JBoss may use the "jar:file" format to reference jar files instead of nested jars (#8428)

What Does This Do
Add support for JBoss jar:file format to DependencyResolver
improve tests
Motivation
The current implementation only considered dependency analysis with the jar:file format for nested jars. However, thanks to the bug reported in APPSEC-56111, we discovered that this format is also used in JBoss to reference jar files instead of nested jars

Author: jandro996

telemetry/src/main/java/datadog/telemetry/dependency/DependencyResolver.java

@@ -71,7 +71,9 @@ private static JarReader.Extracted resolveNestedJar(final URI uri) throws IOExce
       path = path.substring("file:".length());
       final int sepIdx = path.indexOf("!/");
       if (sepIdx == -1) {
-        throw new IllegalArgumentException("Invalid nested jar path: " + path);
+        // JBoss may use the "jar:file" format to reference jar files instead of nested jars.
+        // These look like: jar:file:/path/to.jar!/
+        return JarReader.readJarFile(path);
       }
       final String outerPath = path.substring(0, sepIdx);
       final String innerPath = path.substring(sepIdx + 2);

telemetry/src/test/groovy/datadog/telemetry/dependency/DependencyResolverSpecification.groovy

@@ -21,14 +21,7 @@ class DependencyResolverSpecification extends DepSpecification {
       'Implementation-Title'  : implementationTitle,
       'Implementation-Version': implementationVersion,
     ]
-    File file = new File(testDir, filename)
-    ZipOutputStream out = new ZipOutputStream(new FileOutputStream(file))
-    ZipEntry e = new ZipEntry("META-INF/MANIFEST.MF")
-    def manifest = attributes.findAll { it.value != null }.collect { k, v -> "$k: $v" }.join('\n')
-    out.putNextEntry(e)
-    out.write(manifest.getBytes(Charset.forName('UTF-8')))
-    out.closeEntry()
-    out.close()
+    File file = prepareJar(filename, attributes)
 
     when:
     def dependencies = DependencyResolver.resolve(file.toURI())
@@ -66,6 +59,18 @@ class DependencyResolverSpecification extends DepSpecification {
     'com.samskivert.jmustache'                  | 'jmustache'                     | '1.14.0'                   | null                              | null                  | 'jmustache-1.14.jar'               || 'com.samskivert:jmustache'                  | '1.14'
   }
 
+  private File prepareJar(final filename, final attributes) {
+    File file = new File(testDir, filename)
+    ZipOutputStream out = new ZipOutputStream(new FileOutputStream(file))
+    ZipEntry e = new ZipEntry("META-INF/MANIFEST.MF")
+    def manifest = attributes.findAll { it.value != null }.collect { k, v -> "$k: $v" }.join('\n')
+    out.putNextEntry(e)
+    out.write(manifest.getBytes(Charset.forName('UTF-8')))
+    out.closeEntry()
+    out.close()
+    file
+  }
+
   void 'jar without pom.properties get resolved with hash'() {
     expect:
     knownJarCheck(
@@ -328,4 +333,23 @@ class DependencyResolverSpecification extends DepSpecification {
     assert dep.version == opts['version']
     assert dep.hash == opts['hash']
   }
+
+  void 'JBoss may use the "jar:file" format to reference jar files instead of nested jars'(){
+    setup:
+    final attributes = [
+      'Bundle-SymbolicName'   : null,
+      'Bundle-Name'           : null,
+      'Bundle-Version'        : null,
+      'Implementation-Title'  : 'JUnit',
+      'Implementation-Version': '4.12',
+    ]
+    final file = prepareJar("junit-4.12.jar", attributes)
+    final uri = new URI("jar:"+file.toURI()+"!/")
+
+    when:
+    final deps = DependencyResolver.resolve(uri)
+
+    then:
+    deps.size() == 1
+  }
 }