Mercurial > hg > release > icedtea-web-1.6
changeset 1300:84de0c383e40 default tip
Attempt to reproduce and fix pr3350. The reproducer did not hit the issue, so only DID NPE check was done
* netx/net/sourceforge/jnlp/security/SecurityDialogs.java: (showMatchingALACAttributePanel) defensive NPE check for codebase
* netx/net/sourceforge/jnlp/util/UrlUtils.java: (setOfUrlsToHtmlList) defensive NPE check
* tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp: exact jnlp from pr3350 bug report
* tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java: dummy main jar
* tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF: exact manifest from pr3350
* tests/reproducers/signed/jcalendar/srcs/jcalendar.java: dummy dependence of Kemtrak
* tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java: simple launch of jnlp
author | Jiri Vanek <jvanek@redhat.com> |
---|---|
date | Thu, 06 Apr 2017 12:20:17 +0200 |
parents | 97f1fee964ff |
children | |
files | ChangeLog netx/net/sourceforge/jnlp/security/SecurityDialogs.java netx/net/sourceforge/jnlp/util/UrlUtils.java tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java tests/reproducers/signed/jcalendar/srcs/jcalendar.java |
diffstat | 8 files changed, 308 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/ChangeLog Thu Apr 06 11:01:22 2017 +0200 +++ b/ChangeLog Thu Apr 06 12:20:17 2017 +0200 @@ -1,3 +1,15 @@ +2017-04-06 Jiri Vanek <jvanek@redhat.com> + + Attempt to reproduce and fix pr3350. The reproducer did not hit the issue, so only DID NPE check was done + * netx/net/sourceforge/jnlp/security/SecurityDialogs.java: (showMatchingALACAttributePanel) + defensive NPE check for codebase + * netx/net/sourceforge/jnlp/util/UrlUtils.java: (setOfUrlsToHtmlList) defensive NPE check + * tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp: exact jnlp from pr3350 bug report + * tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java: dummy main jar + * tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF: exact manifest from pr3350 + * tests/reproducers/signed/jcalendar/srcs/jcalendar.java: dummy dependence of Kemtrak + * tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java: simple launch of jnlp + 2016-02-03 Jiri Vanek <jvanek@redhat.com> Post-release changes
--- a/netx/net/sourceforge/jnlp/security/SecurityDialogs.java Thu Apr 06 11:01:22 2017 +0200 +++ b/netx/net/sourceforge/jnlp/security/SecurityDialogs.java Thu Apr 06 12:20:17 2017 +0200 @@ -402,7 +402,11 @@ SecurityDialogMessage message = new SecurityDialogMessage(); message.dialogType = DialogType.MATCHING_ALACA; - message.extras = new Object[]{file, codeBase.toString(), UrlUtils.setOfUrlsToHtmlList(remoteUrls)}; + String codebaseString = "null-codebase"; + if (codeBase != null) { + codebaseString = codeBase.toString(); + } + message.extras = new Object[]{file, codebaseString, UrlUtils.setOfUrlsToHtmlList(remoteUrls)}; AppSigningWarningAction selectedValue = (AppSigningWarningAction) getUserResponse(message); if (selectedValue != null) {
--- a/netx/net/sourceforge/jnlp/util/UrlUtils.java Thu Apr 06 11:01:22 2017 +0200 +++ b/netx/net/sourceforge/jnlp/util/UrlUtils.java Thu Apr 06 12:20:17 2017 +0200 @@ -194,6 +194,9 @@ * @return String containing html item list of those urls */ public static String setOfUrlsToHtmlList(Iterable<URL> remoteUrls) { + if (remoteUrls == null) { + return ""; + } StringBuilder sb = new StringBuilder(); sb.append("<ul>"); for (URL url : remoteUrls) {
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/Kemtrakpro/resources/Kemtrak.jnlp Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,50 @@ +<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> +<jnlp spec="7.0+" href="Kemtrak.jnlp" version="1.302.1.29"> +<!-- spec above has to be "7.0+" otherwise the caching-updating does not work --> + <information> + <title>Kemtrak 007</title> + <vendor>Kemtrak AB</vendor> + <shortcut install="false"> + <!-- needed here to prevent shortcut--> + </shortcut> + </information> + + <update check="always" policy="always" /> + + <security> + <all-permissions/> + </security> + <resources> + <property name="jnlp.versionEnabled" value="true"/> + <java version="1.7.0.45"/> + <java version="1.7.0.51"/> + <java version="1.7.0.55"/> + <java version="1.7.0.60"/> + <java version="1.7.0.65"/> + <java version="1.7.0.67"/> + <java version="1.7.0.71"/> + <java version="1.7.0.72"/> + <java version="1.7.0.75"/> + <java version="1.7.0.76"/> + <java version="1.7.0.79"/> + <java version="1.7.0.80"/> + <java version="1.7.0.85"/> + <java version="1.7.0.91"/> + <java version="1.7.0.95"/> + <java version="1.7.0.97"/> + <java version="1.7.0.99"/> + <java version="1.7.0.101"/> + <java version="1.7.0.111"/> + <java version="1.7.0.121"/> + <java version="1.7.0.131"/> + <java version="1.8+"/> + <jar href="Kemtrakpro.jar" version="1.302.1.29" main="true" /> + <jar href="jcalendar.jar" version="1.302.1.29"/> + </resources> + <applet-desc name="Kemtrak" main-class="Kemtrak" width="1005" height="538" archive="Kemtrakpro.jar, jcalendar.jar" code="Kemtrak.class" mayscript="mayscript"> + <param name="cache_version" value="1.302.1.29, 1.302.1.29" /> + <param name="cache_archive" value="Kemtrakpro.jar, jcalendar.jar" /> + <param name="classloader_cache" value="false" /> + </applet-desc> +<!-- can add txt here to change file size to force cache update - txt 790412 abcdefg --> +</jnlp>
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/Kemtrakpro/srcs/Kemtrak.java Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,83 @@ +/* +Copyright (C) 2017 Red Hat, Inc. + +This file is part of IcedTea. + +IcedTea is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License as published by +the Free Software Foundation, version 2. + +IcedTea is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License for more details. + +You should have received a copy of the GNU General Public License +along with IcedTea; see the file COPYING. If not, write to +the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA +02110-1301 USA. + +Linking this library statically or dynamically with other modules is +making a combined work based on this library. Thus, the terms and +conditions of the GNU General Public License cover the whole +combination. + +As a special exception, the copyright holders of this library give you +permission to link this library with independent modules to produce an +executable, regardless of the license terms of these independent +modules, and to copy and distribute the resulting executable under +terms of your choice, provided that you also meet, for each linked +independent module, the terms and conditions of the license of that +module. An independent module is a module which is not derived from +or based on this library. If you modify this library, you may extend +this exception to your version of the library, but you are not +obligated to do so. If you do not wish to do so, delete this +exception statement from your version. + */ + +import java.applet.Applet; +import java.lang.reflect.*; + +public class Kemtrak extends Applet { + + private class Killer extends Thread { + + public int n = 1000; + + @Override + public void run() { + try { + Thread.sleep(n); + System.out.println("Applet killing himself after " + n + " ms of life"); + System.exit(0); + } catch (Exception ex) { + } + } + } + private Killer killer; + + public static void main(String[] args) { + System.out.println("Kemtrak2"); + jcalendar(); + } + + @Override + public void init() { + System.out.println("Kemtrak1"); + Kemtrak.main(null); + killer = new Killer(); + killer.start(); + } + + public static void jcalendar() { + try { + Class<?> signedAppletClass = Class.forName("jcalendar"); + Method m = signedAppletClass.getMethod("main", String[].class); + m.invoke(null, (Object)null); + } catch (Exception e) { + throw new RuntimeException(e); + } + } + + +}
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/Kemtrakpro/srcs/META-INF/MANIFEST.MF Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,10 @@ +Manifest-Version: 1.0 +Created-By: 1.6.0 (Sun Microsystems Inc.) +Permissions: all-permissions +Trusted-Only: true +Application-Name: Kemtrak +Main-Class: Kemtrak +Class-path: jcalendar.jar +Codebase: * +Application-Library-Allowable-Codebase: * +
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/Kemtrakpro/testcases/KemtrakTests.java Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,65 @@ +/* +Copyright (C) 20121 Red Hat, Inc. + +This file is part of IcedTea. + +IcedTea is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License as published by +the Free Software Foundation, version 2. + +IcedTea is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License for more details. + +You should have received a copy of the GNU General Public License +along with IcedTea; see the file COPYING. If not, write to +the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA +02110-1301 USA. + +Linking this library statically or dynamically with other modules is +making a combined work based on this library. Thus, the terms and +conditions of the GNU General Public License cover the whole +combination. + +As a special exception, the copyright holders of this library give you +permission to link this library with independent modules to produce an +executable, regardless of the license terms of these independent +modules, and to copy and distribute the resulting executable under +terms of your choice, provided that you also meet, for each linked +independent module, the terms and conditions of the license of that +module. An independent module is a module which is not derived from +or based on this library. If you modify this library, you may extend +this exception to your version of the library, but you are not +obligated to do so. If you do not wish to do so, delete this +exception statement from your version. + */ + +import net.sourceforge.jnlp.browsertesting.BrowserTest; + +import net.sourceforge.jnlp.ProcessResult; +import net.sourceforge.jnlp.ServerAccess; +import net.sourceforge.jnlp.annotations.Bug; + +import org.junit.Assert; + +import org.junit.Test; + +@Bug(id = {"PR3350"}) +/** + * The issue is visible only in manifest attributes on, so this is manual reproducer, automated in head + */ +public class KemtrakTests extends BrowserTest { + + private static final ServerAccess SERVER = new ServerAccess(); + + @Bug(id = "PR3350") + @Test + public void KemtrakTest1() throws Exception { + ProcessResult pr = SERVER.executeJavawsHeadless("/Kemtrak.jnlp"); + Assert.assertTrue("Stdout should contain Kemtrak1 but did not", pr.stdout.contains("Kemtrak1")); + Assert.assertTrue("Stdout should contain Kemtrak2 but did not", pr.stdout.contains("Kemtrak2")); + Assert.assertTrue("Stdout should contain jcalendar2 but did not", pr.stdout.contains("jcalendar2")); + } + +}
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/tests/reproducers/signed/jcalendar/srcs/jcalendar.java Thu Apr 06 12:20:17 2017 +0200 @@ -0,0 +1,80 @@ +/* +Copyright (C) 2017 Red Hat, Inc. + +This file is part of IcedTea. + +IcedTea is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License as published by +the Free Software Foundation, version 2. + +IcedTea is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +General Public License for more details. + +You should have received a copy of the GNU General Public License +along with IcedTea; see the file COPYING. If not, write to +the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA +02110-1301 USA. + +Linking this library statically or dynamically with other modules is +making a combined work based on this library. Thus, the terms and +conditions of the GNU General Public License cover the whole +combination. + +As a special exception, the copyright holders of this library give you +permission to link this library with independent modules to produce an +executable, regardless of the license terms of these independent +modules, and to copy and distribute the resulting executable under +terms of your choice, provided that you also meet, for each linked +independent module, the terms and conditions of the license of that +module. An independent module is a module which is not derived from +or based on this library. If you modify this library, you may extend +this exception to your version of the library, but you are not +obligated to do so. If you do not wish to do so, delete this +exception statement from your version. + */ + +import java.applet.Applet; +import java.lang.reflect.*; + +/** + * This is used by Kemtrak reproducer. + * Originally the jar was signed2, but I always forget: + * netx: Initialization Error: Could not initialize applet. (Fatal: Application Error: The JNLP application is not fully signed by a single cert. The JNLP application has its components individually signed, however there must be a common signer to all entries.) + * netx: Initialization Error: Could not initialize applet. (Fatal: Application Error: The JNLP application is not fully signed by a single cert. The JNLP application has its components individually signed, however there must be a common signer to all entries.) + * + * @author jvanek + */ +public class jcalendar extends Applet { + + private class Killer extends Thread { + + public int n = 1000; + + @Override + public void run() { + try { + Thread.sleep(n); + System.out.println("Applet killing himself after " + n + " ms of life"); + System.exit(0); + } catch (Exception ex) { + } + } + } + private Killer killer; + + public static void main(String[] args) { + System.out.println("jcalendar2"); + } + + @Override + public void init() { + System.out.println("jcalendar1"); + killer = new Killer(); + killer.start(); + } + + + +}