fix(dependencies): a module jar cannot name its way out of the registry, and a package-only build boots - #6871
Merged
Merged
Conversation
…ry, and a package-only build boots (#6860, #6861) Two hardening fixes on the dynamic-dependencies pipeline: - ModuleJarInspector refuses a registry project name that is not a plain path segment. The name becomes a repository path on removal (ClasspathExpander.remove concatenates it under /registry/public), so a crafted "META-INF/dirigible/../x" entry named the project ".." and its removal would have deleted the registry root - the expand side already rejects its kind (the Zip-Slip guard), the remove side did not. The refusal is loud and per-jar: such an archive is malformed or malicious. Closes #6860. - The Launcher-Agent-Class manifest attribute is written by the SAME pre-integration-test step that injects the agent classes, never at package time. A manifest naming an agent class the archive does not carry aborts `java -jar` before main (JEP 261), so a build that stops at package - the documented UI-resource dev loop - produced a jar that could not boot at all. Now a package-only jar has NO agent (it boots, without restartless dependency delivery) and the full build produces the complete pair; asserted by LauncherAgentDeliveryIT as before. Closes #6861. - maven-antrun-plugin is pinned to 3.1.0 in build/application: unpinned, an older local Maven resolved 1.3, where the injection silently degraded - the split behind LauncherAgentDeliveryIT failing on developer machines while green on CI. With the pin the IT passes locally too. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #6860 and #6861 — two hardening fixes on the #6776 dynamic-dependencies pipeline, found reviewing the 14.29/14.30 wave.
ModuleJarInspectorrefuses a registry project name that is not a plain path segment ([A-Za-z0-9][A-Za-z0-9._-]*). The name is concatenated into/registry/public/<name>on removal, so a craftedMETA-INF/dirigible/../xentry named the project..and its removal deleted the registry root. Covered byModuleJarInspectorTest(accepted plain name, refused.., refused backslash).Launcher-Agent-Classmanifest attribute now rides the samepre-integration-testant step that injects the agent classes (the antjartask merges it into the existing manifest,keepcompressionpreserved). Apackage-only build — the documented dev loop — previously produced a jar whose manifest named classes the archive lacked, which abortsjava -jarbefore main; now it produces an agent-less jar that boots (verified by an actual boot), and the full build produces the complete pair (LauncherAgentDeliveryIT, as before).maven-antrun-pluginpinned to 3.1.0 — unpinned, older local Mavens resolved 1.3 where the injection silently degraded, which is whyLauncherAgentDeliveryITfailed on developer machines while green on CI. With the pin it passes locally (3/3 verified).🤖 Generated with Claude Code