Skip to content

Commit

Permalink
安全性升级
Browse files Browse the repository at this point in the history
  • Loading branch information
yangchangpei committed Dec 24, 2020
1 parent f54488c commit 7dc76e8
Show file tree
Hide file tree
Showing 5 changed files with 180 additions and 26 deletions.
6 changes: 4 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ JDK 1.7 +
<dependency>
<groupId>com.github.core-lib</groupId>
<artifactId>xjar</artifactId>
<version>4.0.1</version>
<version>4.0.2</version>
<!-- <scope>test</scope> -->
</dependency>
</dependencies>
Expand Down Expand Up @@ -188,7 +188,7 @@ xjar java --add-opens java.base/jdk.internal.loader=ALL-UNNAMED -jar /path/to/en
<plugin>
<groupId>com.github.core-lib</groupId>
<artifactId>xjar-maven-plugin</artifactId>
<version>4.0.1</version>
<version>4.0.2</version>
<executions>
<execution>
<goals>
Expand Down Expand Up @@ -262,6 +262,8 @@ mvn clean install -Dxjar.password=io.xjar -Dxjar.targetDir=/directory/to/save/ta
更多文档:[xjar-maven-plugin](https://github.com/core-lib/xjar-maven-plugin)

## 版本记录
* 4.0.2
1. 安全性升级
* 4.0.1
1. 兼容JDK-9及以上版本
* 4.0.0
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

<groupId>io.xjar</groupId>
<artifactId>xjar</artifactId>
<version>4.0.1</version>
<version>4.0.2</version>

<name>xjar</name>

Expand Down
51 changes: 28 additions & 23 deletions src/main/java/io/xjar/XGo.java
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@
import java.io.*;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

/**
Expand Down Expand Up @@ -34,31 +36,34 @@ public static void make(File xJar, XKey xKey) throws IOException {
variables.put("xKey.ivsize", convert(ivsize));
variables.put("xKey.password", convert(password));

URL url = XGo.class.getClassLoader().getResource("xjar/xjar.go");
if (url == null) {
throw new IOException("could not find xjar.go");
}
String dir = xJar.getParent();
File src = new File(dir, "xjar.go");
try (
InputStream in = url.openStream();
Reader reader = new InputStreamReader(in);
BufferedReader br = new BufferedReader(reader);
OutputStream out = new FileOutputStream(src);
Writer writer = new OutputStreamWriter(out);
BufferedWriter bw = new BufferedWriter(writer)
) {
String line;
while ((line = br.readLine()) != null) {
for (Map.Entry<String, String> variable : variables.entrySet()) {
line = line.replace("#{" + variable.getKey() + "}", variable.getValue());
List<String> templates = Arrays.asList("xjar.go", "xjar_agentable.go");
for (String template : templates) {
URL url = XGo.class.getClassLoader().getResource("xjar/" + template);
if (url == null) {
throw new IOException("could not find xjar/" + template + " in classpath");
}
String dir = xJar.getParent();
File src = new File(dir, template);
try (
InputStream in = url.openStream();
Reader reader = new InputStreamReader(in);
BufferedReader br = new BufferedReader(reader);
OutputStream out = new FileOutputStream(src);
Writer writer = new OutputStreamWriter(out);
BufferedWriter bw = new BufferedWriter(writer)
) {
String line;
while ((line = br.readLine()) != null) {
for (Map.Entry<String, String> variable : variables.entrySet()) {
line = line.replace("#{" + variable.getKey() + "}", variable.getValue());
}
bw.write(line);
bw.write(CLRF);
}
bw.write(line);
bw.write(CLRF);
bw.flush();
writer.flush();
out.flush();
}
bw.flush();
writer.flush();
out.flush();
}
}

Expand Down
13 changes: 13 additions & 0 deletions src/main/resources/xjar/xjar.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
"os"
"os/exec"
"path/filepath"
"strings"
)

var xJar = XJar{
Expand Down Expand Up @@ -55,6 +56,18 @@ func main() {
panic(errors.New("invalid jar with SHA-1"))
}

// check agent forbid
{
args := os.Args
l := len(args)
for i := 0; i < l; i++ {
arg := args[i]
if strings.HasPrefix(arg, "-javaagent:") {
panic(errors.New("agent forbidden"))
}
}
}

// start java application
java := os.Args[1]
args := os.Args[2:]
Expand Down
134 changes: 134 additions & 0 deletions src/main/resources/xjar/xjar_agentable.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,134 @@
package main

import (
"bytes"
"crypto/md5"
"crypto/sha1"
"errors"
"hash"
"io"
"os"
"os/exec"
"path/filepath"
)

var xJar = XJar{
md5: []byte{#{xJar.md5}},
sha1: []byte{#{xJar.sha1}},
}

var xKey = XKey{
algorithm: []byte{#{xKey.algorithm}},
keysize: []byte{#{xKey.keysize}},
ivsize: []byte{#{xKey.ivsize}},
password: []byte{#{xKey.password}},
}

func main() {
// search the jar to start
jar, err := JAR(os.Args)
if err != nil {
panic(err)
}

// parse jar name to absolute path
path, err := filepath.Abs(jar)
if err != nil {
panic(err)
}

// verify jar with MD5
MD5, err := MD5(path)
if err != nil {
panic(err)
}
if bytes.Compare(MD5, xJar.md5) != 0 {
panic(errors.New("invalid jar with MD5"))
}

// verify jar with SHA-1
SHA1, err := SHA1(path)
if err != nil {
panic(err)
}
if bytes.Compare(SHA1, xJar.sha1) != 0 {
panic(errors.New("invalid jar with SHA-1"))
}

// start java application
java := os.Args[1]
args := os.Args[2:]
key := bytes.Join([][]byte{
xKey.algorithm, {13, 10},
xKey.keysize, {13, 10},
xKey.ivsize, {13, 10},
xKey.password, {13, 10},
}, []byte{})
cmd := exec.Command(java, args...)
cmd.Stdin = bytes.NewReader(key)
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
err = cmd.Run()
if err != nil {
panic(err)
}
}

// find jar name from args
func JAR(args []string) (string, error) {
var jar string

l := len(args)
for i := 1; i < l-1; i++ {
arg := args[i]
if arg == "-jar" {
jar = args[i+1]
}
}

if jar == "" {
return "", errors.New("unspecified jar name")
}

return jar, nil
}

// calculate file's MD5
func MD5(path string) ([]byte, error) {
return HASH(path, md5.New())
}

// calculate file's SHA-1
func SHA1(path string) ([]byte, error) {
return HASH(path, sha1.New())
}

// calculate file's HASH value with specified HASH Algorithm
func HASH(path string, hash hash.Hash) ([]byte, error) {
file, err := os.Open(path)

if err != nil {
return nil, err
}

_, _err := io.Copy(hash, file)
if _err != nil {
return nil, _err
}

sum := hash.Sum(nil)

return sum, nil
}

type XJar struct {
md5 []byte
sha1 []byte
}

type XKey struct {
algorithm []byte
keysize []byte
ivsize []byte
password []byte
}

0 comments on commit 7dc76e8

Please sign in to comment.