-
Notifications
You must be signed in to change notification settings - Fork 176
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add wrappers for the xwiki CVE-2024-31982
- Loading branch information
Showing
4 changed files
with
353 additions
and
0 deletions.
There are no files selected for viewing
Binary file added
BIN
+42.5 KB
google/detectors/rce/xwiki/cve202431982/gradle/wrapper/gradle-wrapper.jar
Binary file not shown.
7 changes: 7 additions & 0 deletions
7
google/detectors/rce/xwiki/cve202431982/gradle/wrapper/gradle-wrapper.properties
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
distributionBase=GRADLE_USER_HOME | ||
distributionPath=wrapper/dists | ||
distributionUrl=https\://services.gradle.org/distributions/gradle-7.0-bin.zip | ||
networkTimeout=10000 | ||
validateDistributionUrl=true | ||
zipStoreBase=GRADLE_USER_HOME | ||
zipStorePath=wrapper/dists |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,252 @@ | ||
#!/bin/sh | ||
|
||
# | ||
# Copyright © 2015-2021 the original authors. | ||
# | ||
# Licensed under the Apache License, Version 2.0 (the "License"); | ||
# you may not use this file except in compliance with the License. | ||
# You may obtain a copy of the License at | ||
# | ||
# https://www.apache.org/licenses/LICENSE-2.0 | ||
# | ||
# Unless required by applicable law or agreed to in writing, software | ||
# distributed under the License is distributed on an "AS IS" BASIS, | ||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
# See the License for the specific language governing permissions and | ||
# limitations under the License. | ||
# | ||
# SPDX-License-Identifier: Apache-2.0 | ||
# | ||
|
||
############################################################################## | ||
# | ||
# Gradle start up script for POSIX generated by Gradle. | ||
# | ||
# Important for running: | ||
# | ||
# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is | ||
# noncompliant, but you have some other compliant shell such as ksh or | ||
# bash, then to run this script, type that shell name before the whole | ||
# command line, like: | ||
# | ||
# ksh Gradle | ||
# | ||
# Busybox and similar reduced shells will NOT work, because this script | ||
# requires all of these POSIX shell features: | ||
# * functions; | ||
# * expansions «$var», «${var}», «${var:-default}», «${var+SET}», | ||
# «${var#prefix}», «${var%suffix}», and «$( cmd )»; | ||
# * compound commands having a testable exit status, especially «case»; | ||
# * various built-in commands including «command», «set», and «ulimit». | ||
# | ||
# Important for patching: | ||
# | ||
# (2) This script targets any POSIX shell, so it avoids extensions provided | ||
# by Bash, Ksh, etc; in particular arrays are avoided. | ||
# | ||
# The "traditional" practice of packing multiple parameters into a | ||
# space-separated string is a well documented source of bugs and security | ||
# problems, so this is (mostly) avoided, by progressively accumulating | ||
# options in "$@", and eventually passing that to Java. | ||
# | ||
# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS, | ||
# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly; | ||
# see the in-line comments for details. | ||
# | ||
# There are tweaks for specific operating systems such as AIX, CygWin, | ||
# Darwin, MinGW, and NonStop. | ||
# | ||
# (3) This script is generated from the Groovy template | ||
# https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt | ||
# within the Gradle project. | ||
# | ||
# You can find Gradle at https://github.com/gradle/gradle/. | ||
# | ||
############################################################################## | ||
|
||
# Attempt to set APP_HOME | ||
|
||
# Resolve links: $0 may be a link | ||
app_path=$0 | ||
|
||
# Need this for daisy-chained symlinks. | ||
while | ||
APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path | ||
[ -h "$app_path" ] | ||
do | ||
ls=$( ls -ld "$app_path" ) | ||
link=${ls#*' -> '} | ||
case $link in #( | ||
/*) app_path=$link ;; #( | ||
*) app_path=$APP_HOME$link ;; | ||
esac | ||
done | ||
|
||
# This is normally unused | ||
# shellcheck disable=SC2034 | ||
APP_BASE_NAME=${0##*/} | ||
# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036) | ||
APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s | ||
' "$PWD" ) || exit | ||
|
||
# Use the maximum available, or set MAX_FD != -1 to use that value. | ||
MAX_FD=maximum | ||
|
||
warn () { | ||
echo "$*" | ||
} >&2 | ||
|
||
die () { | ||
echo | ||
echo "$*" | ||
echo | ||
exit 1 | ||
} >&2 | ||
|
||
# OS specific support (must be 'true' or 'false'). | ||
cygwin=false | ||
msys=false | ||
darwin=false | ||
nonstop=false | ||
case "$( uname )" in #( | ||
CYGWIN* ) cygwin=true ;; #( | ||
Darwin* ) darwin=true ;; #( | ||
MSYS* | MINGW* ) msys=true ;; #( | ||
NONSTOP* ) nonstop=true ;; | ||
esac | ||
|
||
CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar | ||
|
||
|
||
# Determine the Java command to use to start the JVM. | ||
if [ -n "$JAVA_HOME" ] ; then | ||
if [ -x "$JAVA_HOME/jre/sh/java" ] ; then | ||
# IBM's JDK on AIX uses strange locations for the executables | ||
JAVACMD=$JAVA_HOME/jre/sh/java | ||
else | ||
JAVACMD=$JAVA_HOME/bin/java | ||
fi | ||
if [ ! -x "$JAVACMD" ] ; then | ||
die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME | ||
Please set the JAVA_HOME variable in your environment to match the | ||
location of your Java installation." | ||
fi | ||
else | ||
JAVACMD=java | ||
if ! command -v java >/dev/null 2>&1 | ||
then | ||
die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. | ||
Please set the JAVA_HOME variable in your environment to match the | ||
location of your Java installation." | ||
fi | ||
fi | ||
|
||
# Increase the maximum file descriptors if we can. | ||
if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then | ||
case $MAX_FD in #( | ||
max*) | ||
# In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked. | ||
# shellcheck disable=SC2039,SC3045 | ||
MAX_FD=$( ulimit -H -n ) || | ||
warn "Could not query maximum file descriptor limit" | ||
esac | ||
case $MAX_FD in #( | ||
'' | soft) :;; #( | ||
*) | ||
# In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked. | ||
# shellcheck disable=SC2039,SC3045 | ||
ulimit -n "$MAX_FD" || | ||
warn "Could not set maximum file descriptor limit to $MAX_FD" | ||
esac | ||
fi | ||
|
||
# Collect all arguments for the java command, stacking in reverse order: | ||
# * args from the command line | ||
# * the main class name | ||
# * -classpath | ||
# * -D...appname settings | ||
# * --module-path (only if needed) | ||
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. | ||
|
||
# For Cygwin or MSYS, switch paths to Windows format before running java | ||
if "$cygwin" || "$msys" ; then | ||
APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) | ||
CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) | ||
|
||
JAVACMD=$( cygpath --unix "$JAVACMD" ) | ||
|
||
# Now convert the arguments - kludge to limit ourselves to /bin/sh | ||
for arg do | ||
if | ||
case $arg in #( | ||
-*) false ;; # don't mess with options #( | ||
/?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath | ||
[ -e "$t" ] ;; #( | ||
*) false ;; | ||
esac | ||
then | ||
arg=$( cygpath --path --ignore --mixed "$arg" ) | ||
fi | ||
# Roll the args list around exactly as many times as the number of | ||
# args, so each arg winds up back in the position where it started, but | ||
# possibly modified. | ||
# | ||
# NB: a `for` loop captures its iteration list before it begins, so | ||
# changing the positional parameters here affects neither the number of | ||
# iterations, nor the values presented in `arg`. | ||
shift # remove old arg | ||
set -- "$@" "$arg" # push replacement arg | ||
done | ||
fi | ||
|
||
|
||
# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. | ||
DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' | ||
|
||
# Collect all arguments for the java command: | ||
# * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments, | ||
# and any embedded shellness will be escaped. | ||
# * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be | ||
# treated as '${Hostname}' itself on the command line. | ||
|
||
set -- \ | ||
"-Dorg.gradle.appname=$APP_BASE_NAME" \ | ||
-classpath "$CLASSPATH" \ | ||
org.gradle.wrapper.GradleWrapperMain \ | ||
"$@" | ||
|
||
# Stop when "xargs" is not available. | ||
if ! command -v xargs >/dev/null 2>&1 | ||
then | ||
die "xargs is not available" | ||
fi | ||
|
||
# Use "xargs" to parse quoted args. | ||
# | ||
# With -n1 it outputs one arg per line, with the quotes and backslashes removed. | ||
# | ||
# In Bash we could simply go: | ||
# | ||
# readarray ARGS < <( xargs -n1 <<<"$var" ) && | ||
# set -- "${ARGS[@]}" "$@" | ||
# | ||
# but POSIX shell has neither arrays nor command substitution, so instead we | ||
# post-process each arg (as a line of input to sed) to backslash-escape any | ||
# character that might be a shell metacharacter, then use eval to reverse | ||
# that process (while maintaining the separation between arguments), and wrap | ||
# the whole thing up as a single "set" statement. | ||
# | ||
# This will of course break if any of these variables contains a newline or | ||
# an unmatched quote. | ||
# | ||
|
||
eval "set -- $( | ||
printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | | ||
xargs -n1 | | ||
sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | | ||
tr '\n' ' ' | ||
)" '"$@"' | ||
|
||
exec "$JAVACMD" "$@" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,94 @@ | ||
@rem | ||
@rem Copyright 2015 the original author or authors. | ||
@rem | ||
@rem Licensed under the Apache License, Version 2.0 (the "License"); | ||
@rem you may not use this file except in compliance with the License. | ||
@rem You may obtain a copy of the License at | ||
@rem | ||
@rem https://www.apache.org/licenses/LICENSE-2.0 | ||
@rem | ||
@rem Unless required by applicable law or agreed to in writing, software | ||
@rem distributed under the License is distributed on an "AS IS" BASIS, | ||
@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
@rem See the License for the specific language governing permissions and | ||
@rem limitations under the License. | ||
@rem | ||
@rem SPDX-License-Identifier: Apache-2.0 | ||
@rem | ||
|
||
@if "%DEBUG%"=="" @echo off | ||
@rem ########################################################################## | ||
@rem | ||
@rem Gradle startup script for Windows | ||
@rem | ||
@rem ########################################################################## | ||
|
||
@rem Set local scope for the variables with windows NT shell | ||
if "%OS%"=="Windows_NT" setlocal | ||
|
||
set DIRNAME=%~dp0 | ||
if "%DIRNAME%"=="" set DIRNAME=. | ||
@rem This is normally unused | ||
set APP_BASE_NAME=%~n0 | ||
set APP_HOME=%DIRNAME% | ||
|
||
@rem Resolve any "." and ".." in APP_HOME to make it shorter. | ||
for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi | ||
|
||
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. | ||
set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" | ||
|
||
@rem Find java.exe | ||
if defined JAVA_HOME goto findJavaFromJavaHome | ||
|
||
set JAVA_EXE=java.exe | ||
%JAVA_EXE% -version >NUL 2>&1 | ||
if %ERRORLEVEL% equ 0 goto execute | ||
|
||
echo. 1>&2 | ||
echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2 | ||
echo. 1>&2 | ||
echo Please set the JAVA_HOME variable in your environment to match the 1>&2 | ||
echo location of your Java installation. 1>&2 | ||
|
||
goto fail | ||
|
||
:findJavaFromJavaHome | ||
set JAVA_HOME=%JAVA_HOME:"=% | ||
set JAVA_EXE=%JAVA_HOME%/bin/java.exe | ||
|
||
if exist "%JAVA_EXE%" goto execute | ||
|
||
echo. 1>&2 | ||
echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2 | ||
echo. 1>&2 | ||
echo Please set the JAVA_HOME variable in your environment to match the 1>&2 | ||
echo location of your Java installation. 1>&2 | ||
|
||
goto fail | ||
|
||
:execute | ||
@rem Setup the command line | ||
|
||
set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar | ||
|
||
|
||
@rem Execute Gradle | ||
"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* | ||
|
||
:end | ||
@rem End local scope for the variables with windows NT shell | ||
if %ERRORLEVEL% equ 0 goto mainEnd | ||
|
||
:fail | ||
rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of | ||
rem the _cmd.exe /c_ return code! | ||
set EXIT_CODE=%ERRORLEVEL% | ||
if %EXIT_CODE% equ 0 set EXIT_CODE=1 | ||
if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE% | ||
exit /b %EXIT_CODE% | ||
|
||
:mainEnd | ||
if "%OS%"=="Windows_NT" endlocal | ||
|
||
:omega |