4 ms·

As someone who hasn't touched Java since a programming class 20 years ago, and mostly lives in the Node world now, with sprinkles of Python, is it enough to sim

• ddworken 5y ago
  One of the benefits of this tool is that you can run it across a folder or even an entire disk to check all jars on the disk. So if a Node app does somehow pull in java, by scanning the entire disk this tool should be able to detect if the pulled in java code contains log4j.
• cmeacham98 5y ago
  A Node or Python program could indirectly use a java library but it would be very unusual, and this library should catch it assuming any amount of sanity in how the dependency is installed. Theoretically, some particularly insane application could download and run a jar purely in memory without it ever touching the disk. That's so close to malware-like behavior that only the most insane legit programs would ever do that.
  • laurent92 5y ago
    Or someone running a plugin system. Ability to download plugins from the in-app experience, + storage in db + run from memory.
    • foota 5y ago
      Ironically, is this not how the log4j vulnerability works?
• xorcist 5y ago
  It wouldn't be safe against an someone who actively tries to hide code, but the classloader requires the class files to be appropriately named, so if unzip -l doesn't show any suspect class names that should be enough in practice. A Linux VPS running a Node app is unlikely to even have Java installed. It's a pretty big dependency and you couldn't miss it.
  • yosito 5y ago
    It seems like it would be easy to miss if it's in a docker container. Would auditing my docker containers be a good idea? Also, is there a good command to run to reliably check if Java is installed on a system?
    • edoceo 5y ago
      > Would auditing my docker containers be a good idea Yes! I frequently review any containers from the cloud I run. Load on isolated VM, start, cursory inspection at least. Then with images I'm happy with we keep them internally, until we need the upgrade.
      • psYchotic 5y ago
        May I suggest you look into grype[0], or some other similar tool? It can be used to scan images for vulnerabilities. You'll probably find a bunch of vulnerabilities that aren't likely to actually affect you, but still, at least you'll know they're in the images you're running. And maybe you'll start using things like docker-slim[1] on your own images to get rid of those vulnerabilities you do find. [0]: https://github.com/anchore/grype https://github.com/anchore/grype [1]: https://github.com/docker-slim/docker-slim https://github.com/docker-slim/docker-slim
• needusername 5y ago
  No. The JAR could be inside a WAR inside an EAR.
  • throwanem 5y ago
    Not to MAR the point you're making, but isn't that scenario pretty FAR from real-world PAR? I'm sure you find JARs in RARs and TARs too, especially from shady VARs, but at some point we're planning out SAR for when a meteor hits our CAR.
  • ddworken 5y ago
    This tool will recursively unpack wars and ears.