From fdd767086ab6cc24bc0ee45f010c1872bb52dd3b Mon Sep 17 00:00:00 2001
From: Daniel Gredler <daniel.gredler@dhl.com>
Date: Thu, 13 Sep 2018 16:20:53 -0400
Subject: [PATCH] Avoid calling overridable function from constructor

When a constructor calls an overridable function, it may allow an attacker to access the "this" reference prior to the object being fully initialized, which can in turn lead to a vulnerability.

Application -> getLocalPath
ProxyPanel -> get
AbortPanel -> get
RotatingBackgrounds -> makeEmpty

(Triggered by internal security audit and Fortify analysis.)
---
 .../main/java/com/threerings/getdown/data/Application.java    | 2 +-
 .../main/java/com/threerings/getdown/launcher/AbortPanel.java | 4 ++--
 .../main/java/com/threerings/getdown/launcher/ProxyPanel.java | 2 +-
 .../com/threerings/getdown/launcher/RotatingBackgrounds.java  | 2 +-
 .../java/com/threerings/getdown/launcher/StatusPanel.java     | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/core/src/main/java/com/threerings/getdown/data/Application.java b/core/src/main/java/com/threerings/getdown/data/Application.java
index ef282d6..3cbf6af 100644
--- a/core/src/main/java/com/threerings/getdown/data/Application.java
+++ b/core/src/main/java/com/threerings/getdown/data/Application.java
@@ -36,7 +36,7 @@ import static java.nio.charset.StandardCharsets.UTF_8;
  * Parses and provide access to the information contained in the <code>getdown.txt</code>
  * configuration file.
  */
-public class Application
+public final class Application
 {
     /** The name of our configuration file. */
     public static final String CONFIG_FILE = "getdown.txt";
diff --git a/launcher/src/main/java/com/threerings/getdown/launcher/AbortPanel.java b/launcher/src/main/java/com/threerings/getdown/launcher/AbortPanel.java
index cd7d0e8..ff7fe68 100644
--- a/launcher/src/main/java/com/threerings/getdown/launcher/AbortPanel.java
+++ b/launcher/src/main/java/com/threerings/getdown/launcher/AbortPanel.java
@@ -28,14 +28,14 @@ import static com.threerings.getdown.Log.log;
 /**
  * Displays a confirmation that the user wants to abort installation.
  */
-public class AbortPanel extends JFrame
+public final class AbortPanel extends JFrame
     implements ActionListener
 {
     public AbortPanel (Getdown getdown, ResourceBundle msgs)
     {
         _getdown = getdown;
         _msgs = msgs;
- 
+
         setLayout(new VGroupLayout());
         setResizable(false);
         setTitle(get("m.abort_title"));
diff --git a/launcher/src/main/java/com/threerings/getdown/launcher/ProxyPanel.java b/launcher/src/main/java/com/threerings/getdown/launcher/ProxyPanel.java
index 7de1d0e..0982c15 100644
--- a/launcher/src/main/java/com/threerings/getdown/launcher/ProxyPanel.java
+++ b/launcher/src/main/java/com/threerings/getdown/launcher/ProxyPanel.java
@@ -30,7 +30,7 @@ import static com.threerings.getdown.Log.log;
  * Displays an interface with which the user can configure their proxy
  * settings.
  */
-public class ProxyPanel extends JPanel
+public final class ProxyPanel extends JPanel
     implements ActionListener
 {
     public ProxyPanel (Getdown getdown, ResourceBundle msgs)
diff --git a/launcher/src/main/java/com/threerings/getdown/launcher/RotatingBackgrounds.java b/launcher/src/main/java/com/threerings/getdown/launcher/RotatingBackgrounds.java
index 854b39c..ca14419 100644
--- a/launcher/src/main/java/com/threerings/getdown/launcher/RotatingBackgrounds.java
+++ b/launcher/src/main/java/com/threerings/getdown/launcher/RotatingBackgrounds.java
@@ -10,7 +10,7 @@ import java.util.List;
 
 import static com.threerings.getdown.Log.log;
 
-public class RotatingBackgrounds
+public final class RotatingBackgrounds
 {
     public interface ImageLoader {
         /** Loads and returns the image with the supplied path. */
diff --git a/launcher/src/main/java/com/threerings/getdown/launcher/StatusPanel.java b/launcher/src/main/java/com/threerings/getdown/launcher/StatusPanel.java
index e3574a2..cfaa21e 100644
--- a/launcher/src/main/java/com/threerings/getdown/launcher/StatusPanel.java
+++ b/launcher/src/main/java/com/threerings/getdown/launcher/StatusPanel.java
@@ -36,7 +36,7 @@ import static com.threerings.getdown.Log.log;
 /**
  * Displays download and patching status.
  */
-public class StatusPanel extends JComponent
+public final class StatusPanel extends JComponent
     implements ImageObserver
 {
     public StatusPanel (ResourceBundle msgs)