search

cloudera / cloudera-scripts-for-log4j

Scripts for addressing log4j zero day security issue
Apache License 2.0
86 stars 68 forks source link

Iterator File List for JAR Files When Looking for Class #14

Open belugabehr opened 2 years ago

belugabehr commented 2 years ago

https://github.com/cloudera/cloudera-scripts-for-log4j/blob/7e3765001256abc3328018421850ff86a1f336f2/hdp_support_scripts/delete_jndi.sh#L31

I think it's more safe and proper to actually iterate the files in the JAR files instead of scanning through their binary contents:

 if unzip -l $jarfile | grep -q JndiLookup.class; then

Should also be faster than the current implementation because the unzip utility knows how to quickly find the class names within the ZIP file dictionary without having to scan/read the entire file.

jtran-cloudera commented 2 years ago

In testing, the grep was faster, but we will note the suggestion.