google / log4jscanner

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.
Apache License 2.0
1.57k stars 120 forks source link

Fix bug where directories inside rewritten jars had incorrect lengths #36

Closed ddworken closed 2 years ago

ddworken commented 2 years ago

Previously, when patching certain jars the length calculations were slightly off due to our usage of CreateRaw to create zip headers to represent empty directories. These slight errors don't seem to actually break the jars from java's perspective, java still opens them fine. But Finder on MacOS complains that they are invalid if someone tries to open them as a zip. Inspecting them with zipinfo -v shows a number of warnings along the lines of "There are an extra -2 bytes preceding this file".

This PR fixes this by using CreateHeader instead of CreateRaw. I also added tests to ensure that this corruption doesn't happen again.