Merge pull request #461 from norrisjeremy/20231218

0.2.15 changes
mwiede · Dec 19, 2023 · 02f89c8 · 02f89c8
2 parents 5bd7509 + 646f622
commit 02f89c8
Show file tree

Hide file tree

Showing 33 changed files with 1,062 additions and 91 deletions.
diff --git a/pom.xml b/pom.xml
@@ -650,6 +650,19 @@
                     </excludes>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>de.thetaphi</groupId>
+                <artifactId>forbiddenapis</artifactId>
+                <version>3.6</version>
+                <configuration>
+                    <bundledSignatures>
+                        <bundledSignature>jdk-unsafe</bundledSignature>
+                        <bundledSignature>jdk-deprecated</bundledSignature>
+                        <bundledSignature>jdk-non-portable</bundledSignature>
+                        <bundledSignature>jdk-reflection</bundledSignature>
+                    </bundledSignatures>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
     <profiles>
@@ -805,5 +818,46 @@
                 </plugins>
             </build>
         </profile>
+        <profile>
+            <id>forbiddenapis</id>
+            <activation>
+                <jdk>[16,)</jdk>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>de.thetaphi</groupId>
+                        <artifactId>forbiddenapis</artifactId>
+                        <configuration>
+                            <releaseVersion>16</releaseVersion>
+                        </configuration>
+                        <executions>
+                            <execution>
+                                <id>check</id>
+                                <goals>
+                                    <goal>check</goal>
+                                </goals>
+                                <configuration>
+                                    <bundledSignatures combine.children="append">
+                                        <bundledSignature>jdk-system-out</bundledSignature>
+                                    </bundledSignatures>
+                                </configuration>
+                            </execution>
+                            <execution>
+                                <id>testCheck</id>
+                                <goals>
+                                    <goal>testCheck</goal>
+                                </goals>
+                                <configuration>
+                                    <bundledSignatures combine.children="append">
+                                        <bundledSignature>commons-io-unsafe-2.14.0</bundledSignature>
+                                    </bundledSignatures>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
     </profiles>
 </project>
diff --git a/src/main/java/com/jcraft/jsch/HostKey.java b/src/main/java/com/jcraft/jsch/HostKey.java
@@ -26,6 +26,8 @@
 
 package com.jcraft.jsch;
 
+import java.util.Locale;
+
 public class HostKey {
 
   private static final byte[][] names =
@@ -118,7 +120,7 @@ public String getKey() {
   public String getFingerPrint(JSch jsch) {
     HASH hash = null;
     try {
-      String _c = JSch.getConfig("FingerprintHash").toLowerCase();
+      String _c = JSch.getConfig("FingerprintHash").toLowerCase(Locale.ROOT);
       Class<? extends HASH> c = Class.forName(JSch.getConfig(_c)).asSubclass(HASH.class);
       hash = c.getDeclaredConstructor().newInstance();
     } catch (Exception e) {

diff --git a/src/main/java/com/jcraft/jsch/JSch.java b/src/main/java/com/jcraft/jsch/JSch.java
@@ -45,8 +45,12 @@ public class JSch {
         "ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256"));
     config.put("prefer_known_host_key_types",
         Util.getSystemProperty("jsch.prefer_known_host_key_types", "yes"));
+    config.put("enable_strict_kex", Util.getSystemProperty("jsch.enable_strict_kex", "yes"));
+    config.put("require_strict_kex", Util.getSystemProperty("jsch.require_strict_kex", "no"));
     config.put("enable_server_sig_algs",
         Util.getSystemProperty("jsch.enable_server_sig_algs", "yes"));
+    config.put("enable_ext_info_in_auth",
+        Util.getSystemProperty("jsch.enable_ext_info_in_auth", "yes"));
     config.put("cipher.s2c", Util.getSystemProperty("jsch.cipher",
         "aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com"));
     config.put("cipher.c2s", Util.getSystemProperty("jsch.cipher",

diff --git a/src/main/java/com/jcraft/jsch/JSchAlgoNegoFailException.java b/src/main/java/com/jcraft/jsch/JSchAlgoNegoFailException.java
@@ -1,5 +1,7 @@
 package com.jcraft.jsch;
 
+import java.util.Locale;
+
 /**
  * Extension of {@link JSchException} to indicate when a connection fails during algorithm
  * negotiation.
@@ -35,7 +37,7 @@ public String getServerProposal() {
   }
 
   private static String failString(int algorithmIndex, String jschProposal, String serverProposal) {
-    return String.format(
+    return String.format(Locale.ROOT,
         "Algorithm negotiation fail: algorithmName=\"%s\" jschProposal=\"%s\" serverProposal=\"%s\"",
         algorithmNameFromIndex(algorithmIndex), jschProposal, serverProposal);
   }

diff --git a/src/main/java/com/jcraft/jsch/JSchStrictKexException.java b/src/main/java/com/jcraft/jsch/JSchStrictKexException.java
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2002-2018 ymnk, JCraft,Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without modification, are permitted
+ * provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this list of conditions
+ * and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice, this list of
+ * conditions and the following disclaimer in the documentation and/or other materials provided with
+ * the distribution.
+ *
+ * 3. The names of the authors may not be used to endorse or promote products derived from this
+ * software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL JCRAFT, INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+package com.jcraft.jsch;
+
+public class JSchStrictKexException extends JSchException {
+  private static final long serialVersionUID = -1L;
+
+  JSchStrictKexException() {
+    super();
+  }
+
+  JSchStrictKexException(String s) {
+    super(s);
+  }
+}
diff --git a/src/main/java/com/jcraft/jsch/KeyExchange.java b/src/main/java/com/jcraft/jsch/KeyExchange.java
@@ -26,6 +26,8 @@
 
 package com.jcraft.jsch;
 
+import java.util.Locale;
+
 public abstract class KeyExchange {
 
   static final int PROPOSAL_KEX_ALGS = 0;
@@ -198,7 +200,7 @@ protected static String[] guess(Session session, byte[] I_S, byte[] I_C) throws
   public String getFingerPrint() {
     HASH hash = null;
     try {
-      String _c = session.getConfig("FingerprintHash").toLowerCase();
+      String _c = session.getConfig("FingerprintHash").toLowerCase(Locale.ROOT);
       Class<? extends HASH> c = Class.forName(session.getConfig(_c)).asSubclass(HASH.class);
       hash = c.getDeclaredConstructor().newInstance();
     } catch (Exception e) {

diff --git a/src/main/java/com/jcraft/jsch/OpenSSHConfig.java b/src/main/java/com/jcraft/jsch/OpenSSHConfig.java
@@ -36,6 +36,7 @@
 import java.util.Arrays;
 import java.util.Hashtable;
 import java.util.List;
+import java.util.Locale;
 import java.util.Set;
 import java.util.Vector;
 import java.util.stream.Collectors;
@@ -75,9 +76,10 @@
  */
 public class OpenSSHConfig implements ConfigRepository {
 
-  private static final Set<String> keysWithListAdoption =
-      Stream.of("KexAlgorithms", "Ciphers", "HostKeyAlgorithms", "MACs", "PubkeyAcceptedAlgorithms",
-          "PubkeyAcceptedKeyTypes").map(String::toUpperCase).collect(Collectors.toSet());
+  private static final Set<String> keysWithListAdoption = Stream
+      .of("KexAlgorithms", "Ciphers", "HostKeyAlgorithms", "MACs", "PubkeyAcceptedAlgorithms",
+          "PubkeyAcceptedKeyTypes")
+      .map(string -> string.toUpperCase(Locale.ROOT)).collect(Collectors.toSet());
 
   /**
    * Parses the given string, and returns an instance of ConfigRepository.
@@ -209,13 +211,13 @@ private String find(String key) {
       if (keymap.get(key) != null) {
         key = keymap.get(key);
       }
-      key = key.toUpperCase();
+      key = key.toUpperCase(Locale.ROOT);
       String value = null;
       for (int i = 0; i < _configs.size(); i++) {
         Vector<String[]> v = _configs.elementAt(i);
         for (int j = 0; j < v.size(); j++) {
           String[] kv = v.elementAt(j);
-          if (kv[0].toUpperCase().equals(key)) {
+          if (kv[0].toUpperCase(Locale.ROOT).equals(key)) {
             value = kv[1];
             break;
           }
@@ -255,13 +257,13 @@ private String find(String key) {
     }
 
     private String[] multiFind(String key) {
-      key = key.toUpperCase();
+      key = key.toUpperCase(Locale.ROOT);
       Vector<String> value = new Vector<>();
       for (int i = 0; i < _configs.size(); i++) {
         Vector<String[]> v = _configs.elementAt(i);
         for (int j = 0; j < v.size(); j++) {
           String[] kv = v.elementAt(j);
-          if (kv[0].toUpperCase().equals(key)) {
+          if (kv[0].toUpperCase(Locale.ROOT).equals(key)) {
             String foo = kv[1];
             if (foo != null) {
               value.remove(foo);

diff --git a/src/main/java/com/jcraft/jsch/PageantConnector.java b/src/main/java/com/jcraft/jsch/PageantConnector.java
@@ -40,6 +40,7 @@
 import com.sun.jna.platform.win32.WinNT.HANDLE;
 import com.sun.jna.platform.win32.WinUser;
 import com.sun.jna.platform.win32.WinUser.COPYDATASTRUCT;
+import java.util.Locale;
 
 public class PageantConnector implements AgentConnector {
 
@@ -84,7 +85,8 @@ public void query(Buffer buffer) throws AgentProxyException {
       throw new AgentProxyException("Pageant is not runnning.");
     }
 
-    String mapname = String.format("PageantRequest%08x", kernel32.GetCurrentThreadId());
+    String mapname =
+        String.format(Locale.ROOT, "PageantRequest%08x", kernel32.GetCurrentThreadId());
 
     HANDLE sharedFile = null;
     Pointer sharedMemory = null;