+ String filename = m.group( 2 );
|
|
|
9e6051 |
if ( !isValidChecksumPattern( filename, path ) )
|
|
|
9e6051 |
{
|
|
|
9e6051 |
throw new DigesterException( "Supplied checksum does not match checksum pattern" );
|
|
|
9e6051 |
}
|
|
|
9e6051 |
- trimmedChecksum = m.group( 2 );
|
|
|
9e6051 |
+ trimmedChecksum = m.group( 3 );
|
|
|
9e6051 |
}
|
|
|
9e6051 |
else
|
|
|
9e6051 |
{
|
|
|
9e6051 |
--
|
|
|
9e6051 |
1.8.3.1
|
|
|
9e6051 |
|