Check for suspicious gradle-wrapper.jar

org.eclipse.jdt.ls.core/META-INF/MANIFEST.MF

@@ -37,7 +37,6 @@ Export-Package: org.eclipse.jdt.ls.core.internal;x-friends:="org.eclipse.jdt.ls.
  org.eclipse.jdt.ls.core.internal.commands;x-friends:="org.eclipse.jdt.ls.tests",
  org.eclipse.jdt.ls.core.internal.contentassist;x-friends:="org.eclipse.jdt.ls.tests",
  org.eclipse.jdt.ls.core.internal.corext.codemanipulation;x-friends:="org.eclipse.jdt.ls.tests",
- org.eclipse.jdt.ls.core.internal.corext.template.java;x-friends:="org.eclipse.jdt.ls.tests",
  org.eclipse.jdt.ls.core.internal.corext.dom;x-internal:=true,
  org.eclipse.jdt.ls.core.internal.corext.refactoring;x-internal:=true,
  org.eclipse.jdt.ls.core.internal.corext.refactoring.changes;x-internal:=true,
@@ -46,6 +45,7 @@ Export-Package: org.eclipse.jdt.ls.core.internal;x-friends:="org.eclipse.jdt.ls.
  org.eclipse.jdt.ls.core.internal.corext.refactoring.reorg;x-internal:=true,
  org.eclipse.jdt.ls.core.internal.corext.refactoring.tagging;x-internal:=true,
  org.eclipse.jdt.ls.core.internal.corext.refactoring.util;x-internal:=true,
+ org.eclipse.jdt.ls.core.internal.corext.template.java;x-friends:="org.eclipse.jdt.ls.tests",
  org.eclipse.jdt.ls.core.internal.corext.util;x-internal:=true,
  org.eclipse.jdt.ls.core.internal.corrections;x-internal:=true,
  org.eclipse.jdt.ls.core.internal.corrections.proposals;x-internal:=true,
@@ -56,9 +56,10 @@ Export-Package: org.eclipse.jdt.ls.core.internal;x-friends:="org.eclipse.jdt.ls.
  org.eclipse.jdt.ls.core.internal.lsp;x-friends:="org.eclipse.jdt.ls.tests",
  org.eclipse.jdt.ls.core.internal.managers;x-friends:="org.eclipse.jdt.ls.tests,org.eclipse.jdt.ls.tests.syntaxserver",
  org.eclipse.jdt.ls.core.internal.preferences;x-friends:="org.eclipse.jdt.ls.tests,org.eclipse.jdt.ls.tests.syntaxserver",
+ org.eclipse.jdt.ls.core.internal.semantictokens;x-friends:="org.eclipse.jdt.ls.tests",
  org.eclipse.jdt.ls.core.internal.syntaxserver;x-friends:="org.eclipse.jdt.ls.tests.syntaxserver",
  org.eclipse.jdt.ls.core.internal.text.correction;x-friends:="org.eclipse.jdt.ls.tests",
- org.eclipse.jdt.ls.core.internal.semantictokens;x-friends:="org.eclipse.jdt.ls.tests"
+ org.eclipse.jdt.ls.internal.gradle.checksums;x-friends:="org.eclipse.jdt.ls.tests"
 Bundle-ClassPath: lib/jsoup-1.9.2.jar,
  lib/remark-1.2.0.jar,
  .

org.eclipse.jdt.ls.core/src/org/eclipse/jdt/ls/core/internal/ExceptionFactory.java

@@ -0,0 +1,36 @@
+/*******************************************************************************
+ * Copyright (c) 2020 Red Hat Inc. and others.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License 2.0
+ * which accompanies this distribution, and is available at
+ * https://www.eclipse.org/legal/epl-2.0/
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *
+ * Contributors:
+ * Red Hat Inc. - initial API and implementation
+ *******************************************************************************/
+package org.eclipse.jdt.ls.core.internal;
+
+import org.eclipse.core.runtime.CoreException;
+
+/**
+ *
+ * @author snjeza
+ *
+ */
+public class ExceptionFactory {
+
+ private ExceptionFactory() {
+ }
+
+ public static CoreException newException(String message) {
+ return new CoreException(StatusFactory.newErrorStatus(message));
+ }
+
+ public static CoreException newException(Throwable e) {
+ return new CoreException(StatusFactory.newErrorStatus(e.getMessage(), e));
+ }
+
+}
+

org.eclipse.jdt.ls.core/src/org/eclipse/jdt/ls/core/internal/JobHelpers.java

@@ -210,6 +210,10 @@ public static void waitForJobs(String jobFamily, IProgressMonitor monitor) {
  }
  }
 
+ public static void waitForLoadingGradleVersionJob() {
+ waitForJobs(LoadingGradleVersionJobMatcher.INSTANCE, MAX_TIME_MILLIS);
+ }
+
  interface IJobMatcher {
 
  boolean matches(Job job);
@@ -239,6 +243,17 @@ public boolean matches(Job job) {
 
  }
 
+ static class LoadingGradleVersionJobMatcher implements IJobMatcher {
+
+ public static final IJobMatcher INSTANCE = new LoadingGradleVersionJobMatcher();
+
+ @Override
+ public boolean matches(Job job) {
+ return job.getClass().getName().matches("org.eclipse.buildship.core.internal.util.gradle.PublishedGradleVersionsWrapper.LoadVersionsJob");
+ }
+
+ }
+
  static class DownloadSourcesJobMatcher implements IJobMatcher {
 
  public static final IJobMatcher INSTANCE = new DownloadSourcesJobMatcher();

org.eclipse.jdt.ls.core/src/org/eclipse/jdt/ls/core/internal/managers/GradleBuildSupport.java

@@ -14,6 +14,7 @@
 
 import java.io.File;
 import java.nio.file.Paths;
+import java.util.Optional;
 
 import org.eclipse.buildship.core.BuildConfiguration;
 import org.eclipse.buildship.core.GradleBuild;
@@ -56,10 +57,17 @@ public void update(IProject project, boolean force, IProgressMonitor monitor) th
  return;
  }
  JavaLanguageServerPlugin.logInfo("Starting Gradle update for " + project.getName());
- String projectPath = project.getLocation().toFile().getAbsolutePath();
- BuildConfiguration buildConfiguration = GradleProjectImporter.getBuildConfiguration(Paths.get(projectPath));
- GradleBuild build = GradleCore.getWorkspace().createBuild(buildConfiguration);
- build.synchronize(monitor);
+ if (force) {
+ String projectPath = project.getLocation().toFile().getAbsolutePath();
+ BuildConfiguration buildConfiguration = GradleProjectImporter.getBuildConfiguration(Paths.get(projectPath));
+ GradleBuild build = GradleCore.getWorkspace().createBuild(buildConfiguration);
+ build.synchronize(monitor);
+ } else {
+ Optional<GradleBuild> build = GradleCore.getWorkspace().getBuild(project);
+ if (build.isPresent()) {
+ build.get().synchronize(monitor);
+ }
+ }
  }
 
  @Override

org.eclipse.jdt.ls.core/src/org/eclipse/jdt/ls/core/internal/managers/GradleProjectImporter.java

@@ -12,6 +12,8 @@
  *******************************************************************************/
 package org.eclipse.jdt.ls.core.internal.managers;
 
+import static java.util.Arrays.asList;
+
 import java.io.File;
 import java.io.FilenameFilter;
 import java.nio.file.Files;
@@ -42,6 +44,11 @@
 import org.eclipse.jdt.ls.core.internal.JavaLanguageServerPlugin;
 import org.eclipse.jdt.ls.core.internal.ProjectUtils;
 import org.eclipse.jdt.ls.core.internal.preferences.PreferenceManager;
+import org.eclipse.jdt.ls.internal.gradle.checksums.ValidationResult;
+import org.eclipse.jdt.ls.internal.gradle.checksums.WrapperValidator;
+import org.eclipse.lsp4j.ExecuteCommandParams;
+import org.eclipse.lsp4j.MessageParams;
+import org.eclipse.lsp4j.MessageType;
 
 /**
  * @author Fred Bricon
@@ -59,6 +66,17 @@ public class GradleProjectImporter extends AbstractProjectImporter {
 
  public static final String IMPORTING_GRADLE_PROJECTS = "Importing Gradle project(s)";
 
+ //@formatter:off
+ public static final String GRADLE_WRAPPER_CHEKSUM_WARNING_TEMPLATE =
+ "Security Warning! The gradle wrapper '@wrapper@' could be malicious. "
+ + "If you trust it, please add \n"
+ + "`{\"sha256\": \"@checksum@\","
+ + "\n\"allowed\": true}`"
+ + "\n to the `java.import.gradle.wrapper.checksums` preference."
+ + ""
+ .replaceAll("\n", System.lineSeparator());
+ //@formatter:on
+
  private Collection<Path> directories;
 
  /* (non-Javadoc)
@@ -107,13 +125,39 @@ private void importDir(Path rootFolder, IProgressMonitor monitor) {
  }
 
  public static GradleDistribution getGradleDistribution(Path rootFolder) {
- if (JavaLanguageServerPlugin.getPreferencesManager() != null && JavaLanguageServerPlugin.getPreferencesManager().getPreferences().isGradleWrapperEnabled() && Files.exists(rootFolder.resolve("gradlew"))) {
- return GradleDistribution.fromBuild();
+ PreferenceManager preferencesManager = JavaLanguageServerPlugin.getPreferencesManager();
+ if (preferencesManager != null && preferencesManager.getPreferences().isGradleWrapperEnabled() && Files.exists(rootFolder.resolve("gradlew"))) {
+ WrapperValidator validator = new WrapperValidator();
+ try {
+ ValidationResult result = validator.checkWrapper(rootFolder.toFile().getAbsolutePath());
+ if (result.isValid()) {
+ WrapperGradleDistribution gradleDistribution = GradleDistribution.fromBuild();
+ return gradleDistribution;
+ } else {
+ if (!WrapperValidator.contains(result.getChecksum())) {
+ ProjectsManager pm = JavaLanguageServerPlugin.getProjectsManager();
+ if (pm != null && pm.getConnection() != null) {
+ if (preferencesManager.getClientPreferences().isGradleChecksumWrapperPromptSupport()) {
+ String id = "gradle/checksum/prompt";
+ ExecuteCommandParams params = new ExecuteCommandParams(id, asList(result.getWrapperJar(), result.getChecksum()));
+ pm.getConnection().sendNotification(params);
+ } else {
+ //@formatter:off
+ String message = GRADLE_WRAPPER_CHEKSUM_WARNING_TEMPLATE.replaceAll("@wrapper@", result.getWrapperJar()).replaceAll("@checksum@", result.getChecksum());
+ //@formatter:on
+ pm.getConnection().showMessage(new MessageParams(MessageType.Error, message));
+ }
+ }
+ }
+ }
+ } catch (CoreException e) {
+ JavaLanguageServerPlugin.logException(e.getMessage(), e);
+ }
  }
- if (JavaLanguageServerPlugin.getPreferencesManager() != null && JavaLanguageServerPlugin.getPreferencesManager().getPreferences().getGradleVersion() != null) {
+ if (preferencesManager != null && preferencesManager.getPreferences().getGradleVersion() != null) {
  List<GradleVersion> versions = CorePlugin.publishedGradleVersions().getVersions();
  GradleVersion gradleVersion = null;
- String versionString = JavaLanguageServerPlugin.getPreferencesManager().getPreferences().getGradleVersion();
+ String versionString = preferencesManager.getPreferences().getGradleVersion();
  GradleVersion requiredVersion = GradleVersion.version(versionString);
  for (GradleVersion version : versions) {
  if (version.compareTo(requiredVersion) == 0) {

org.eclipse.jdt.ls.core/src/org/eclipse/jdt/ls/core/internal/managers/ProjectsManager.java

@@ -372,6 +372,10 @@ public void setConnection(JavaLanguageClient client) {
  this.client = client;
  }
 
+ public JavaLanguageClient getConnection() {
+ return this.client;
+ }
+
  private String getWorkspaceInfo() {
  StringBuilder b = new StringBuilder();
  b.append("Projects:\n");

org.eclipse.jdt.ls.core/src/org/eclipse/jdt/ls/core/internal/preferences/ClientPreferences.java

@@ -221,6 +221,14 @@ public boolean isClientDocumentSymbolProviderRegistered() {
  return Boolean.parseBoolean(extendedClientCapabilities.getOrDefault("clientDocumentSymbolProvider", "false").toString());
  }
 
+ public boolean isActionableNotificationSupported() {
+ return Boolean.parseBoolean(extendedClientCapabilities.getOrDefault("actionableNotificationSupported", "false").toString());
+ }
+
+ public boolean isGradleChecksumWrapperPromptSupport() {
+ return Boolean.parseBoolean(extendedClientCapabilities.getOrDefault("gradleChecksumWrapperPromptSupport", "false").toString());
+ }
+
  public boolean isSupportsCompletionDocumentationMarkdown() {
  //@formatter:off
  return v3supported && capabilities.getTextDocument().getCompletion() != null

org.eclipse.jdt.ls.core/src/org/eclipse/jdt/ls/core/internal/preferences/Preferences.java

@@ -31,6 +31,7 @@
 import java.util.UUID;
 
 import org.eclipse.core.internal.resources.PreferenceInitializer;
+import org.eclipse.core.resources.IProject;
 import org.eclipse.core.runtime.IPath;
 import org.eclipse.core.runtime.preferences.DefaultScope;
 import org.eclipse.core.runtime.preferences.IEclipsePreferences;
@@ -39,9 +40,12 @@
 import org.eclipse.jdt.internal.core.manipulation.MembersOrderPreferenceCacheCommon;
 import org.eclipse.jdt.ls.core.internal.IConstants;
 import org.eclipse.jdt.ls.core.internal.JavaLanguageServerPlugin;
+import org.eclipse.jdt.ls.core.internal.ProjectUtils;
 import org.eclipse.jdt.ls.core.internal.ResourceUtils;
 import org.eclipse.jdt.ls.core.internal.RuntimeEnvironment;
 import org.eclipse.jdt.ls.core.internal.contentassist.TypeFilter;
+import org.eclipse.jdt.ls.core.internal.managers.ProjectsManager;
+import org.eclipse.jdt.ls.internal.gradle.checksums.WrapperValidator;
 import org.eclipse.lsp4j.MessageType;
 
 /**
@@ -60,7 +64,7 @@ public class Preferences {
  * Specifies Java Execution Environments.
  */
  public static final String JAVA_CONFIGURATION_RUNTIMES = "java.configuration.runtimes";
- public static final Set<String> JAVA_CONFIGURATION_RUNTIMES_DEFAULT;
+ public static final List<String> JAVA_CONFIGURATION_RUNTIMES_DEFAULT;
  /**
  * Specifies the file path to the formatter xml url.
  */
@@ -209,6 +213,15 @@ public class Preferences {
  */
  public static final String SELECTIONRANGE_ENABLED_KEY = "java.selectionRange.enabled";
 
+ /**
+ * A named preference that holds the allowed gradle wrapper sha256 checksums.
+ * <p>
+ * Value is of type <code>String</code>: list of checksums.
+ * </p>
+ */
+ public static final String JAVA_GRADLE_WRAPPER_SHA256_KEY = "java.imports.gradle.wrapper.checksums";
+ public static final List<String> JAVA_GRADLE_WRAPPER_SHA256_DEFAULT;
+
  /**
  * A named preference that holds the favorite static members.
  * <p>
@@ -412,6 +425,8 @@ public class Preferences {
  private String mavenUserSettings;
 
  private List<String> javaCompletionFavoriteMembers;
+ private List<String> sha256Allowed;
+ private List<String> sha256Disallowed;
 
  private List<String> javaImportExclusions = new LinkedList<>();
  private ReferencedLibraries referencedLibraries;
@@ -430,7 +445,8 @@ public class Preferences {
 
  static {
  JAVA_IMPORT_EXCLUSIONS_DEFAULT = new LinkedList<>();
- JAVA_CONFIGURATION_RUNTIMES_DEFAULT = new HashSet<>();
+ JAVA_CONFIGURATION_RUNTIMES_DEFAULT = new ArrayList<>();
+ JAVA_GRADLE_WRAPPER_SHA256_DEFAULT = new ArrayList<>();
  JAVA_IMPORT_EXCLUSIONS_DEFAULT.add("**/node_modules/**");
  JAVA_IMPORT_EXCLUSIONS_DEFAULT.add("**/.metadata/**");
  JAVA_IMPORT_EXCLUSIONS_DEFAULT.add("**/archetype-resources/**");
@@ -731,6 +747,43 @@ public static Preferences createFrom(Map<String, Object> configuration) {
  List<String> javaCompletionFavoriteMembers = getList(configuration, JAVA_COMPLETION_FAVORITE_MEMBERS_KEY, JAVA_COMPLETION_FAVORITE_MEMBERS_DEFAULT);
  prefs.setJavaCompletionFavoriteMembers(javaCompletionFavoriteMembers);
 
+ List<?> gradleWrapperList = getList(configuration, JAVA_GRADLE_WRAPPER_SHA256_KEY, JAVA_GRADLE_WRAPPER_SHA256_DEFAULT);
+ List<String> sha256Allowed = new ArrayList<>();
+ List<String> sha256Disallowed = new ArrayList<>();
+ for (Object object : gradleWrapperList) {
+ if (object instanceof Map) {
+ Map<?, ?> map = (Map<?, ?>) object;
+ final ChecksumWrapper sha256 = prefs.new ChecksumWrapper();
+ sha256.allowed = true;
+ map.forEach((k, v) -> {
+ if (k instanceof String) {
+ switch ((String) k) {
+ case "sha256":
+ if (v instanceof String) {
+ sha256.checksum = (String) v;
+ }
+ break;
+ case "allowed":
+ if (v instanceof Boolean) {
+ sha256.allowed = (Boolean) v;
+ }
+ break;
+ default:
+ break;
+ }
+ }
+ });
+ if (sha256.checksum != null) {
+ if (sha256.allowed) {
+ sha256Allowed.add(sha256.checksum);
+ } else {
+ sha256Disallowed.add(sha256.checksum);
+ }
+ }
+ }
+ }
+ prefs.putSha256(sha256Allowed, sha256Disallowed);
+
  String mavenUserSettings = getString(configuration, MAVEN_USER_SETTINGS_KEY, null);
  prefs.setMavenUserSettings(mavenUserSettings);
 
@@ -771,7 +824,7 @@ public static Preferences createFrom(Map<String, Object> configuration) {
  int staticOnDemandThreshold = getInt(configuration, IMPORTS_STATIC_ONDEMANDTHRESHOLD, IMPORTS_STATIC_ONDEMANDTHRESHOLD_DEFAULT);
  prefs.setStaticImportOnDemandThreshold(staticOnDemandThreshold);
 
- List<?> runtimeList = getList(configuration, JAVA_CONFIGURATION_RUNTIMES, JAVA_IMPORT_ORDER_DEFAULT);
+ List<?> runtimeList = getList(configuration, JAVA_CONFIGURATION_RUNTIMES, JAVA_CONFIGURATION_RUNTIMES_DEFAULT);
  Set<RuntimeEnvironment> runtimes = new HashSet<>();
  boolean[] hasDefault = { false };
  for (Object object : runtimeList) {
@@ -888,6 +941,24 @@ public Preferences setJavaCompletionFavoriteMembers(List<String> javaCompletionF
  return this;
  }
 
+ public Preferences putSha256(List<String> sha256Allowed, List<String> sha256Disallowed) {
+ List<String> oldAllowed = this.sha256Allowed;
+ List<String> oldDisallowed = this.sha256Disallowed;
+ WrapperValidator.clear();
+ this.sha256Allowed = sha256Allowed;
+ if (sha256Disallowed != null) {
+ WrapperValidator.disallow(sha256Disallowed);
+ }
+ this.sha256Disallowed = sha256Disallowed;
+ ProjectsManager projectsManager = JavaLanguageServerPlugin.getProjectsManager();
+ if (projectsManager != null && (!Objects.equals(oldAllowed, this.sha256Allowed) || !Objects.equals(oldDisallowed, this.sha256Disallowed))) {
+ for (IProject project : ProjectUtils.getGradleProjects()) {
+ projectsManager.updateProject(project, true);
+ }
+ }
+ return this;
+ }
+
  private Preferences setMembersSortOrder(String sortOrder) {
  if (sortOrder != null) {
  IEclipsePreferences fPreferenceStore = InstanceScope.INSTANCE.getNode(IConstants.PLUGIN_ID);
@@ -1092,6 +1163,10 @@ public String[] getJavaCompletionFavoriteMembers() {
  return javaCompletionFavoriteMembers.toArray(new String[0]);
  }
 
+ public List<String> getSha256Allowed() {
+ return sha256Allowed;
+ }
+
  public String getJavaHome() {
  return javaHome;
  }
@@ -1367,4 +1442,9 @@ public Preferences setStaticImportOnDemandThreshold(int staticImportOnDemandThre
  defEclipsePrefs.put(CodeStyleConfiguration.ORGIMPORTS_STATIC_ONDEMANDTHRESHOLD, String.valueOf(this.staticImportOnDemandThreshold));
  return this;
  }
+
+ class ChecksumWrapper {
+ private String checksum;
+ private boolean allowed;
+ }
 }