Name: el35337 Date: 07/28/2000


java.lang.jar.Manifest's "make72safe" method contains an insideous problem that only shows up for attributes that have 140 are broken into 3 or more lines. The current implementation allows the characters CR LF SPACE to be inserted in the middle of or immediately after the terminating CR LF for an attribute.

The attached example code shows a proper 72 character-safe manifest, and three problem manifests.

Problem manifest #1 occurs when make72safe inserts a CRLF-SPACE triad immediate _after_ the terminating CRLF for an attribute. As a result the manifest contains an illegal blank line and the following attribute has a space inserted before it as if it were a line continuation. This results in writing terminally broken manifest files.

Problem manifest #2 and #3 aren't as bad - they just showcase what happens when the CRLF-SPACE triad are inserted immediately before or in the middle of the existing CRLF line terminator. This results in an unnecessary but harmless empty continuation line.

-- TEST CODE --

  public static void main(String[] args) throws Exception {

    System.out.println("--- GOOD MANIFEST ---");
    Manifest m = new Manifest();
    m.getMainAttributes().put(Attributes.Name.MANIFEST_VERSION, "1.0");
    m.getMainAttributes().putValue("1", "This should be the Last line and a valid attribute");
    m.getMainAttributes().putValue("2", "This string has a large, but correctly handled number of characters in it... the wrapping logic is fine when it doesn't run into a CRLF pair at the wrong point.");
    m.write(System.out);
    System.out.flush();

    System.out.println("--- PROBLEM MANIFEST #1 ---");
    m.getMainAttributes().putValue("2", "This string has exactly the wrong number of characters in it... but it is only the second set of 70 that actually exposes the problem.");
    m.write(System.out);
    System.out.flush();

    System.out.println("--- PROBLEM MANIFEST #2 ---");
    m.getMainAttributes().putValue("2", "This string has exactly the wrong number of characters in it.... but it is only the second set of 70 that actually exposes the problem.");
    m.write(System.out);
    System.out.flush();

    System.out.println("--- PROBLEM MANIFEST #3 ---");
    m.getMainAttributes().putValue("2", "This string has exactly the wrong number of characters in it..... but it is only the second set of 70 that actually exposes the problem.");
    m.write(System.out);
    System.out.flush();
  }

-- PROBLEM METHOD --

    /**
     * Adds line breaks to enforce a maximum 72 bytes per line.
     */
    static void make72Safe(StringBuffer line) {
        int length = line.length();
        if (length > 72) {
            int index = 70;
            while (index - 1 < length) {
                line.insert(index, "\r\n ");
                index += 72;
                length += 3;
            }
        }
        return;
    }

-- PROPOSED FIX --

    /**
     * Adds line breaks to enforce a maximum 72 bytes per line.
     */
    static void make72Safe(StringBuffer line) {
        int length = line.length();
        int index = 70;
        while (index < length - 2) {
            line.insert(index, "\r\n ");
            index += 73;
            length += 3;
        }
        return;
    }
(Review ID: 106390)
======================================================================