github-advanced-security[bot] commented on code in PR #16543: URL: https://github.com/apache/lucene/pull/16543#discussion_r3828240538
########## build-tools/build-infra/src/main/java/org/apache/lucene/gradle/IntranetGradleSetup.java: ########## @@ -0,0 +1,494 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.lucene.gradle; + +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.io.Reader; +import java.lang.annotation.ElementType; +import java.lang.annotation.Retention; +import java.lang.annotation.RetentionPolicy; +import java.lang.annotation.Target; +import java.math.BigInteger; +import java.net.HttpURLConnection; +import java.net.URI; +import java.net.URISyntaxException; +import java.net.URLConnection; +import java.nio.channels.FileChannel; +import java.nio.channels.FileLock; +import java.nio.charset.StandardCharsets; +import java.nio.file.FileSystem; +import java.nio.file.FileSystems; +import java.nio.file.Files; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.nio.file.StandardCopyOption; +import java.nio.file.StandardOpenOption; +import java.nio.file.attribute.PosixFilePermissions; +import java.security.MessageDigest; +import java.util.Comparator; +import java.util.List; +import java.util.Locale; +import java.util.Properties; +import java.util.concurrent.TimeUnit; +import java.util.regex.Matcher; +import java.util.regex.Pattern; +import java.util.stream.Collectors; +import java.util.stream.Stream; + +/** + * Standalone class run by {@code gradlew}/{@code gradlew.bat} (before the gradle wrapper) when the + * {@value #WRAPPER_URL_ENV} and/or {@value #DISTRIBUTION_URL_ENV} environment variables are set. It + * supports environments that cannot reach GitHub and services.gradle.org by downloading: + * + * <ul> + * <li>{@code gradle-wrapper.jar} from {@value #WRAPPER_URL_ENV} into {@code gradle/wrapper/} + * (verified against the checksum in {@code gradle-wrapper.jar.sha256}, so that {@code + * WrapperDownloader} doesn't need to fetch it), + * <li>the gradle distribution from {@value #DISTRIBUTION_URL_ENV}, installing it in the gradle + * user home exactly where the gradle wrapper would install the "official" distribution (under + * the hash of the {@code distributionUrl} from {@code gradle-wrapper.properties}), so that + * the wrapper considers it already installed. + * </ul> + * + * <p>Both URLs may contain a {@code ${gradleVersion}} placeholder, replaced with the version parsed + * from {@code distributionUrl} in {@code gradle-wrapper.properties}. + * + * <p>Ensure this class has no dependencies outside of standard java libraries as it's run directly + * from source. It only uses JDK 11 language features and APIs so that it runs on any reasonably + * recent JDK (17+ is required by {@link #checkVersion()}; the actual build requires a newer one). + */ +public class IntranetGradleSetup { + /** + * Copied to keep the class isolated from any other classes. + * + * @see "https://github.com/apache/lucene/issues/15399"; + */ + @Retention(RetentionPolicy.CLASS) + @Target({ElementType.CONSTRUCTOR, ElementType.FIELD, ElementType.METHOD, ElementType.TYPE}) + private @interface SuppressForbidden { + /** A reason for suppressing should always be given. */ + String reason(); + } + + public static final String DISTRIBUTION_URL_ENV = "LUCENE_GRADLE_DISTRIBUTION_URL"; + public static final String WRAPPER_URL_ENV = "LUCENE_GRADLE_WRAPPER_URL"; + + private static final Pattern DISTRIBUTION_NAME = + Pattern.compile("gradle-(?<version>.+?)-(bin|all)\\.zip"); + private static final Pattern PLACEHOLDER = Pattern.compile("\\$\\{([^}]*)\\}"); + private static final boolean IS_WINDOWS = + System.getProperty("os.name").toLowerCase(Locale.ROOT).contains("windows"); + + private final Path projectDir; + private final Path gradleUserHome; + + public static void main(String[] args) { + if (args.length < 1) { + System.err.println("Usage: java IntranetGradleSetup.java <project dir> [gradle arguments]"); + System.exit(2); + } + + try { + checkVersion(); + new IntranetGradleSetup(Paths.get(args[0]), args).run(); + } catch (Exception e) { + System.err.println("ERROR: " + e.getMessage()); + System.exit(3); + } + } + + public static void checkVersion() { + int major = Runtime.version().feature(); + if (major < 17) { + throw new IllegalStateException("java version must be 17 or later, your version: " + major); + } + } + + IntranetGradleSetup(Path projectDir, String[] gradleArgs) { + this.projectDir = projectDir.toAbsolutePath().normalize(); + + // Gradle user home: -g/--gradle-user-home, GRADLE_USER_HOME or ~/.gradle. + String userHome = null; + for (int i = 1; i < gradleArgs.length; i++) { + String arg = gradleArgs[i]; + if ((arg.equals("-g") || arg.equals("--gradle-user-home")) && i + 1 < gradleArgs.length) { + userHome = gradleArgs[++i]; + } else if (arg.startsWith("--gradle-user-home=")) { + userHome = arg.substring("--gradle-user-home=".length()); + } + } + if (userHome == null) { + userHome = System.getenv("GRADLE_USER_HOME"); + } + this.gradleUserHome = + userHome != null + ? Paths.get(userHome) + : Paths.get(System.getProperty("user.home"), ".gradle"); + } + + void run() throws Exception { + Path wrapperDir = projectDir.resolve("gradle").resolve("wrapper"); + Path propertiesFile = wrapperDir.resolve("gradle-wrapper.properties"); + if (!Files.exists(propertiesFile)) { + throw new IOException("Wrapper property file not found: " + propertiesFile); + } + Properties props = new Properties(); + try (Reader reader = Files.newBufferedReader(propertiesFile, StandardCharsets.UTF_8)) { + props.load(reader); + } + String distributionUrl = props.getProperty("distributionUrl"); + if (distributionUrl == null) { + throw new IOException("No 'distributionUrl' in " + propertiesFile); + } + Matcher m = + DISTRIBUTION_NAME.matcher(distributionUrl.replaceAll("\\?.*", "").replaceAll(".*/", "")); + if (!m.matches()) { + throw new IOException( + "Could not parse the gradle version from distributionUrl in " + + propertiesFile + + ": " + + distributionUrl); + } + String gradleVersion = m.group("version"); + int timeout = Integer.parseInt(props.getProperty("networkTimeout", "10000").trim()); + + String wrapperUrl = expand(System.getenv(WRAPPER_URL_ENV), gradleVersion); + String mirrorDistributionUrl = expand(System.getenv(DISTRIBUTION_URL_ENV), gradleVersion); + + setupWrapperJar(wrapperDir, wrapperUrl, timeout); + if (mirrorDistributionUrl != null) { + setupDistribution(props, distributionUrl, mirrorDistributionUrl, gradleVersion, timeout); + } + } + + /** Replaces {@code ${gradleVersion}}; null/blank input yields null. */ + private static String expand(String template, String gradleVersion) throws IOException { + if (template == null || template.trim().isEmpty()) { + return null; + } + Matcher m = PLACEHOLDER.matcher(template.trim()); + StringBuilder sb = new StringBuilder(); + while (m.find()) { + if (!m.group(1).equals("gradleVersion")) { + throw new IOException( + "Unknown placeholder " + + m.group() + + " (only ${gradleVersion} is supported) in: " + + template); + } + m.appendReplacement(sb, Matcher.quoteReplacement(gradleVersion)); + } + return m.appendTail(sb).toString(); + } + + /** + * Makes sure gradle/wrapper/gradle-wrapper.jar is present and matches gradle-wrapper.jar.sha256, + * downloading it from the mirror if needed (otherwise WrapperDownloader would try GitHub). + */ + private void setupWrapperJar(Path wrapperDir, String wrapperUrl, int timeout) throws Exception { + Path jar = wrapperDir.resolve("gradle-wrapper.jar"); + Path checksumFile = wrapperDir.resolve("gradle-wrapper.jar.sha256"); + String expected = null; + for (String line : Files.readAllLines(checksumFile, StandardCharsets.UTF_8)) { + // sha256sum format: "<checksum> *gradle-wrapper.jar" ('*' marks binary mode). + String[] parts = line.trim().split("\\s+"); + if (parts.length == 2 && parts[1].replaceFirst("^\\*", "").equals("gradle-wrapper.jar")) { + expected = parts[0]; + } + } + if (expected == null) { + throw new IOException("No checksum for gradle-wrapper.jar in " + checksumFile); + } + + if (Files.exists(jar) && sha256(jar).equalsIgnoreCase(expected)) { + return; + } + if (wrapperUrl == null) { + log( + "WARNING: " + + jar + + " is missing or does not match " + + checksumFile + + " and " + + WRAPPER_URL_ENV + + " is not set; WrapperDownloader will try to fetch it from GitHub."); + return; + } + + log("Downloading gradle-wrapper.jar from " + wrapperUrl); + Path temp = Files.createTempFile(wrapperDir, ".gradle-wrapper", ".tmp"); + try { + download(new URI(wrapperUrl), temp, timeout); + String actual = sha256(temp); + if (!actual.equalsIgnoreCase(expected)) { + throw new IOException( + "The gradle-wrapper.jar downloaded from " + + wrapperUrl + + " does not match " + + checksumFile + + " (expected: " + + expected + + ", actual: " + + actual + + ")."); + } + Files.move(temp, jar, StandardCopyOption.REPLACE_EXISTING); + } finally { + Files.deleteIfExists(temp); + } + } + + /** + * Downloads the distribution from the mirror and installs it where the gradle wrapper would + * install the official one: {@code <base>/<path>/<name>/<md5 of the official url as base36>/}. + */ + private void setupDistribution( + Properties props, String distributionUrl, String mirrorUrl, String gradleVersion, int timeout) + throws Exception { + String expectedSha256 = props.getProperty("distributionSha256Sum"); + if (expectedSha256 == null || expectedSha256.trim().isEmpty()) { + throw new IOException( + "No 'distributionSha256Sum' in gradle-wrapper.properties; refusing to install a gradle" + + " distribution without checksum verification."); + } + expectedSha256 = expectedSha256.trim(); + + URI official = new URI(distributionUrl); + String zipName = official.getPath().replaceAll(".*/", ""); + String distName = zipName.replaceAll("\\.[^.]*$", ""); + String hash = + new BigInteger( + 1, + MessageDigest.getInstance("MD5") Review Comment: ## CodeQL / Use of a potentially broken or risky cryptographic algorithm Cryptographic algorithm [MD5](1) may not be secure. Consider using a different algorithm. [Show more details](https://github.com/apache/lucene/security/code-scanning/268) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
