RFR: 8300140: ZipFile.isSignatureRelated returns true for files in META-INF subdirectories [v8]

Eirik Bjorsnos duke at openjdk.org
Wed Jan 18 10:02:00 UTC 2023


> Some call sites of SignatureFileVerifier.isBlockOrSF fails to check that files reside in META-INF directly, and not in a subdirectory of META-INF.
> 
> The mentioned call sites needs updates to check and ignore such files.
> 
> A new test VerifyUnrelatedSignatureFiles is added which verifies that [*.SF, *.RSA] files in META-INF/ subdirectories are indeed ignored.

Eirik Bjorsnos has updated the pull request incrementally with one additional commit since the last revision:

  Renaming the test to IgnoreUnrelatedSignatureFiles to make it clear that unrelated files should be ignored.

-------------

Changes:
  - all: https://git.openjdk.org/jdk/pull/11976/files
  - new: https://git.openjdk.org/jdk/pull/11976/files/eadcc2c0..0cd4cc4a

Webrevs:
 - full: https://webrevs.openjdk.org/?repo=jdk&pr=11976&range=07
 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=11976&range=06-07

  Stats: 1 line in 1 file changed: 0 ins; 0 del; 1 mod
  Patch: https://git.openjdk.org/jdk/pull/11976.diff
  Fetch: git fetch https://git.openjdk.org/jdk pull/11976/head:pull/11976

PR: https://git.openjdk.org/jdk/pull/11976



More information about the security-dev mailing list