Skip to content

Bump org.ops4j.pax.url:pax-url-aether from 2.6.1 to 2.6.14#798

Merged
lukehutch merged 1 commit into
latestfrom
dependabot/maven/org.ops4j.pax.url-pax-url-aether-2.6.14
Mar 4, 2024
Merged

Bump org.ops4j.pax.url:pax-url-aether from 2.6.1 to 2.6.14#798
lukehutch merged 1 commit into
latestfrom
dependabot/maven/org.ops4j.pax.url-pax-url-aether-2.6.14

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2023

Copy link
Copy Markdown
Contributor

Bumps org.ops4j.pax.url:pax-url-aether from 2.6.1 to 2.6.14.

Commits
  • 5c29463 [maven-release-plugin] prepare release url-2.6.14
  • 5787768 [build] Use SSH connection for GitHub
  • 93ae0d1 Merge pull request #422 from cstamas/compiler-fix
  • 0df5985 fix for compiler
  • 046d8e4 Merge pull request #420 from cstamas/update-build-plugins
  • 0acfe0d Update build plugins
  • 7cfacb1 [Fixes #419] Reject webbundle: URIs without Web-ContextPath for non-bundles
  • fb36ebd [Fixes #418] Do not modify any manifest headers except Web-ContextPath for ex...
  • f9115c9 [versions] Set versions of inactive projects o 2.6.14-SNAPSHOT
  • 7b37632 Revert "[build] Use SSH connection for GitHub"
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [org.ops4j.pax.url:pax-url-aether](https://github.com/ops4j/org.ops4j.pax.url) from 2.6.1 to 2.6.14.
- [Commits](ops4j/org.ops4j.pax.url@url-2.6.1...url-2.6.14)

---
updated-dependencies:
- dependency-name: org.ops4j.pax.url:pax-url-aether
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Oct 16, 2023
jwachter added a commit to jwachter/classgraph that referenced this pull request Nov 2, 2023
With nested jars there are two different mechanisms that will be
used as the path is not usable as a `java.nio.file.Path` instance.

The first is trying to convert the resulting nested path - a path
like `jar:file:....!/some/nested/path` - to a `URL` and if that should
fail due to a `MalformedURLException` it is tried to convert
the path to `URI`. If the URI fallback fails an IOException will
be thrown and this eventually will bubble up and discard the whole
classpath entry, resulting in a message like the following when
enabling verbose output during scanning:

```
2023-11-02T12:51:42.719+0100	ClassGraph	-- Skipping invalid classpath entry .../spring-boot-fully-executable-jar.jar!/BOOT-INF/lib/... : java.io.IOException: Malformed URI: ...
```

Most of the time nothing will be discarded as most paths can be converted
to a URL in the first step or at least succeed when converting to a URI.

However for paths containing spaces and the hash symbol we can reach a
case where both URL conversion and URI conversion fail and so the
classpath entry is discarded even though all paths are valid and can
be usable.

Let us assume a Spring Boot Executable JAR that is located in a directory
named `ci-build main classgraph#123` - which is a valid directory name on Windows
and Linux.

When ClassGraph reaches a nested library here it will construct the
paths to the nested jars like `jar:file:<path>!/<nested-path>`.

So in this case we end up with something like `jar:file:/opt/ci-build main classgraph#123!/BOOT-INF/lib/my-lib.jar`.

When ClassGraph reaches the conversion code it will first try to convert
to a URL. This will fail with the following message:

`java.net.MalformedURLException: no !/ in spec`

If we then fallback to the URI conversion it will try to convert but as
our path contains spaces this will also be rejected by an exception:

`java.net.URISyntaxException: Illegal character in opaque part at index 66: jar:file:...`

The index will point to the first space in the path that is converted.

So we can construct nested paths that are neither valid `URL` instances
nor valid `URI instances`.

To solve this issue we introduce encoding for spaces when the path
is handled as a url or multi-section path to ensure that conversion
can succeed. This seems to also be what the `java.nio.file.Path` API
does when asking for the resulting URI for the same path.

So this commit encodes spaces as `%20` and hash symbols as `%23` when
going into the URL/Multi-Section branch.

Fixes classgraph#798
jwachter added a commit to jwachter/classgraph that referenced this pull request Nov 2, 2023
With nested jars there are two different mechanisms that will be
used as the path is not usable as a `java.nio.file.Path` instance.

The first is trying to convert the resulting nested path - a path
like `jar:file:....!/some/nested/path` - to a `URL` and if that should
fail due to a `MalformedURLException` it is tried to convert
the path to `URI`. If the URI fallback fails an IOException will
be thrown and this eventually will bubble up and discard the whole
classpath entry, resulting in a message like the following when
enabling verbose output during scanning:

```
2023-11-02T12:51:42.719+0100	ClassGraph	-- Skipping invalid classpath entry .../spring-boot-fully-executable-jar.jar!/BOOT-INF/lib/... : java.io.IOException: Malformed URI: ...
```

Most of the time nothing will be discarded as most paths can be converted
to a URL in the first step or at least succeed when converting to a URI.

However for paths containing spaces and the hash symbol we can reach a
case where both URL conversion and URI conversion fail and so the
classpath entry is discarded even though all paths are valid and can
be usable.

Let us assume a Spring Boot Executable JAR that is located in a directory
named `ci-build main classgraph#123` - which is a valid directory name on Windows
and Linux.

When ClassGraph reaches a nested library here it will construct the
paths to the nested jars like `jar:file:<path>!/<nested-path>`.

So in this case we end up with something like `jar:file:/opt/ci-build main classgraph#123!/BOOT-INF/lib/my-lib.jar`.

When ClassGraph reaches the conversion code it will first try to convert
to a URL. This will fail with the following message:

`java.net.MalformedURLException: no !/ in spec`

If we then fallback to the URI conversion it will try to convert but as
our path contains spaces this will also be rejected by an exception:

`java.net.URISyntaxException: Illegal character in opaque part at index 66: jar:file:...`

The index will point to the first space in the path that is converted.

So we can construct nested paths that are neither valid `URL` instances
nor valid `URI instances`.

To solve this issue we introduce encoding for spaces when the path
is handled as a url or multi-section path to ensure that conversion
can succeed. This seems to also be what the `java.nio.file.Path` API
does when asking for the resulting URI for the same path.

So this commit encodes spaces as `%20` and hash symbols as `%23` when
going into the URL/Multi-Section branch.

Fixes classgraph#798
@lukehutch lukehutch merged commit 50356ec into latest Mar 4, 2024
@dependabot dependabot Bot deleted the dependabot/maven/org.ops4j.pax.url-pax-url-aether-2.6.14 branch March 4, 2024 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant