google / log4jscanner

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.
Apache License 2.0
1.56k stars 121 forks source link

*: support self-executable JARs #22

Closed ericchiang closed 2 years ago

ericchiang commented 2 years ago

Add support for scanning and rewriting executable JARs, JARs that are essentially a concatenated bash script and ZIP archive.

https://kevinboone.me/execjava.html

Likely decreases the performance because we have to read the trailing header twice on non-JAR files. Will try to get some benchmarks.

Don't know how common these are, but there was some mention of them on reddit (see #21).

Fixes https://github.com/google/log4jscanner/issues/21 Ref https://github.com/golang/go/issues/10464