starred/pkl
1
0
Fork 0
mirror of https://github.com/apple/pkl.git synced 2026-01-19 01:47:24 +01:00
Code Issues 198 Packages Projects Releases 10 Wiki Activity

Allow jar:nested: URIs in default security manager (#895)

Browse Source 
Nested jars built by spring boot can possibly represent classpath
resource URIs as "jar:nested:".

This changes Pkl to by default trust them with the same level as
modulepath URIs.
This commit is contained in:
Daniel Chao
2025-01-22 06:42:47 -08:00
committed by GitHub
parent 75bd21420b
commit 257bd6f699
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkl-core/src/main/java/org/pkl/core/SecurityManagers.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
* Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -38,8 +38,10 @@ public final class SecurityManagers {
List.of(
Pattern.compile("repl:"),
Pattern.compile("file:"),
// for evaluating URLs returned by `Class(Loader).getResource()`
Pattern.compile("jar:file:"),
Pattern.compile("jar:nested:"),
Pattern.compile("modulepath:"),
Pattern.compile("https:"),
Pattern.compile("pkl:"),
@@ -78,9 +80,15 @@ public final class SecurityManagers {
return switch (uri.getScheme()) {
case "repl" -> 40;
case "file" -> uri.getHost() == null ? 30 : 10;
case "jar" ->
case "jar" -> {
if (uri.getSchemeSpecificPart().startsWith("nested:")) {
// treat jar:nested: URIs as same level as modulepath URIs
yield 20;
} else {
// use trust level of embedded URL
getDefaultTrustLevel(URI.create(uri.toString().substring(4)));
yield getDefaultTrustLevel(URI.create(uri.toString().substring(4)));
}
}
case "modulepath" -> 20;
case "pkl" -> 0;
default -> 10;