1 /*
2  * Copyright (c) 2015, 2016, Oracle and/or its affiliates. All rights reserved.
3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4  *
5  * This code is free software; you can redistribute it and/or modify it
6  * under the terms of the GNU General Public License version 2 only, as
7  * published by the Free Software Foundation.
8  *
9  * This code is distributed in the hope that it will be useful, but WITHOUT
10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12  * version 2 for more details (a copy is included in the LICENSE file that
13  * accompanied this code).
14  *
15  * You should have received a copy of the GNU General Public License version
16  * 2 along with this work; if not, write to the Free Software Foundation,
17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18  *
19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20  * or visit www.oracle.com if you need additional information or have any
21  * questions.
22  */
23 
24 /*
25  * @test
26  * @bug 8132734 8144062
27  * @summary Test potential security related issues
28  * @library /lib/testlibrary/java/util/jar
29  * @build Compiler JarBuilder CreateMultiReleaseTestJars
30  * @run testng MultiReleaseJarSecurity
31  */
32 
33 import java.io.File;
34 import java.io.IOException;
35 import java.io.InputStream;
36 import java.nio.file.Files;
37 import java.security.CodeSigner;
38 import java.security.cert.Certificate;
39 import java.util.Arrays;
40 import java.util.jar.JarEntry;
41 import java.util.jar.JarFile;
42 import java.util.zip.ZipFile;
43 
44 import org.testng.Assert;
45 import org.testng.annotations.AfterClass;
46 import org.testng.annotations.BeforeClass;
47 import org.testng.annotations.Test;
48 
49 public class MultiReleaseJarSecurity {
50 
51     static final int MAJOR_VERSION = Runtime.version().major();
52 
53     String userdir = System.getProperty("user.dir",".");
54     File multirelease = new File(userdir, "multi-release.jar");
55     File signedmultirelease = new File(userdir, "signed-multi-release.jar");
56 
57     @BeforeClass
initialize()58     public void initialize() throws Exception {
59         CreateMultiReleaseTestJars creator =  new CreateMultiReleaseTestJars();
60         creator.compileEntries();
61         creator.buildMultiReleaseJar();
62         creator.buildSignedMultiReleaseJar();
63     }
64 
65     @AfterClass
close()66     public void close() throws IOException {
67         Files.delete(multirelease.toPath());
68         Files.delete(signedmultirelease.toPath());
69     }
70 
71     @Test
testCertsAndSigners()72     public void testCertsAndSigners() throws IOException {
73         try (JarFile jf = new JarFile(signedmultirelease, true, ZipFile.OPEN_READ, Runtime.version())) {
74             CertsAndSigners vcas = new CertsAndSigners(jf, jf.getJarEntry("version/Version.class"));
75             CertsAndSigners rcas = new CertsAndSigners(jf, jf.getJarEntry("META-INF/versions/" + MAJOR_VERSION + "/version/Version.class"));
76             Assert.assertTrue(Arrays.equals(rcas.getCertificates(), vcas.getCertificates()));
77             Assert.assertTrue(Arrays.equals(rcas.getCodeSigners(), vcas.getCodeSigners()));
78         }
79     }
80 
81     private static class CertsAndSigners {
82         final private JarFile jf;
83         final private JarEntry je;
84         private boolean readComplete;
85 
CertsAndSigners(JarFile jf, JarEntry je)86         CertsAndSigners(JarFile jf, JarEntry je) {
87             this.jf = jf;
88             this.je = je;
89         }
90 
getCertificates()91         Certificate[] getCertificates() throws IOException {
92             readEntry();
93             return je.getCertificates();
94         }
95 
getCodeSigners()96         CodeSigner[] getCodeSigners() throws IOException {
97             readEntry();
98             return je.getCodeSigners();
99         }
100 
readEntry()101         private void readEntry() throws IOException {
102             if (!readComplete) {
103                 try (InputStream is = jf.getInputStream(je)) {
104                     is.readAllBytes();
105                 }
106                 readComplete = true;
107             }
108         }
109     }
110 }
111