undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/util/jar/JarFile/VerifySignedJar.java

@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2001, 2026, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @modules java.base/sun.security.x509
+ * @modules java.base/sun.security.tools.keytool
+ * @bug 4419266 4842702
+ * @summary Make sure verifying signed Jar doesn't throw SecurityException
+ * @run junit VerifySignedJar
+ */
+import jdk.security.jarsigner.JarSigner;
+import org.junit.jupiter.api.Test;
+import sun.security.tools.keytool.CertAndKeyGen;
+import sun.security.x509.X500Name;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.KeyStore;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
+import java.util.Collections;
+import java.util.concurrent.TimeUnit;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
+import java.util.zip.ZipFile;
+
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+
+public class VerifySignedJar {
+
+    @Test
+    void signedJarSecurityExceptionTest() throws Exception {
+        Path j = createJar();
+        Path s = signJar(j, keyEntry("cn=duke"));
+
+        try (JarFile jf = new JarFile(s.toFile())) {
+
+            for (JarEntry e: Collections.list(jf.entries())) {
+                // Reading entry to trigger verification
+                jf.getInputStream(e).transferTo(OutputStream.nullOutputStream());
+                // Check that all regular files are signed by duke
+                if (!e.getName().startsWith("META-INF/")) {
+                    checkSignedBy(e, "cn=duke");
+                }
+            }
+
+            // Read ZIP and JAR entries by name
+            assertNotNull(jf.getEntry("getprop.class"));
+            assertNotNull(jf.getJarEntry("getprop.class"));
+
+            // Make sure we throw NPE on null parameters
+            assertThrows(NullPointerException.class, () -> jf.getEntry(null));
+            assertThrows(NullPointerException.class, () -> jf.getJarEntry(null));
+            assertThrows(NullPointerException.class, () -> jf.getInputStream(null));
+
+        } catch (SecurityException se) {
+            fail("Got SecurityException when verifying signed jar:" + se);
+        }
+    }
+
+    // Check that a JAR entry is signed by an expected DN
+    private static void checkSignedBy(JarEntry e, String expectedDn) {
+        Certificate[] certs = e.getCertificates();
+        assertNotNull(certs, "JarEntry has no certificates: " + e.getName());
+        assertNotEquals(0, certs.length, "JarEntry has no certificates: " + e.getName());
+        var x = assertInstanceOf(X509Certificate.class, certs[0], "Expected JarEntry.getCertificate to return X509Certificate");
+        String name = x.getSubjectX500Principal().getName();
+        assertTrue(name.equalsIgnoreCase(expectedDn), "Expected entry signed by %s, was %s".formatted(name, expectedDn));
+    }
+
+    private static Path createJar() throws IOException {
+        Path j = Path.of("unsigned.jar");
+        try (JarOutputStream out = new JarOutputStream(Files.newOutputStream(j))){
+            out.putNextEntry(new JarEntry("getprop.class"));
+            out.write(new byte[] {(byte) 0XCA, (byte) 0XFE, (byte) 0XBA, (byte) 0XBE});
+        }
+        return j;
+    }
+
+    private static Path signJar(Path j, KeyStore.PrivateKeyEntry entry) throws Exception {
+        Path s = Path.of("signed.jar");
+
+        JarSigner signer = new JarSigner.Builder(entry)
+                .signerName("zigbert")
+                .digestAlgorithm("SHA-256")
+                .signatureAlgorithm("SHA256withRSA")
+                .build();
+
+        try (ZipFile zip = new ZipFile(j.toFile());
+            OutputStream out = Files.newOutputStream(s)) {
+            signer.sign(zip, out);
+        }
+
+        return s;
+    }
+
+    private static KeyStore.PrivateKeyEntry keyEntry(String dname) throws Exception {
+
+        CertAndKeyGen gen = new CertAndKeyGen("RSA", "SHA256withRSA");
+
+        gen.generate(1048); // Small key size makes test run faster
+
+        var oneDay = TimeUnit.DAYS.toSeconds(1);
+        Certificate cert = gen.getSelfCertificate(new X500Name(dname), oneDay);
+
+        return new KeyStore.PrivateKeyEntry(gen.getPrivateKey(),
+                new Certificate[] {cert});
+    }
+}