Mercurial > hg > release > icedtea-web-1.6

changeset 1300:84de0c383e40 default tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Attempt to reproduce and fix pr3350. The reproducer did not hit the issue, so only DID NPE check was done * netx/net/sourceforge/jnlp/security/SecurityDialogs.java: (showMatchingALACAttributePanel) defensive NPE check for codebase * netx/net/sourceforge/jnlp/util/UrlUtils.java: (setOfUrlsToHtmlList) defensive NPE check * tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp: exact jnlp from pr3350 bug report * tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java: dummy main jar * tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF: exact manifest from pr3350 * tests/reproducers/signed/jcalendar/srcs/jcalendar.java: dummy dependence of Kemtrak * tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java: simple launch of jnlp
author Jiri Vanek <jvanek@redhat.com>
date Thu, 06 Apr 2017 12:20:17 +0200
parents 97f1fee964ff
children
files ChangeLog netx/net/sourceforge/jnlp/security/SecurityDialogs.java netx/net/sourceforge/jnlp/util/UrlUtils.java tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java tests/reproducers/signed/jcalendar/srcs/jcalendar.java
diffstat 8 files changed, 308 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/ChangeLog	Thu Apr 06 11:01:22 2017 +0200
+++ b/ChangeLog	Thu Apr 06 12:20:17 2017 +0200
@@ -1,3 +1,15 @@
+2017-04-06  Jiri Vanek <jvanek@redhat.com>
+
+	Attempt to reproduce and fix pr3350. The reproducer did not hit the issue, so only DID NPE check was done
+	* netx/net/sourceforge/jnlp/security/SecurityDialogs.java: (showMatchingALACAttributePanel)
+	defensive NPE check for codebase
+	* netx/net/sourceforge/jnlp/util/UrlUtils.java: (setOfUrlsToHtmlList) defensive NPE check
+	* tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp: exact jnlp from pr3350 bug report
+	* tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java: dummy main jar
+	* tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF: exact manifest from pr3350
+	* tests/reproducers/signed/jcalendar/srcs/jcalendar.java: dummy dependence of Kemtrak
+	* tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java: simple launch of jnlp
+
 2016-02-03  Jiri Vanek <jvanek@redhat.com>
 
 	Post-release changes
--- a/netx/net/sourceforge/jnlp/security/SecurityDialogs.java	Thu Apr 06 11:01:22 2017 +0200
+++ b/netx/net/sourceforge/jnlp/security/SecurityDialogs.java	Thu Apr 06 12:20:17 2017 +0200
@@ -402,7 +402,11 @@
 
          SecurityDialogMessage message = new SecurityDialogMessage();
          message.dialogType = DialogType.MATCHING_ALACA;
-         message.extras = new Object[]{file, codeBase.toString(), UrlUtils.setOfUrlsToHtmlList(remoteUrls)};
+         String codebaseString = "null-codebase";
+         if (codeBase != null) {
+             codebaseString = codeBase.toString();
+         }
+         message.extras = new Object[]{file, codebaseString, UrlUtils.setOfUrlsToHtmlList(remoteUrls)};
          AppSigningWarningAction selectedValue = (AppSigningWarningAction) getUserResponse(message);
 
          if (selectedValue != null) {
--- a/netx/net/sourceforge/jnlp/util/UrlUtils.java	Thu Apr 06 11:01:22 2017 +0200
+++ b/netx/net/sourceforge/jnlp/util/UrlUtils.java	Thu Apr 06 12:20:17 2017 +0200
@@ -194,6 +194,9 @@
      * @return String containing html item list of those urls
      */
     public static String setOfUrlsToHtmlList(Iterable<URL> remoteUrls) {
+        if (remoteUrls == null) {
+            return "";
+        }
         StringBuilder sb = new StringBuilder();
         sb.append("<ul>");
         for (URL url : remoteUrls) {
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp	Thu Apr 06 12:20:17 2017 +0200
@@ -0,0 +1,50 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
+<jnlp spec="7.0+" href="Kemtrak.jnlp" version="1.302.1.29">
+<!-- spec above has to be "7.0+" otherwise the caching-updating does not work -->
+    <information>
+        <title>Kemtrak 007</title>
+        <vendor>Kemtrak AB</vendor>
+		<shortcut install="false">
+			<!-- needed here to prevent shortcut-->
+		</shortcut>
+    </information>
+	
+	<update check="always" policy="always" />
+
+	<security>
+		<all-permissions/>
+	</security>
+	<resources>
+		<property name="jnlp.versionEnabled" value="true"/>
+		<java version="1.7.0.45"/>
+		<java version="1.7.0.51"/>
+		<java version="1.7.0.55"/>
+		<java version="1.7.0.60"/>
+		<java version="1.7.0.65"/>
+		<java version="1.7.0.67"/>
+		<java version="1.7.0.71"/>
+		<java version="1.7.0.72"/>
+		<java version="1.7.0.75"/>
+		<java version="1.7.0.76"/>
+		<java version="1.7.0.79"/>
+		<java version="1.7.0.80"/>
+		<java version="1.7.0.85"/>
+		<java version="1.7.0.91"/>
+		<java version="1.7.0.95"/>
+		<java version="1.7.0.97"/>
+		<java version="1.7.0.99"/>
+		<java version="1.7.0.101"/>
+		<java version="1.7.0.111"/>
+		<java version="1.7.0.121"/>
+		<java version="1.7.0.131"/>
+		<java version="1.8+"/>
+		<jar href="Kemtrakpro.jar" version="1.302.1.29" main="true" />
+		<jar href="jcalendar.jar" version="1.302.1.29"/>
+	</resources>
+	<applet-desc name="Kemtrak" main-class="Kemtrak" width="1005" height="538" archive="Kemtrakpro.jar, jcalendar.jar" code="Kemtrak.class" mayscript="mayscript">
+		<param name="cache_version" value="1.302.1.29, 1.302.1.29" />
+		<param name="cache_archive" value="Kemtrakpro.jar, jcalendar.jar" />
+		<param name="classloader_cache" value="false" />
+	</applet-desc>
+<!-- can add txt here to change file size to force cache update - txt 790412 abcdefg -->
+</jnlp>    
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java	Thu Apr 06 12:20:17 2017 +0200
@@ -0,0 +1,83 @@
+/* 
+Copyright (C) 2017 Red Hat, Inc.
+
+This file is part of IcedTea.
+
+IcedTea is free software; you can redistribute it and/or
+modify it under the terms of the GNU General Public License as published by
+the Free Software Foundation, version 2.
+
+IcedTea is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with IcedTea; see the file COPYING.  If not, write to
+the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version.
+ */
+
+import java.applet.Applet;
+import java.lang.reflect.*;
+
+public class Kemtrak extends Applet {
+
+    private class Killer extends Thread {
+
+        public int n = 1000;
+
+        @Override
+        public void run() {
+            try {
+                Thread.sleep(n);
+                System.out.println("Applet killing himself after " + n + " ms of life");
+                System.exit(0);
+            } catch (Exception ex) {
+            }
+        }
+    }
+    private Killer killer;
+
+    public static void main(String[] args) {
+        System.out.println("Kemtrak2");
+        jcalendar();
+    }
+
+    @Override
+    public void init() {
+        System.out.println("Kemtrak1");
+        Kemtrak.main(null);
+        killer = new Killer();
+        killer.start();
+    }
+
+ public static void jcalendar() {
+        try {
+            Class<?> signedAppletClass = Class.forName("jcalendar");
+            Method m = signedAppletClass.getMethod("main", String[].class);
+            m.invoke(null, (Object)null);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+
+}
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF	Thu Apr 06 12:20:17 2017 +0200
@@ -0,0 +1,10 @@
+Manifest-Version: 1.0
+Created-By: 1.6.0 (Sun Microsystems Inc.)
+Permissions: all-permissions
+Trusted-Only: true
+Application-Name: Kemtrak
+Main-Class: Kemtrak
+Class-path: jcalendar.jar
+Codebase: *
+Application-Library-Allowable-Codebase: *
+
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java	Thu Apr 06 12:20:17 2017 +0200
@@ -0,0 +1,65 @@
+/* 
+Copyright (C) 20121 Red Hat, Inc.
+
+This file is part of IcedTea.
+
+IcedTea is free software; you can redistribute it and/or
+modify it under the terms of the GNU General Public License as published by
+the Free Software Foundation, version 2.
+
+IcedTea is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with IcedTea; see the file COPYING.  If not, write to
+the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version.
+ */
+
+import net.sourceforge.jnlp.browsertesting.BrowserTest;
+
+import net.sourceforge.jnlp.ProcessResult;
+import net.sourceforge.jnlp.ServerAccess;
+import net.sourceforge.jnlp.annotations.Bug;
+
+import org.junit.Assert;
+
+import org.junit.Test;
+
+@Bug(id = {"PR3350"})
+/**
+ * The issue is visible only in manifest attributes on, so this is manual reproducer, automated in head
+ */
+public class KemtrakTests extends BrowserTest {
+
+    private static final ServerAccess SERVER = new ServerAccess();
+
+    @Bug(id = "PR3350")
+    @Test
+    public void KemtrakTest1() throws Exception {
+        ProcessResult pr = SERVER.executeJavawsHeadless("/Kemtrak.jnlp");
+        Assert.assertTrue("Stdout should contain Kemtrak1 but did not", pr.stdout.contains("Kemtrak1"));
+        Assert.assertTrue("Stdout should contain Kemtrak2 but did not", pr.stdout.contains("Kemtrak2"));
+        Assert.assertTrue("Stdout should contain jcalendar2 but did not", pr.stdout.contains("jcalendar2"));
+    }
+
+}
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/tests/reproducers/signed/jcalendar/srcs/jcalendar.java	Thu Apr 06 12:20:17 2017 +0200
@@ -0,0 +1,80 @@
+/* 
+Copyright (C) 2017 Red Hat, Inc.
+
+This file is part of IcedTea.
+
+IcedTea is free software; you can redistribute it and/or
+modify it under the terms of the GNU General Public License as published by
+the Free Software Foundation, version 2.
+
+IcedTea is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with IcedTea; see the file COPYING.  If not, write to
+the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version.
+ */
+
+import java.applet.Applet;
+import java.lang.reflect.*;
+
+/**
+ * This is used by Kemtrak reproducer.
+ * Originally the jar was signed2, but I always forget:
+ * netx: Initialization Error: Could not initialize applet. (Fatal: Application Error: The JNLP application is not fully signed by a single cert. The JNLP application has its components individually signed, however there must be a common signer to all entries.)
+ * netx: Initialization Error: Could not initialize applet. (Fatal: Application Error: The JNLP application is not fully signed by a single cert. The JNLP application has its components individually signed, however there must be a common signer to all entries.)
+ * 
+ * @author jvanek
+ */
+public class jcalendar extends Applet {
+
+    private class Killer extends Thread {
+
+        public int n = 1000;
+
+        @Override
+        public void run() {
+            try {
+                Thread.sleep(n);
+                System.out.println("Applet killing himself after " + n + " ms of life");
+                System.exit(0);
+            } catch (Exception ex) {
+            }
+        }
+    }
+    private Killer killer;
+
+    public static void main(String[] args) {
+        System.out.println("jcalendar2");
+    }
+
+    @Override
+    public void init() {
+        System.out.println("jcalendar1");
+        killer = new Killer();
+        killer.start();
+    }
+
+
+
+}