768872 - jar: allows Java to read arbitrary ZIP files across origins (including ODT files)

Status: RESOLVED WONTFIX

(Plugins Graveyard :: Java (Oracle), defect)

Description

[Frederik Braun [:freddy]]

Attachment: Proof of Concept

I just fund a way to read arbitrary ZIP files on other origins. This includes listing the files contained in the ZIP as well as their content.
Since other file formats build on ZIPs, we can read .odt and .docx files as well.

Because of LiveConnect, my PoC requires Java. It has been tested with Java7 Update 5 on a Windows 7 x64 virtual machine.

Comment 1

[Daniel Veditz [:dveditz]]

Does this actually work on the web? If you run this from a file:/// URI then java seems to think all "no host" urls are "local", and jar:scheme: looks like no host to them. WIll try it after this mtg.

Fixed in Firefox 15 by bug 748343 (removal of window.java and window.Package)

Comment 2

[Daniel Veditz [:dveditz]]

It *does* work from the web... I find this surprising. What else is broken?.

Comment 3

[Daniel Veditz [:dveditz]]

Does this work within an applet? It's java making the connection and supposedly validating the origins. If they're not validating the net origin can LiveConnect be used in this way to read local files as well?

Comment 4

[Frederik Braun [:freddy]]

I didn't get it to read file:// URIs, I think there's some java.security.manager or java.lang.SecurityManager in the way. My java is a little rusty. Me not getting it to work does not mean it's impossible ;)

*But* here's the big news:
The bug triggers in applets. Confirmed with IE, Opera, Chrome, Firefox..

Comment 5

[Daniel Veditz [:dveditz]]

If you have this already compiled to an applet it'd be handy to upload the testcase.

Comment 6

[Frederik Braun [:freddy]]

Attachment: Proof of Concept Applet

just wrap in applet tag. make width and height a few hundred pixels each..

Comment 7

[Frederik Braun [:freddy]]

Applet added. Oracle is going to be notified of this..

Comment 8

[Daniel Veditz [:dveditz]]

(In reply to Frederik Braun [:freddyb] from comment #7)
> Applet added. Oracle is going to be notified of this..

Did they respond or give you any kind of tracking number?

Comment 9

[Frederik Braun [:freddy]]

Sorry,

Tracking #:    S0191404
Description:   ORACLE JAVA JRE 7U5 SOP BYPASS FOR ZIP-BASED FILETYPES
Status:        Under investigation / Being fixed in main codeline

Comment 10

[Frederik Braun [:freddy]]

This is fixed with Java JRE 7 Update 9.
Resolved/Fixed?

Comment 11

[Frederik Braun [:freddy]]

My bad, I just worked through my Proof Of Concept again and it still works.
Status is still "Under investigation / Being fixed in main codeline" from Oracle's side.

Comment 12

[Frederik Braun [:freddy]]

Tracking #:    S0191404
Description:   ORACLE JAVA JRE 7U5 SOPBYPASS FOR ZIP-BASED FILETYPES
Status:        Issue fixed in main codeline, scheduled for a future CPU

Comment 13

[Al Billings [:abillings - ex-MoCo]]

Resolving fixed based on comment 10.

Comment 14

[Al Billings [:abillings - ex-MoCo]]

Will be fixed by Oracle update on conversation with Freddy.

Comment 15

[David Lawrence [:dkl]]

Removing employee no longer with company from CC list of private bugs.