/hg/icedtea-web: Restricted CodebaseMatcher to not match aaexamp...

[jvanek at icedtea.classpath.org]

changeset 70d23452ac83 in /hg/icedtea-web
details: http://icedtea.classpath.org/hg/icedtea-web?cmd=changeset;node=70d23452ac83
author: Jiri Vanek <jvanek at redhat.com>
date: Tue Apr 01 11:20:26 2014 +0200

	Restricted CodebaseMatcher to not match aaexample.com by *.example.com expression but still match example.com - as in specification.


diffstat:

 ChangeLog                                                           |  12 +++
 netx/net/sourceforge/jnlp/util/ClasspathMatcher.java                |  18 ++++-
 tests/netx/unit/net/sourceforge/jnlp/util/ClasspathMatcherTest.java |  31 +++++++++-
 3 files changed, 54 insertions(+), 7 deletions(-)

diffs (96 lines):

diff -r dc0a77856cb4 -r 70d23452ac83 ChangeLog
--- a/ChangeLog	Mon Mar 31 13:27:48 2014 -0400
+++ b/ChangeLog	Tue Apr 01 11:20:26 2014 +0200
@@ -1,3 +1,15 @@
+2013-04-01  Jiri Vanek  <jvanek at redhat.com>
+
+	Restricted CodebaseMatcher to not match aaexample.com by *.example.com expression
+	but still match example.com - as in specification.
+	* netx/net/sourceforge/jnlp/util/ClasspathMatcher.java: (domainToRegEx) consists
+	of original regex connected by or with second one in case of *. start.
+	(sourceToRegExString) part of the logic extracted to quote method.
+	* tests/netx/unit/net/sourceforge/jnlp/util/ClasspathMatcherTest.java:
+	(matchTest5) adapted. (wildCardSubdomainDoesNotMatchParentDomainPaths) new test,
+	focusing on aaexample.com/example.com/aaa.example.com in *.example.com both
+	path and domain.
+
 2013-03-31  Omair Majid  <omajid at redhat.com>
 
 	* netx/net/sourceforge/jnlp/resources/Messages.properties
diff -r dc0a77856cb4 -r 70d23452ac83 netx/net/sourceforge/jnlp/util/ClasspathMatcher.java
--- a/netx/net/sourceforge/jnlp/util/ClasspathMatcher.java	Mon Mar 31 13:27:48 2014 -0400
+++ b/netx/net/sourceforge/jnlp/util/ClasspathMatcher.java	Tue Apr 01 11:20:26 2014 +0200
@@ -146,12 +146,16 @@
         }
 
         private static Pattern domainToRegEx(String domain) {
-            // Although I have conisdered the "dot" as bug in specification, 
-            // to many applications are depnding on it
-            while (domain.startsWith("*.")) {
-                domain = "*" + domain.substring(2);
+            String pre = "";
+            String post = "";
+            if (domain.startsWith("*.")) {
+                //this is handling case, when *.abc.xy
+                //should match also abc.xy except whatever.abc.xz
+                //but NOT whatewerabc.xy
+                pre = "(" + quote(domain.substring(2)) + ")|(";
+                post = ")";
             }
-            return ClasspathMatcher.sourceToRegEx(domain);
+            return Pattern.compile(pre + ClasspathMatcher.sourceToRegExString(domain) + post);
         }
     }
 
@@ -316,6 +320,10 @@
         if (s.equals("*")) {
             return ".*";
         }
+        return quote(s);
+    }
+    
+    private static String quote(String s) {
         /*
          * coment for lazybones:
          * \Q is start of citation
diff -r dc0a77856cb4 -r 70d23452ac83 tests/netx/unit/net/sourceforge/jnlp/util/ClasspathMatcherTest.java
--- a/tests/netx/unit/net/sourceforge/jnlp/util/ClasspathMatcherTest.java	Mon Mar 31 13:27:48 2014 -0400
+++ b/tests/netx/unit/net/sourceforge/jnlp/util/ClasspathMatcherTest.java	Tue Apr 01 11:20:26 2014 +0200
@@ -427,8 +427,35 @@
         Assert.assertFalse(p.match(urls[17]));
         //reasons for alowing "dot" issue
         Assert.assertTrue(p.match(new URL("http://www.example.com")));
-        Assert.assertTrue(p.match(new URL("http://example.com"))); //yah, this is really nasty
-        //still the DOT issue is an BUG
+        Assert.assertTrue(p.match(new URL("http://example.com")));
+        //reason for restricting dost issue
+        Assert.assertFalse(p.match(new URL("http://aaaexample.com")));
+    }
+
+    @Test
+    public void wildCardSubdomainDoesNotMatchParentDomainPaths() throws MalformedURLException {
+        ClasspathMatchers p1 = ClasspathMatchers.compile("*.example.com*/*.abc.cde*", true);
+        Assert.assertFalse(p1.matches(new URL("http://aaaexample.com/xyz.abc.cde")));
+
+        Assert.assertTrue(p1.matches(new  URL("http://www.example.com/.abc.cde")));
+        Assert.assertTrue(p1.matches(new  URL("http://www.example.com/xyz.abc.cde")));
+        Assert.assertFalse(p1.matches(new URL("http://www.example.com/abc.cde")));
+        Assert.assertTrue(p1.matches(new  URL("http://example.com/xyz.abc.cdeefg")));
+        Assert.assertTrue(p1.matches(new  URL("http://example.com/xyz.abc.cde.efg")));
+        Assert.assertFalse(p1.matches(new URL("http://example.com/abc.cde.efg")));
+        Assert.assertFalse(p1.matches(new URL("http://example.com")));
+
+
+        ClasspathMatchers p = ClasspathMatchers.compile("*.example.com*/*.abc.cde*", false);
+        Assert.assertFalse(p.matches(new URL("http://aaaexample.com/xyz.abc.cde")));
+
+        Assert.assertTrue(p.matches(new URL("http://www.example.com/.abc.cde")));
+        Assert.assertTrue(p.matches(new URL("http://www.example.com/xyz.abc.cde")));
+        Assert.assertTrue(p.matches(new URL("http://www.example.com/abc.cde")));
+        Assert.assertTrue(p.matches(new URL("http://example.com/xyz.abc.cdeefg")));
+        Assert.assertTrue(p.matches(new URL("http://example.com/xyz.abc.cde.efg")));
+        Assert.assertTrue(p.matches(new URL("http://example.com/abc.cde.efg")));
+        Assert.assertTrue(p.matches(new URL("http://example.com")));
     }
 
     @Test