fix: resource leaks, Zip Slip, process deadlock, and several medium-severity bugs - #276
Merged
Conversation
Agent-Logs-Url: https://github.com/microsphere-projects/microsphere-java/sessions/43b3b061-3f1c-40d4-ad76-5e234af35e41 Co-authored-by: mercyblitz <533114+mercyblitz@users.noreply.github.com>
…arEntry Agent-Logs-Url: https://github.com/microsphere-projects/microsphere-java/sessions/43b3b061-3f1c-40d4-ad76-5e234af35e41 Co-authored-by: mercyblitz <533114+mercyblitz@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
mercyblitz
May 25, 2026 12:02
View session
mercyblitz
marked this pull request as ready for review
May 25, 2026 12:07
…eamArtifactResourceResolver Agent-Logs-Url: https://github.com/microsphere-projects/microsphere-java/sessions/10a7a5c5-6aee-457c-ae4d-dfde02082f85 Co-authored-by: mercyblitz <533114+mercyblitz@users.noreply.github.com>
mercyblitz
approved these changes
May 25, 2026
Replace stream-based existence check with a non-IO check using FileObject.getLastModified(). Removes unused IOException import and avoids opening an InputStream (and related exception handling) to determine whether a resource exists, reducing I/O overhead.
Replace try-with-resources around toJarFile(url) with an explicit try/finally that calls IOUtils.close(jarFile). Add IOUtils and Objects.nonNull imports and remove the now-unused IOException import. This simplifies resource cleanup, delegates close/error handling to IOUtils, and keeps the null check explicit when determining if a file URL refers to a JarFile.
Refactor JarUtils: import IOUtils and use IOUtils.close to close JarFile in a finally block instead of try-with-resources when resolving a JarEntry, and use the SeparatorConstants.FILE_SEPARATOR constant when building target canonical paths. These changes standardize resource cleanup and separator usage across the codebase and add the necessary imports.
Replace the local variable name jarFile_ with jf in ClassUtils.java when opening the JarFile and passing it to INSTANCE.scan. This is a small refactor to simplify the local variable name and improve readability without changing behavior.
Replace the manual null-check and IllegalStateException throw with a call to io.microsphere.util.Assert.assertNotNull and add its static import. This simplifies the constructor by centralizing null validation while preserving the original error message about requiring a JDK.
Remove the unused import of io.microsphere.io.IOUtils from JarUtils.java to clean up code and eliminate a compiler/IDE warning. No functional changes were made.
Fix JarUtils logger reference and improve null-safety and diagnostics: import and use assertNotNull, add @Nonnull/@nullable annotations, document thrown NullPointerException, and add parameter null checks in extract/doExtract. Resolve and log invalid JAR/entry cases (guarded warn logs) and tidy minor formatting/comments. Update tests: expand LoggingTest value source and extend JarUtilsTest with cases for extraction success, null arguments, missing JAR file, and missing JAR entry.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
inputStream.readAllBytes()withIOUtils.toByteArray(inputStream)new ByteArrayInputStream(...)withnew FastByteArrayInputStream(...)