RFR: 8280409: JarFile::verifiableEntry can fail with NPE accessing ze.getName() [v2]
Lance Andersen
lancea at openjdk.java.net
Tue Feb 8 18:15:05 UTC 2022
On Tue, 8 Feb 2022 16:15:20 GMT, Sean Mullan <mullan at openjdk.org> wrote:
>> if ZipEntry is extended and getName() overridden then you can't trust the name. So I think you'll have extract the name rather than calling ZipEntry::getName twice. I'm almost tempted to have getInputStream(ZipEntry) be re-specified to throw IAE if the zip entry name is null.
>
> Ah, yes - good catch!
Will do.
-------------
PR: https://git.openjdk.java.net/jdk/pull/7348
More information about the security-dev
mailing list