root
/
spring-boot
mirror of https://github.com/spring-projects/spring-boot.git
1
0
Fork 0
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Fix "signer information does not match" error 

Update ExecutableArchiveLauncher so that `-cp` URLs are not added
when they are already contained as nested JARs. This prevents a
SecurityException "signer information does not match error" when using
signed jars. The root cause of the issue was that the primary JAR file
was on the default classpath with the URL "file:....jar" and in the
main URL set as "jar:file:....jar". It is now filtered so that only
the "jar:" variant is added.

Fixes gh-1134
This commit is contained in:
Phillip Webb 2014-06-24 11:21:32 -07:00
parent 1f1a7e0ed3
commit 60ef031f78
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
spring-boot-tools/spring-boot-loader/src/main/java/org/springframework/boot/loader/ExecutableArchiveLauncher.java
View File

@ -30,7 +30,7 @@ import org.springframework.boot.loader.archive.Archive.EntryFilter;
/**
* Base class for executable archive {@link Launcher}s.
*
*
* @author Phillip Webb
* @author Andy Wilkinson
*/
@ -78,11 +78,11 @@ public abstract class ExecutableArchiveLauncher extends Launcher {
@Override
protected ClassLoader createClassLoader(URL[] urls) throws Exception {
Set<URL> copy = new LinkedHashSet<URL>();
Set<URL> copy = new LinkedHashSet<URL>(urls.length);
ClassLoader loader = getDefaultClassLoader();
if (loader instanceof URLClassLoader) {
for (URL url : ((URLClassLoader) loader).getURLs()) {
if (!this.javaAgentDetector.isJavaAgentJar(url)) {
if (addDefaultClassloaderUrl(urls, url)) {
copy.add(url);
}
}
@ -93,6 +93,16 @@ public abstract class ExecutableArchiveLauncher extends Launcher {
return super.createClassLoader(copy.toArray(new URL[copy.size()]));
}
private boolean addDefaultClassloaderUrl(URL[] urls, URL url) {
String jarUrl = "jar:" + url + "!/";
for (URL nestedUrl : urls) {
if (nestedUrl.equals(url) || nestedUrl.toString().equals(jarUrl)) {
return false;
}
}
return !this.javaAgentDetector.isJavaAgentJar(url);
}
/**
* Determine if the specified {@link JarEntry} is a nested item that should be added
* to the classpath. The method is called once for each entry.