Class JarFile

java.lang.Object
net.sourceforge.jnlp.util.JarFile
All Implemented Interfaces:
Closeable, AutoCloseable
public class JarFile extends Object implements Closeable
A wrapper over JarFile that verifies zip headers to protect against GIFAR attacks.
See Also:

  • Field Details

    • JAVA9_OR_GREATER

      private static final boolean JAVA9_OR_GREATER

    • runtimeVersion

      private final LazyLoaded<Object> runtimeVersion

    • constructor

      private final LazyLoaded<Constructor<JarFile>> constructor

    • delegate

      private final JarFile delegate

    • ZIP_ENTRY_HEADER_SIGNATURE

      private static final byte[] ZIP_ENTRY_HEADER_SIGNATURE
      The ZIP specification requires that the zip header for all entries in a zip-compressed archive must start with a well known "PK" which is defined as hex x50 x4b x03 x04.

      Note - this is not file-header, it is item-header.

      Actually most of compressing formats have some n-bytes headers. Eg: http://www.gzip.org/zlib/rfc-gzip.html#header-trailer for ID1 and ID2 so in case that some differently compressed jars will come to play, this is the place where to fix it.

      See Also:

    • HEADER_LENGTH

      private static final int HEADER_LENGTH

  • Constructor Details

  • Method Details