Skip to content

Commit e8dadf4

Browse files
jaikiranjaikiran
committed
8378003: JarURLConnection.getCertificates() and getCodeSigners() incorrectly return null for signed JAR files after JDK-8377338
Reviewed-by: mullan, dfuchs
1 parent aeafc5b commit e8dadf4

File tree

2 files changed

+210
-0
lines changed

2 files changed

+210
-0
lines changed

‎src/java.base/share/classes/sun/net/www/protocol/jar/URLJarFile.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,12 @@
3030
import java.nio.file.Files;
3131
import java.nio.file.Path;
3232
import java.nio.file.StandardCopyOption;
33+
import java.security.cert.Certificate;
3334
import java.util.*;
3435
import java.util.jar.*;
3536
import java.util.zip.ZipFile;
3637
import java.util.zip.ZipEntry;
38+
import java.security.CodeSigner;
3739
import sun.net.www.ParseUtil;
3840

3941
/* URL jar file is a common JarFile subtype used for JarURLConnection */
@@ -163,9 +165,11 @@ private static JarFile retrieve(final URL url, final URLJarFileCloseController c
163165
}
164166

165167
private class URLJarFileEntry extends JarEntry {
168+
private final JarEntry je;
166169

167170
URLJarFileEntry(JarEntry je) {
168171
super(je);
172+
this.je = je;
169173
}
170174

171175
@Override
@@ -180,6 +184,30 @@ public Attributes getAttributes() throws IOException {
180184
}
181185
return null;
182186
}
187+
188+
@Override
189+
public Certificate[] getCertificates() {
190+
// super.getCertificates() returns Certificates that were
191+
// captured by reading the "JarEntry.certs" field when
192+
// the super instance was created. Some JarEntry
193+
// implementations (like java.util.jar.JarFile$JarFileEntry)
194+
// compute certificates lazily, so we explicitly
195+
// call getCertificates() on the underlying JarEntry instead of
196+
// super.getCertificates()
197+
return je.getCertificates();
198+
}
199+
200+
@Override
201+
public CodeSigner[] getCodeSigners() {
202+
// super.getCodeSigners() returns CodeSigners that were
203+
// captured by reading the "JarEntry.signers" field when
204+
// the super instance was created. Some JarEntry
205+
// implementations (like java.util.jar.JarFile$JarFileEntry)
206+
// compute codesigners lazily, so we explicitly
207+
// call getCodeSigners() on the underlying JarEntry instead of
208+
// super.getCodeSigners()
209+
return je.getCodeSigners();
210+
}
183211
}
184212

185213
public interface URLJarFileCloseController {

‎test/jdk/sun/net/www/protocol/jar/JarURLConnectionCertsAndCodeSigners.java‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
/*
2+
* Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
import java.io.InputStream;
25+
import java.io.OutputStream;
26+
import java.net.JarURLConnection;
27+
import java.net.URI;
28+
import java.net.URLConnection;
29+
import java.nio.file.Files;
30+
import java.nio.file.Path;
31+
import java.security.CodeSigner;
32+
import java.security.KeyStore;
33+
import java.security.cert.Certificate;
34+
import java.security.cert.X509Certificate;
35+
import java.util.List;
36+
import java.util.concurrent.TimeUnit;
37+
import java.util.jar.Attributes;
38+
import java.util.jar.JarEntry;
39+
import java.util.jar.JarOutputStream;
40+
import java.util.jar.Manifest;
41+
import java.util.zip.ZipFile;
42+
43+
import jdk.security.jarsigner.JarSigner;
44+
import org.junit.jupiter.api.BeforeAll;
45+
import org.junit.jupiter.api.Test;
46+
import sun.security.tools.keytool.CertAndKeyGen;
47+
import sun.security.x509.X500Name;
48+
import static org.junit.jupiter.api.Assertions.assertEquals;
49+
import static org.junit.jupiter.api.Assertions.assertInstanceOf;
50+
import static org.junit.jupiter.api.Assertions.assertNotEquals;
51+
import static org.junit.jupiter.api.Assertions.assertNotNull;
52+
import static org.junit.jupiter.api.Assertions.assertNotSame;
53+
54+
/*
55+
* @test
56+
* @bug 8378003
57+
* @summary Verify that JarURLConnection.getCertificates() and
58+
* JarURLConnection.getJarEntry().getCodeSigners() returns the
59+
* expected results for entries in a signed JAR file
60+
* @modules java.base/sun.security.x509
61+
* java.base/sun.security.tools.keytool
62+
* @run junit ${test.main.class}
63+
*/
64+
class JarURLConnectionCertsAndCodeSigners {
65+
66+
private static final String JAR_ENTRY_NAME = "foo-bar";
67+
private static final String CERT_SUBJECT = "CN=duke";
68+
private static Path SIGNED_JAR;
69+
70+
@BeforeAll
71+
static void beforeAll() throws Exception {
72+
final KeyStore.PrivateKeyEntry key = generatePrivateKey();
73+
SIGNED_JAR = createSignedJar(key);
74+
}
75+
76+
/*
77+
* Verifies that JarURLConnection.getCertificates() returns the correct
78+
* certificates for entries in a signed JAR file.
79+
*/
80+
@Test
81+
void testCertificates() throws Exception {
82+
final URI uri = new URI("jar:" + SIGNED_JAR.toUri() + "!/" + JAR_ENTRY_NAME);
83+
System.err.println("running test against signed JAR entry: " + uri);
84+
final URLConnection urlConn = uri.toURL().openConnection();
85+
assertInstanceOf(JarURLConnection.class, urlConn, "unexpected URLConnection type");
86+
final JarURLConnection jarURLConn = (JarURLConnection) urlConn;
87+
try (InputStream is = jarURLConn.getInputStream()) {
88+
is.readAllBytes();
89+
}
90+
Certificate[] prevIterationCerts = null;
91+
for (int i = 1; i <= 2; i++) {
92+
final Certificate[] certs = jarURLConn.getCertificates();
93+
assertNotNull(certs, "null certificates for signed JAR entry: " + uri);
94+
assertNotEquals(0, certs.length, "empty certificates for signed JAR entry: " + uri);
95+
assertInstanceOf(X509Certificate.class, certs[0], "unexpected certificate type");
96+
final String subject = ((X509Certificate) certs[0]).getSubjectX500Principal().getName();
97+
assertEquals(CERT_SUBJECT, subject, "unexpected subject in certificate");
98+
if (i > 1) {
99+
// verify that each call to getCertificates() returns
100+
// a new instance of the array.
101+
// intentional identity check
102+
assertNotSame(prevIterationCerts, certs, "getCertificates() did not return" +
103+
" a new array");
104+
}
105+
prevIterationCerts = certs;
106+
}
107+
}
108+
109+
/*
110+
* Verifies that JarURLConnection.getJarEntry().getCodeSigners() returns the correct
111+
* codesigners for entries in a signed JAR file.
112+
*/
113+
@Test
114+
void testCodeSigners() throws Exception {
115+
final URI uri = new URI("jar:" + SIGNED_JAR.toUri() + "!/" + JAR_ENTRY_NAME);
116+
System.err.println("running test against signed JAR entry: " + uri);
117+
final URLConnection urlConn = uri.toURL().openConnection();
118+
assertInstanceOf(JarURLConnection.class, urlConn, "unexpected URLConnection type");
119+
final JarURLConnection jarURLConn = (JarURLConnection) urlConn;
120+
try (InputStream is = jarURLConn.getInputStream()) {
121+
is.readAllBytes();
122+
}
123+
CodeSigner[] prevIterationCodeSigners = null;
124+
for (int i = 1; i <= 2; i++) {
125+
final CodeSigner[] codeSigners = jarURLConn.getJarEntry().getCodeSigners();
126+
assertNotNull(codeSigners, "null codesigners for signed JAR entry: " + uri);
127+
assertNotEquals(0, codeSigners.length, "empty codesigners for signed JAR entry: " + uri);
128+
final List<? extends Certificate> certs = codeSigners[0].getSignerCertPath().getCertificates();
129+
assertNotNull(certs, "null certificates from codesigner");
130+
assertNotEquals(0, certs.size(), "empty certificates from codesigner");
131+
assertInstanceOf(X509Certificate.class, certs.getFirst(), "unexpected certificate type");
132+
final String subject = ((X509Certificate) certs.getFirst()).getSubjectX500Principal().getName();
133+
assertEquals(CERT_SUBJECT, subject, "unexpected subject in certificate");
134+
if (i > 1) {
135+
// verify that each call to getCodeSigners() returns
136+
// a new instance of the array.
137+
// intentional identity check
138+
assertNotSame(prevIterationCodeSigners, codeSigners, "getCodeSigners() did not"
139+
+ " return a new array");
140+
}
141+
prevIterationCodeSigners = codeSigners;
142+
}
143+
}
144+
145+
private static KeyStore.PrivateKeyEntry generatePrivateKey() throws Exception {
146+
final CertAndKeyGen gen = new CertAndKeyGen("RSA", "SHA256withRSA");
147+
gen.generate(1048); // Small key size makes test run faster
148+
final long oneDay = TimeUnit.DAYS.toSeconds(1);
149+
final Certificate cert = gen.getSelfCertificate(new X500Name(CERT_SUBJECT), oneDay);
150+
return new KeyStore.PrivateKeyEntry(gen.getPrivateKey(), new Certificate[]{cert});
151+
}
152+
153+
private static Path createSignedJar(final KeyStore.PrivateKeyEntry privateKey)
154+
throws Exception {
155+
156+
// first create a unsigned JAR
157+
final Path unsignedJar = Path.of("test-8377985-unsigned.jar");
158+
final Manifest manifest = new Manifest();
159+
final Attributes mainAttributes = manifest.getMainAttributes();
160+
mainAttributes.putValue("Manifest-Version", "1.0");
161+
try (OutputStream os = Files.newOutputStream(unsignedJar);
162+
JarOutputStream jaros = new JarOutputStream(os, manifest)) {
163+
jaros.putNextEntry(new JarEntry(JAR_ENTRY_NAME));
164+
jaros.write(new byte[]{0x42});
165+
jaros.closeEntry();
166+
}
167+
168+
// use a JarSigner to sign the JAR
169+
final JarSigner signer = new JarSigner.Builder(privateKey)
170+
.signerName("abcdef")
171+
.digestAlgorithm("SHA-256")
172+
.signatureAlgorithm("SHA256withRSA")
173+
.build();
174+
175+
final Path signedJar = Path.of("test-8377985-signed.jar");
176+
try (ZipFile zip = new ZipFile(unsignedJar.toFile());
177+
OutputStream out = Files.newOutputStream(signedJar)) {
178+
signer.sign(zip, out);
179+
}
180+
return signedJar;
181+
}
182+
}

0 commit comments

Comments
 (0)