5252import net .sourceforge .jnlp .runtime .classloader .JNLPClassLoader .SigningState ;
5353import net .sourceforge .jnlp .runtime .classloader .SecurityDelegate ;
5454import net .sourceforge .jnlp .util .ClasspathMatcher .ClasspathMatchers ;
55+ import net .sourceforge .jnlp .util .UrlKey ;
5556import net .sourceforge .jnlp .util .UrlUtils ;
5657
5758import java .net .MalformedURLException ;
@@ -77,7 +78,7 @@ public class ManifestAttributesChecker {
7778 private final SecurityDelegate securityDelegate ;
7879
7980 public ManifestAttributesChecker (final SecurityDesc security , final JNLPFile file ,
80- final SigningState signing , final SecurityDelegate securityDelegate ) {
81+ final SigningState signing , final SecurityDelegate securityDelegate ) {
8182 this .security = security ;
8283 this .file = file ;
8384 this .signing = signing ;
@@ -122,7 +123,7 @@ public void checkAll() throws LaunchException {
122123 }
123124
124125 if (attributesCheck .contains (MANIFEST_ATTRIBUTES_CHECK .ALAC ) ||
125- attributesCheck .contains (MANIFEST_ATTRIBUTES_CHECK .ALL )) {
126+ attributesCheck .contains (MANIFEST_ATTRIBUTES_CHECK .ALL )) {
126127 checkApplicationLibraryAllowableCodebaseAttribute ();
127128 } else {
128129 LOG .warn ("check on {} skipped because property of deployment.manifest.attributes.check was not set to ALL or includes {} in the combination of options" , "Application Library Allowable Codebase" , "ALAC" );
@@ -142,7 +143,7 @@ public static List<MANIFEST_ATTRIBUTES_CHECK> getAttributesCheck() {
142143 final List <String > configs = JNLPRuntime .getConfiguration ().getPropertyAsList (ConfigurationConstants .KEY_ENABLE_MANIFEST_ATTRIBUTES_CHECK );
143144 List <MANIFEST_ATTRIBUTES_CHECK > manifestAttributesCheckList = new ArrayList <>();
144145 for (String attribute : configs ) {
145- for (MANIFEST_ATTRIBUTES_CHECK manifestAttribute : MANIFEST_ATTRIBUTES_CHECK .values ()) {
146+ for (MANIFEST_ATTRIBUTES_CHECK manifestAttribute : MANIFEST_ATTRIBUTES_CHECK .values ()) {
146147 if (manifestAttribute .toString ().equals (attribute )) {
147148 manifestAttributesCheckList .add (manifestAttribute );
148149 }
@@ -331,20 +332,20 @@ private void checkApplicationLibraryAllowableCodebaseAttribute() throws LaunchEx
331332 final URL codebase = file .getCodeBase ();
332333
333334 //cases
334- final Map <String , Set <URL >> usedUrls = new HashMap <>();
335+ final Map <UrlKey , Set <UrlKey >> usedUrls = new HashMap <>();
335336 final URL sourceLocation = file .getSourceLocation ();
336337 final ResourcesDesc [] resourcesDescs = file .getResourcesDescs ();
337338 if ((sourceLocation != null ) && !FILE_PROTOCOL .equals (sourceLocation .getProtocol ())) {
338339 final URL urlWithoutFileName = UrlUtils .removeFileName (sourceLocation );
339- usedUrls .computeIfAbsent (urlWithoutFileName . toString ( ), url -> new HashSet <>()).add (sourceLocation );
340+ usedUrls .computeIfAbsent (new UrlKey ( urlWithoutFileName ), url -> new HashSet <>()).add (new UrlKey ( sourceLocation ) );
340341 }
341342 for (ResourcesDesc resourcesDesc : resourcesDescs ) {
342343 ExtensionDesc [] ex = resourcesDesc .getExtensions ();
343344 if (ex != null ) {
344345 for (ExtensionDesc extensionDesc : ex ) {
345346 if (extensionDesc != null ) {
346347 final URL urlWithoutFileName = UrlUtils .removeFileName (extensionDesc .getLocation ());
347- usedUrls .computeIfAbsent (urlWithoutFileName . toString ( ), url -> new HashSet <>()).add (extensionDesc .getLocation ());
348+ usedUrls .computeIfAbsent (new UrlKey ( urlWithoutFileName ), url -> new HashSet <>()).add (new UrlKey ( extensionDesc .getLocation () ));
348349 }
349350 }
350351 }
@@ -353,7 +354,7 @@ private void checkApplicationLibraryAllowableCodebaseAttribute() throws LaunchEx
353354 for (JARDesc jarDesc : jars ) {
354355 if (jarDesc != null ) {
355356 final URL urlWithoutFileName = UrlUtils .removeFileName (jarDesc .getLocation ());
356- usedUrls .computeIfAbsent (urlWithoutFileName . toString ( ), url -> new HashSet <>()).add (jarDesc .getLocation ());
357+ usedUrls .computeIfAbsent (new UrlKey ( urlWithoutFileName ), url -> new HashSet <>()).add (new UrlKey ( jarDesc .getLocation () ));
357358 }
358359 }
359360 }
@@ -365,21 +366,17 @@ private void checkApplicationLibraryAllowableCodebaseAttribute() throws LaunchEx
365366 LOG .debug ("The application is not using any url resources, skipping Application-Library-Allowable-Codebase Attribute check." );
366367 return ;
367368 }
368- final Set <URL > notOkUrls = new HashSet <>();
369+ final Set <UrlKey > notOkUrls = new HashSet <>();
369370 final boolean skipResourcesFromFileSystem = Boolean .parseBoolean (JNLPRuntime .getConfiguration ().getProperty (ConfigurationConstants .KEY_ASSUME_FILE_STEM_IN_CODEBASE ));
370- for (String urlString : usedUrls .keySet ()) {
371- try {
372- final URL u = new URL (urlString );
373- if (UrlUtils .urlRelativeTo (u , codebase )) {
374- LOG .debug ("OK - '{}' is from codebase '{}'." , u , codebase );
375- } else if (skipResourcesFromFileSystem && FILE_PROTOCOL .equals (u .getProtocol ())) {
376- LOG .debug ("OK - '{}' is from file system" , u );
377- } else {
378- notOkUrls .add (u );
379- LOG .warn ("Warning! '{}' is NOT from codebase '{}'." , u , codebase );
380- }
381- } catch (MalformedURLException mue ) {
382- LOG .debug ("Malformed URL checkApplicationLibraryAllowableCodebaseAttribute '{}'." , urlString );
371+ for (UrlKey urlKey : usedUrls .keySet ()) {
372+ final URL u = urlKey .getUrl ();
373+ if (UrlUtils .urlRelativeTo (u , codebase )) {
374+ LOG .debug ("OK - '{}' is from codebase '{}'." , u , codebase );
375+ } else if (skipResourcesFromFileSystem && FILE_PROTOCOL .equals (u .getProtocol ())) {
376+ LOG .debug ("OK - '{}' is from file system" , u );
377+ } else {
378+ notOkUrls .add (urlKey );
379+ LOG .warn ("Warning! '{}' is NOT from codebase '{}'." , u , codebase );
383380 }
384381 }
385382 if (notOkUrls .isEmpty ()) {
@@ -396,9 +393,11 @@ private void checkApplicationLibraryAllowableCodebaseAttribute() throws LaunchEx
396393 att = null ;
397394 }
398395
399- final Set <URL > notOkResources = notOkUrls .stream ()
400- .flatMap (notOk -> usedUrls .get (notOk .toString ()).stream ())
401- .collect (Collectors .toSet ());
396+ final List <URL > notOkResources = notOkUrls .stream ()
397+ .flatMap (notOk -> usedUrls .get (notOk ).stream ())
398+ .collect (Collectors .toSet ()).stream ()
399+ .map (UrlKey ::getUrl )
400+ .collect (Collectors .toList ());
402401
403402 notOkResources .forEach (url -> LOG .warn ("The resource '{}' is not from codebase '{}'" , url , codebase ));
404403
@@ -411,16 +410,12 @@ private void checkApplicationLibraryAllowableCodebaseAttribute() throws LaunchEx
411410 return ;
412411 }
413412 } else {
414- for (String foundUrlString : usedUrls .keySet ()) {
415- try {
416- URL foundUrl = new URL (foundUrlString );
417- if (!att .matches (foundUrl )) {
418- throw new LaunchException ("The resources " + usedUrls .get (foundUrlString ) + " do not match the location in Application-Library-Allowable-Codebase Attribute " + att + ". Blocking the application from running." );
419- } else {
420- LOG .debug ("The resources from {} do match the location in Application-Library-Allowable-Codebase Attribute {}. Continuing." , foundUrl , att );
421- }
422- } catch (MalformedURLException mue ) {
423- throw new LaunchException ("Malformed URL " + foundUrlString + ". Resources do not match the location in Application-Library-Allowable-Codebase Attribute " + att + ". Blocking the application from running." );
413+ for (UrlKey foundUrlKey : usedUrls .keySet ()) {
414+ URL foundUrl = foundUrlKey .getUrl ();
415+ if (!att .matches (foundUrl )) {
416+ throw new LaunchException ("The resources " + usedUrls .get (foundUrlKey ) + " do not match the location in Application-Library-Allowable-Codebase Attribute " + att + ". Blocking the application from running." );
417+ } else {
418+ LOG .debug ("The resources from {} do match the location in Application-Library-Allowable-Codebase Attribute {}. Continuing." , foundUrl , att );
424419 }
425420 }
426421 }
@@ -446,7 +441,7 @@ static URL stripDocbase(URL documentBase) {
446441 if (i <= 8 || i >= s .length ()) {
447442 return documentBase ;
448443 }
449- s = s .substring (0 , i + 1 );
444+ s = s .substring (0 , i + 1 );
450445 try {
451446 documentBase = new URL (s );
452447 } catch (MalformedURLException ex ) {
0 commit comments