4 ms·
I believe the format specifies the META-INF/MANIFEST.MF path, but in practice the classloader and jar tools can deal with a missing manifest. Otherwise it is a
by tadfisher 5y ago
I believe the format specifies the META-INF/MANIFEST.MF path, but in practice the classloader and jar tools can deal with a missing manifest. Otherwise it is a zip, with all of its warts and non-reproducible default behavior.
Did you know you can have multiple zip entries with the same path? Ask me how I found out.
- koolba 5y agoThat sounds like a recipe for a good time with ClassLoaders.
- mdaniel 5y agoIt's been the source of at least two Android vulns that I can recall, since code-path A uses the top manifest for signature verification but code-path B uses the bottom manifest for reading out "the file" and poof!
- diroussel 5y agoAnother difference is that In a jar file, all file names are utf-8 encoded. Where as in a zip file the encoding is not specified.
- ajb 5y agoMost of the old school archive formats allow adding the same path twice. It's to avoid having to rewrite a huge archive just to change a file.
- account42 5y agoYou don't need the same path twice in the central directory record for that though.
- dolmen 5y agoHow did you find out?
- usrusr 5y agoThe usual way to find out is using JarOutputStream without thinking about content name uniqueness. I suspect that of those who do know many have learned it this way.
- pvorb 5y agoHow did you find out?