From b002674bc37a3d8575d6b1d96cdd020d18c0d708 Mon Sep 17 00:00:00 2001
From: Serban Iordache <iordache@hotmail.com>
Date: Mon, 20 Aug 2018 21:29:40 +0200
Subject: [PATCH] validate package names

---
 .../org/beryx/jlink/impl/JlinkTaskImpl.groovy | 27 +++++++++++---
 .../org/beryx/jlink/JlinkTaskImplSpec.groovy  | 37 +++++++++++++++++++
 2 files changed, 58 insertions(+), 6 deletions(-)
 create mode 100644 src/test/groovy/org/beryx/jlink/JlinkTaskImplSpec.groovy

diff --git a/src/main/groovy/org/beryx/jlink/impl/JlinkTaskImpl.groovy b/src/main/groovy/org/beryx/jlink/impl/JlinkTaskImpl.groovy
index b397cc0b..8ab05dd8 100644
--- a/src/main/groovy/org/beryx/jlink/impl/JlinkTaskImpl.groovy
+++ b/src/main/groovy/org/beryx/jlink/impl/JlinkTaskImpl.groovy
@@ -144,12 +144,8 @@ class JlinkTaskImpl {
     File genDummyModuleInfo(File jarFile, File targetDir) {
         def packages = new TreeSet<String>()
         new ZipFile(jarFile).entries().each { entry ->
-            if(!entry.name.contains('META-INF') && entry.name.endsWith('.class')) {
-                int pos = entry.name.lastIndexOf('/')
-                if(pos > 0) {
-                    packages << entry.name.substring(0, pos).replace('/', '.')
-                }
-            }
+            def pkgName = getPackage(entry.name)
+            if(pkgName) packages << pkgName
         }
         def moduleName = getModuleName(jarFile)
         def modinfoDir = new File(targetDir, moduleName)
@@ -164,6 +160,25 @@ class JlinkTaskImpl {
         modinfoDir
     }
 
+    static String getPackage(String entryName) {
+        if(!entryName.endsWith('.class')) return null;
+        int pos = entryName.lastIndexOf('/')
+        if(pos <= 0) return null
+        def pkgName = entryName.substring(0, pos).replace('/', '.')
+        boolean valid = pkgName.split('\\.').every {isValidIdentifier(it)}
+        return valid ? pkgName : null
+    }
+
+    static boolean isValidIdentifier(String name) {
+        if (!name) return false
+        if (!Character.isJavaIdentifierStart(name.charAt(0))) return false
+        for (int i = 1; i < name.length(); i++) {
+            if (!Character.isJavaIdentifierPart(name.charAt(i))) return false
+        }
+        true
+    }
+
+
     def copyRuntimeJars(DependencyManager depMgr) {
         project.delete(jlinkJarsDirPath, nonModularJarsDirPath)
         project.logger.info("Copying modular jars required by non-modular jars to ${jlinkJarsDirPath}...")
diff --git a/src/test/groovy/org/beryx/jlink/JlinkTaskImplSpec.groovy b/src/test/groovy/org/beryx/jlink/JlinkTaskImplSpec.groovy
new file mode 100644
index 00000000..36205777
--- /dev/null
+++ b/src/test/groovy/org/beryx/jlink/JlinkTaskImplSpec.groovy
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.beryx.jlink
+
+import org.beryx.jlink.impl.JlinkTaskImpl
+import spock.lang.Specification
+import spock.lang.Unroll
+
+class JlinkTaskImplSpec extends Specification {
+    @Unroll
+    def "should get package #pkgName from jar entry #entry"() {
+        expect:
+        JlinkTaskImpl.getPackage(entry) == pkgName
+
+        where:
+        entry                            | pkgName
+        'App.class'                      | null
+        'org/App.class'                  | 'org'
+        'org/example/App.class'          | 'org.example'
+        'org/example-bad/App.class'      | null
+        'org/example/info.txt'           | null
+        'META-INF/org/example/App.class' | null
+    }
+}