# HG changeset patch # User Jiri Vanek # Date 1491474017 -7200 # Node ID 84de0c383e40fe330d8470da52b27f0c470ef7f5 # Parent 97f1fee964ffd568281570e969b8babf267df091 Attempt to reproduce and fix pr3350. The reproducer did not hit the issue, so only DID NPE check was done * netx/net/sourceforge/jnlp/security/SecurityDialogs.java: (showMatchingALACAttributePanel) defensive NPE check for codebase * netx/net/sourceforge/jnlp/util/UrlUtils.java: (setOfUrlsToHtmlList) defensive NPE check * tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp: exact jnlp from pr3350 bug report * tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java: dummy main jar * tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF: exact manifest from pr3350 * tests/reproducers/signed/jcalendar/srcs/jcalendar.java: dummy dependence of Kemtrak * tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java: simple launch of jnlp diff -r 97f1fee964ff -r 84de0c383e40 ChangeLog --- a/ChangeLog Thu Apr 06 11:01:22 2017 +0200 +++ b/ChangeLog Thu Apr 06 12:20:17 2017 +0200 @@ -1,3 +1,15 @@ +2017-04-06 Jiri Vanek + + Attempt to reproduce and fix pr3350. The reproducer did not hit the issue, so only DID NPE check was done + * netx/net/sourceforge/jnlp/security/SecurityDialogs.java: (showMatchingALACAttributePanel) + defensive NPE check for codebase + * netx/net/sourceforge/jnlp/util/UrlUtils.java: (setOfUrlsToHtmlList) defensive NPE check + * tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp: exact jnlp from pr3350 bug report + * tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java: dummy main jar + * tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF: exact manifest from pr3350 + * tests/reproducers/signed/jcalendar/srcs/jcalendar.java: dummy dependence of Kemtrak + * tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java: simple launch of jnlp + 2016-02-03 Jiri Vanek Post-release changes diff -r 97f1fee964ff -r 84de0c383e40 netx/net/sourceforge/jnlp/security/SecurityDialogs.java --- a/netx/net/sourceforge/jnlp/security/SecurityDialogs.java Thu Apr 06 11:01:22 2017 +0200 +++ b/netx/net/sourceforge/jnlp/security/SecurityDialogs.java Thu Apr 06 12:20:17 2017 +0200 @@ -402,7 +402,11 @@ SecurityDialogMessage message = new SecurityDialogMessage(); message.dialogType = DialogType.MATCHING_ALACA; - message.extras = new Object[]{file, codeBase.toString(), UrlUtils.setOfUrlsToHtmlList(remoteUrls)}; + String codebaseString = "null-codebase"; + if (codeBase != null) { + codebaseString = codeBase.toString(); + } + message.extras = new Object[]{file, codebaseString, UrlUtils.setOfUrlsToHtmlList(remoteUrls)}; AppSigningWarningAction selectedValue = (AppSigningWarningAction) getUserResponse(message); if (selectedValue != null) { diff -r 97f1fee964ff -r 84de0c383e40 netx/net/sourceforge/jnlp/util/UrlUtils.java --- a/netx/net/sourceforge/jnlp/util/UrlUtils.java Thu Apr 06 11:01:22 2017 +0200 +++ b/netx/net/sourceforge/jnlp/util/UrlUtils.java Thu Apr 06 12:20:17 2017 +0200 @@ -194,6 +194,9 @@ * @return String containing html item list of those urls */ public static String setOfUrlsToHtmlList(Iterable remoteUrls) { + if (remoteUrls == null) { + return ""; + } StringBuilder sb = new StringBuilder(); sb.append("
    "); for (URL url : remoteUrls) { diff -r 97f1fee964ff -r 84de0c383e40 tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,50 @@ + + + + + Kemtrak 007 + Kemtrak AB + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff -r 97f1fee964ff -r 84de0c383e40 tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,83 @@ +/* +Copyright (C) 2017 Red Hat, Inc. + +This file is part of IcedTea. + +IcedTea is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License as published by +the Free Software Foundation, version 2. + +IcedTea is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License for more details. + +You should have received a copy of the GNU General Public License +along with IcedTea; see the file COPYING. If not, write to +the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA +02110-1301 USA. + +Linking this library statically or dynamically with other modules is +making a combined work based on this library. Thus, the terms and +conditions of the GNU General Public License cover the whole +combination. + +As a special exception, the copyright holders of this library give you +permission to link this library with independent modules to produce an +executable, regardless of the license terms of these independent +modules, and to copy and distribute the resulting executable under +terms of your choice, provided that you also meet, for each linked +independent module, the terms and conditions of the license of that +module. An independent module is a module which is not derived from +or based on this library. If you modify this library, you may extend +this exception to your version of the library, but you are not +obligated to do so. If you do not wish to do so, delete this +exception statement from your version. + */ + +import java.applet.Applet; +import java.lang.reflect.*; + +public class Kemtrak extends Applet { + + private class Killer extends Thread { + + public int n = 1000; + + @Override + public void run() { + try { + Thread.sleep(n); + System.out.println("Applet killing himself after " + n + " ms of life"); + System.exit(0); + } catch (Exception ex) { + } + } + } + private Killer killer; + + public static void main(String[] args) { + System.out.println("Kemtrak2"); + jcalendar(); + } + + @Override + public void init() { + System.out.println("Kemtrak1"); + Kemtrak.main(null); + killer = new Killer(); + killer.start(); + } + + public static void jcalendar() { + try { + Class signedAppletClass = Class.forName("jcalendar"); + Method m = signedAppletClass.getMethod("main", String[].class); + m.invoke(null, (Object)null); + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + +} diff -r 97f1fee964ff -r 84de0c383e40 tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,10 @@ +Manifest-Version: 1.0 +Created-By: 1.6.0 (Sun Microsystems Inc.) +Permissions: all-permissions +Trusted-Only: true +Application-Name: Kemtrak +Main-Class: Kemtrak +Class-path: jcalendar.jar +Codebase: * +Application-Library-Allowable-Codebase: * + diff -r 97f1fee964ff -r 84de0c383e40 tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,65 @@ +/* +Copyright (C) 20121 Red Hat, Inc. + +This file is part of IcedTea. + +IcedTea is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License as published by +the Free Software Foundation, version 2. + +IcedTea is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License for more details. + +You should have received a copy of the GNU General Public License +along with IcedTea; see the file COPYING. If not, write to +the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA +02110-1301 USA. + +Linking this library statically or dynamically with other modules is +making a combined work based on this library. Thus, the terms and +conditions of the GNU General Public License cover the whole +combination. + +As a special exception, the copyright holders of this library give you +permission to link this library with independent modules to produce an +executable, regardless of the license terms of these independent +modules, and to copy and distribute the resulting executable under +terms of your choice, provided that you also meet, for each linked +independent module, the terms and conditions of the license of that +module. An independent module is a module which is not derived from +or based on this library. If you modify this library, you may extend +this exception to your version of the library, but you are not +obligated to do so. If you do not wish to do so, delete this +exception statement from your version. + */ + +import net.sourceforge.jnlp.browsertesting.BrowserTest; + +import net.sourceforge.jnlp.ProcessResult; +import net.sourceforge.jnlp.ServerAccess; +import net.sourceforge.jnlp.annotations.Bug; + +import org.junit.Assert; + +import org.junit.Test; + +@Bug(id = {"PR3350"}) +/** + * The issue is visible only in manifest attributes on, so this is manual reproducer, automated in head + */ +public class KemtrakTests extends BrowserTest { + + private static final ServerAccess SERVER = new ServerAccess(); + + @Bug(id = "PR3350") + @Test + public void KemtrakTest1() throws Exception { + ProcessResult pr = SERVER.executeJavawsHeadless("/Kemtrak.jnlp"); + Assert.assertTrue("Stdout should contain Kemtrak1 but did not", pr.stdout.contains("Kemtrak1")); + Assert.assertTrue("Stdout should contain Kemtrak2 but did not", pr.stdout.contains("Kemtrak2")); + Assert.assertTrue("Stdout should contain jcalendar2 but did not", pr.stdout.contains("jcalendar2")); + } + +} diff -r 97f1fee964ff -r 84de0c383e40 tests/reproducers/signed/jcalendar/srcs/jcalendar.java --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/jcalendar/srcs/jcalendar.java Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,80 @@ +/* +Copyright (C) 2017 Red Hat, Inc. + +This file is part of IcedTea. + +IcedTea is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License as published by +the Free Software Foundation, version 2. + +IcedTea is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License for more details. + +You should have received a copy of the GNU General Public License +along with IcedTea; see the file COPYING. If not, write to +the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA +02110-1301 USA. + +Linking this library statically or dynamically with other modules is +making a combined work based on this library. Thus, the terms and +conditions of the GNU General Public License cover the whole +combination. + +As a special exception, the copyright holders of this library give you +permission to link this library with independent modules to produce an +executable, regardless of the license terms of these independent +modules, and to copy and distribute the resulting executable under +terms of your choice, provided that you also meet, for each linked +independent module, the terms and conditions of the license of that +module. An independent module is a module which is not derived from +or based on this library. If you modify this library, you may extend +this exception to your version of the library, but you are not +obligated to do so. If you do not wish to do so, delete this +exception statement from your version. + */ + +import java.applet.Applet; +import java.lang.reflect.*; + +/** + * This is used by Kemtrak reproducer. + * Originally the jar was signed2, but I always forget: + * netx: Initialization Error: Could not initialize applet. (Fatal: Application Error: The JNLP application is not fully signed by a single cert. The JNLP application has its components individually signed, however there must be a common signer to all entries.) + * netx: Initialization Error: Could not initialize applet. (Fatal: Application Error: The JNLP application is not fully signed by a single cert. The JNLP application has its components individually signed, however there must be a common signer to all entries.) + * + * @author jvanek + */ +public class jcalendar extends Applet { + + private class Killer extends Thread { + + public int n = 1000; + + @Override + public void run() { + try { + Thread.sleep(n); + System.out.println("Applet killing himself after " + n + " ms of life"); + System.exit(0); + } catch (Exception ex) { + } + } + } + private Killer killer; + + public static void main(String[] args) { + System.out.println("jcalendar2"); + } + + @Override + public void init() { + System.out.println("jcalendar1"); + killer = new Killer(); + killer.start(); + } + + + +}