undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
2026-03-26 17:11:57 -04:00 · 2026-03-26 17:11:57 -04:00 · 0a580b313d
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
--- a/test/jdk/java/util/jar/Manifest/IncludeInExceptionsTest.java
+++ b/test/jdk/java/util/jar/Manifest/IncludeInExceptionsTest.java
@ -0,0 +1,99 @@
+/*
+ * Copyright (c) 2019, 2026, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.concurrent.Callable;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
+import java.util.stream.Stream;
+
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.fail;
+import static sun.security.util.SecurityProperties.INCLUDE_JAR_NAME_IN_EXCEPTIONS;
+
+/*
+ * @test
+ * @bug 8216362
+ * @summary Verify that the property jdk.includeInExceptions works as expected
+ *          when an error occurs while reading an invalid Manifest file.
+ * @modules java.base/sun.security.util
+ * @run junit/othervm -Djdk.includeInExceptions=jar IncludeInExceptionsTest
+ * @run junit/othervm -Djdk.includeInExceptions= IncludeInExceptionsTest
+ * @run junit/othervm IncludeInExceptionsTest
+ */
+
+/*
+ * @see Manifest#Manifest(JarVerifier,InputStream,String)
+ * @see Manifest#getErrorPosition
+ */
+public class IncludeInExceptionsTest {
+
+    static final String FILENAME = "Unique-Filename-Expected-In_Msg.jar";
+
+    static final byte[] INVALID_MANIFEST = (
+            "Manifest-Version: 1.0\r\n" +
+            "\r\n" +
+            "Illegal\r\n" +
+            "\r\n").getBytes(UTF_8);
+
+    static String createJarInvalidManifest(String jar) throws IOException {
+        try (OutputStream out = Files.newOutputStream(Paths.get(jar));
+            JarOutputStream jos = new JarOutputStream(out)) {
+            JarEntry je = new JarEntry(JarFile.MANIFEST_NAME);
+            jos.putNextEntry(je);
+            jos.write(INVALID_MANIFEST);
+            jos.closeEntry();
+        }
+        return jar;
+    }
+
+    @ParameterizedTest
+    @MethodSource("manifests")
+    void testInvalidManifest(Callable<?> attempt) {
+        var ioException = assertThrows(IOException.class, attempt::call);
+        boolean foundFileName = ioException.getMessage().contains(FILENAME);
+        if (INCLUDE_JAR_NAME_IN_EXCEPTIONS && !foundFileName) {
+            fail("JAR file name expected but not found in error message");
+        } else if (foundFileName && !INCLUDE_JAR_NAME_IN_EXCEPTIONS) {
+            fail("JAR file name found but should not be in error message");
+        }
+    }
+
+    static Stream<Callable<?>> manifests() {
+        Callable<?> jarName = () -> new JarFile(createJarInvalidManifest(FILENAME)).getManifest();
+        Callable<?> jarNameVerify = () -> new JarFile(createJarInvalidManifest("Verifying-" + FILENAME),
+                true).getManifest();
+        return Stream.of(
+                jarName,
+                jarNameVerify
+        );
+    }
+}