Two important changes:
1. Don't change the name of the code cache dir as that would leave a stale code
cache around on old installations that were using the code cache.
2. Don't create a native libs cache dir if there are no native resources.
Everything else is mostly cosmetic and organizational.
This feature makes use of the current caching system for "code" jars. Resources marked by nresource are copied to specific cache directories, unpacked, and then the caches are added to the applications java.library.path. This "native" cache is cleaned according to "cache_retention_days", similar to the code cache.
Cleans content of each found directory when unpacking a new java_vm.
Fixes the problem when java_wm was build using standard jar.
For pack200 this remains unresolved.
We were already doing this for bootstrap.properties-based launches, but there's
no reason to restrict it to that. If you run Getdown with an appbase and an
appdir, it can create the app dir and download the app into it.
This enables scenarios where getdown is installed to a shared location and
users that run the app install it in their private storage area (or on a
machine local file system, or who knows).
Closes#163.
- Max concurrent downloads is controlled by a config in getdown.txt:
max_concurrent_downloads. It defaults to two.
- A bunch of thread-safety problems were fixed.
- While in there, I revamped the downloader to be less crufty from years of
ad-hoc requirements accretion.
- I disabled the Channel.transferFrom based download change because it prevents
fine-grained feedback (and abort checking) from taking place, and it doesn't
handle failure cases. Maybe we'll clean it up and re-enable it in the future.
The new code is more careful about how it obtains config info, and issues
warnings when sources of info conflict. It does not abort in such circumstances
as Getdown's prime directive is to do the best it can to get the app updated
and launched. But the warnings will hopefully allow accidental conflicts to be
detected and avoided before being deployed to customers.
We also now allow bootstrap.properties to provide an appid; that matches what
was possible via system properties and command line arguments. We also avoid
"communicating" environment configuration through the Java system properties
mechanism. We now read from sysprops but do not write back to them.
Lastly, this includes some name tidying (like appdir -> appDir and
getAppdir -> getAppDir).
Apologies for messing with code after the fact, but some OOPisms are just too
much for me to stomach. This should just be a function of two arguments. No
objects required.
Yes, we're now reparsing the whitelist on every call, but this function is
called only a handful of times.
When a constructor calls an overridable function, it may allow an attacker to access the "this" reference prior to the object being fully initialized, which can in turn lead to a vulnerability.
Application -> getLocalPath
ProxyPanel -> get
AbortPanel -> get
RotatingBackgrounds -> makeEmpty
(Triggered by internal security audit and Fortify analysis.)
Allows users to build customized Getdown JARs which can only talk to whitelisted hosts. This can be useful for very security-conscious organizations which want to distribute Getdown internally as a standard application bootstrapping mechanism, but want to ensure that it can only be used for internal applications.
This is an adaptation of the whitelist proof-of-concept discussed on the mailing list, adjusted to use the new Build class.
(Triggered by internal security audit and Fortify analysis.)
Because we are running cmd.exe here, it is possible to use a malicious URL to execute arbitrary commands on the shell ( e.g. if url=http://my-patch-notes.com/" & del C:\ )
(Triggered by internal security audit and Fortify analysis.)
These types of denial of service issues are more common in web applications, but even here an attacker could tie up system resources indefinitely by specifying a very large start delay.
(Triggered by internal security audit and Fortify analysis.)
We can just keep Color in its ARGB format and have a single static brightness()
helper. Reactangle grew a union method which allows us to avoid AWT's Rectangle
entirely.
stringsToList() needed to return null for null array input, and I went ahead
and used Arrays.asList while I was in there because we know the provenance of
the input array, no one will mutate it.
Michael Bayne