1 /*
   2  * Copyright (c) 2015, 2016, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  */
  23 
  24 /*
  25  * @test
  26  * @bug 8132734 8144062
  27  * @summary Test potential security related issues
  28  * @library /lib/testlibrary/java/util/jar
  29  * @build Compiler JarBuilder CreateMultiReleaseTestJars
  30  * @run testng MultiReleaseJarSecurity
  31  */
  32 
  33 import java.io.File;
  34 import java.io.IOException;
  35 import java.io.InputStream;
  36 import java.nio.file.Files;
  37 import java.security.CodeSigner;
  38 import java.security.cert.Certificate;
  39 import java.util.Arrays;
  40 import java.util.jar.JarEntry;
  41 import java.util.jar.JarFile;
  42 import java.util.zip.ZipFile;
  43 
  44 import org.testng.Assert;
  45 import org.testng.annotations.AfterClass;
  46 import org.testng.annotations.BeforeClass;
  47 import org.testng.annotations.Test;
  48 
  49 public class MultiReleaseJarSecurity {
  50 
  51     static final int MAJOR_VERSION = Runtime.version().major();
  52 
  53     String userdir = System.getProperty("user.dir",".");
  54     File multirelease = new File(userdir, "multi-release.jar");
  55     File signedmultirelease = new File(userdir, "signed-multi-release.jar");
  56 
  57     @BeforeClass
  58     public void initialize() throws Exception {
  59         CreateMultiReleaseTestJars creator =  new CreateMultiReleaseTestJars();
  60         creator.compileEntries();
  61         creator.buildMultiReleaseJar();
  62         creator.buildSignedMultiReleaseJar();
  63     }
  64 
  65     @AfterClass
  66     public void close() throws IOException {
  67         Files.delete(multirelease.toPath());
  68         Files.delete(signedmultirelease.toPath());
  69     }
  70 
  71     @Test
  72     public void testCertsAndSigners() throws IOException {
  73         try (JarFile jf = new JarFile(signedmultirelease, true, ZipFile.OPEN_READ, JarFile.Release.RUNTIME)) {
  74             CertsAndSigners vcas = new CertsAndSigners(jf, jf.getJarEntry("version/Version.class"));
  75             CertsAndSigners rcas = new CertsAndSigners(jf, jf.getJarEntry("META-INF/versions/" + MAJOR_VERSION + "/version/Version.class"));
  76             Assert.assertTrue(Arrays.equals(rcas.getCertificates(), vcas.getCertificates()));
  77             Assert.assertTrue(Arrays.equals(rcas.getCodeSigners(), vcas.getCodeSigners()));
  78         }
  79     }
  80 
  81     private static class CertsAndSigners {
  82         final private JarFile jf;
  83         final private JarEntry je;
  84         private boolean readComplete;
  85 
  86         CertsAndSigners(JarFile jf, JarEntry je) {
  87             this.jf = jf;
  88             this.je = je;
  89         }
  90 
  91         Certificate[] getCertificates() throws IOException {
  92             readEntry();
  93             return je.getCertificates();
  94         }
  95 
  96         CodeSigner[] getCodeSigners() throws IOException {
  97             readEntry();
  98             return je.getCodeSigners();
  99         }
 100 
 101         private void readEntry() throws IOException {
 102             if (!readComplete) {
 103                 try (InputStream is = jf.getInputStream(je)) {
 104                     is.readAllBytes();
 105                 }
 106                 readComplete = true;
 107             }
 108         }
 109     }
 110 }