Permissions not preserved in a JAR within a ZIP

logpresso / CVE-2021-44228-Scanner

Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228

Apache License 2.0

851 stars 174 forks source link

Permissions not preserved in a JAR within a ZIP #255

Open mrpegman opened 2 years ago

mrpegman commented 2 years ago

If you have a JAR with the targeted classes and that JAR is within a ZIP, then scanning the ZIP will remove permissions on the files within the JAR. This is a UNIX-only issue as far as I can tell. Opening up the JAR after scanning shows that the HOST OS was changed from UNIX to FAT and the UNIX-style permissions were stripped.

xeraph commented 2 years ago

You would have used fix option. Scanner does not modify any file while scanning.

mrpegman commented 2 years ago

The command that I ran was: java -jar esp.jar --scan-log4j1 --scan-zip --fix fsc.zip

The esp.jar is the logpresso JAR. The fsc.zip file contains a JAR which when it gets scanned has the UNIX file permissions removed.