RFR: 8215788: Clarify JarInputStream Manifest access [v4]
Alan Bateman
alanb at openjdk.org
Sat Sep 17 08:07:51 UTC 2022
On Fri, 16 Sep 2022 18:33:46 GMT, Lance Andersen <lancea at openjdk.org> wrote:
>> Okay, in which case what would you think about just saying that the getNextEntry/getNextJarEntry method do not return the Manifest when it's at the start of the stream, and it's unspecified whether they return the Manifest when it located later in the stream. I think this would give us wriggle room to change it in the future.
>
>> Okay, in which case what would you think about just saying that the getNextEntry/getNextJarEntry method do not return the Manifest when it's at the start of the stream, and it's unspecified whether they return the Manifest when it located later in the stream. I think this would give us wriggle room to change it in the future.
>
> Is this any better:
>
>
>
> * <p>
> * When the {@code Manifest} is returned by {@code getManifest()}, the {@link #getNextEntry()}
> * and {@link #getNextJarEntry()} methods will not return the {@code Manifest}.
> * If {@code META-INF/} is the first entry in the input stream it will be
> * also not be returned by {@link #getNextEntry()} and {@link #getNextJarEntry()}.
> * </p>
> * @apiNote
> * It is unspecified whether {@link #getNextEntry()} and
> * {@link #getNextJarEntry()} will return the {@code Manifest}
> * when the {@code Manifest} occurs later in the input stream.
> * <p>
> * {@link JarEntry#getAttributes()} will return the {@code Manifest}'s
> * attributes for the current JAR file entry, if any, providing
> * {@code getManifest()} returns a {@code Manifest} for the JAR file.
> * </p>
It's a bit better but I think we can make it clearer and also link the JAR Manifest section of the JAR file spec. Can you try this:
* <p> The {@link #getManifest() getManifest} method is used to read the
* <a href="{@docRoot}/../specs/jar/jar.html#jar-manifest">JAR Manifest</a>
* from the entry {@code META-INF/MANIFEST.MF} when it is the first entry
* in the stream (or the second entry in the case that the fist entry is
* {@code META-INF/} and the second entry {@code META-INF/MANIFEST.MF}).
*
* <p> The {@link #getNextJarEntry()} and {@link #getNextEntry()} methods are
* used to read JAR file entries from the stream. These methods skip over the
* manifest ({@code META-INF/MANIFEST.MF}) when it is at the beginning of the
* stream. In other words, these methods do not return an entry for the manifest
* when the manifest is the first entry in the stream. If the first entry is
* {@code META-INF/} and the second entry is the manifest then both are skipped
* over by these methods. Whether these methods skip over the manifest when it
* appears later in the stream is not specified.
I think we also have to update getManifest method to align with the above as doesn't say anything about the manifest needing to be at the beginning of the stream.
-------------
PR: https://git.openjdk.org/jdk/pull/10045
More information about the security-dev
mailing list