Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix issue #368 remove JAR signature related files to prevent JAR signature verification #369

Merged
merged 1 commit into from
Aug 22, 2022
Merged

Fix issue #368 remove JAR signature related files to prevent JAR signature verification #369

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions booster-transform-util/src/main/kotlin/com/didiglobal/booster/transform/util/transform.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,9 @@ fun ZipFile.transform(
runnable.run()
}))

entries().asSequence().forEach { entry ->
entries().asSequence().filterNot {
isJarSignatureRelatedFiles(it.name)
}.forEach { entry ->
if (!entries.contains(entry.name)) {
val zae = entryFactory(entry)
val stream = InputStreamSupplier {
Expand Down Expand Up @@ -108,7 +110,9 @@ fun ZipInputStream.transform(
val entries = mutableSetOf<String>()

while (true) {
val entry = nextEntry?.takeIf { true } ?: break
val entry = nextEntry?.takeUnless {
isJarSignatureRelatedFiles(it.name)
} ?: break
if (!entries.contains(entry.name)) {
val zae = entryFactory(entry)
val data = readBytes()
Expand All @@ -131,6 +135,12 @@ fun ZipInputStream.transform(
transform(it, entryFactory, transformer)
}

private val JAR_SIGNATURE_EXTENSIONS = setOf("SF", "RSA", "DSA", "EC")

private fun isJarSignatureRelatedFiles(name: String): Boolean {
return name.startsWith("META-INF/") && name.substringAfterLast('.') in JAR_SIGNATURE_EXTENSIONS
}

private const val DEFAULT_BUFFER_SIZE = 8 * 1024

private fun InputStream.readBytes(estimatedSize: Int = DEFAULT_BUFFER_SIZE): ByteArray {
Expand Down