fix(cli): Guard against foreign classpath items with a pathing JAR

To not blindly add any JAR to the classpath that has been copied to the
distribution's "lib" directory, build a "pathing JAR" whose manifest
contains the intended runtime classpath. Then only use that JAR and the
main CLI JAR as the classpath for the application.

Fixes #9372.

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>

buildSrc/src/main/kotlin/ort-application-conventions.gradle.kts

@@ -164,28 +164,50 @@ tasks.named<BuildNativeImageTask>("nativeCompile") {
     }
 }
 
+val jar by tasks.getting(Jar::class)
+
+val pathingJar by tasks.registering(Jar::class) {
+    archiveClassifier = "pathing"
+
+    manifest {
+        // Work around the command line length limit on Windows when passing the classpath to Java, see
+        // https://github.com/gradle/gradle/issues/1989.
+        attributes["Class-Path"] = configurations.runtimeClasspath.get().joinToString(" ") { it.name }
+    }
+}
+
 tasks.named<CreateStartScripts>("startScripts") {
+    classpath = jar.outputs.files + pathingJar.get().outputs.files
+
     doLast {
-        // Work around the command line length limit on Windows when passing the classpath to Java, see
-        // https://github.com/gradle/gradle/issues/1989#issuecomment-395001392.
+        // Append the plugin directory to the Windows classpath.
         val windowsScriptText = windowsScript.readText(Charset.defaultCharset())
         windowsScript.writeText(
             windowsScriptText.replace(
-                Regex("set CLASSPATH=%APP_HOME%\\\\lib\\\\.*"),
-                "set CLASSPATH=%APP_HOME%\\\\lib\\\\*;%APP_HOME%\\\\plugin\\\\*"
+                Regex("(set CLASSPATH=%APP_HOME%\\\\lib\\\\.*)"), "$1;%APP_HOME%\\\\plugin\\\\*"
             )
         )
 
+        // Append the plugin directory to the Unix classpath.
         val unixScriptText = unixScript.readText(Charset.defaultCharset())
         unixScript.writeText(
             unixScriptText.replace(
-                Regex("CLASSPATH=\\\$APP_HOME/lib/.*"),
-                "CLASSPATH=\\\$APP_HOME/lib/*:\\\$APP_HOME/plugin/*"
+                Regex("(CLASSPATH=\\\$APP_HOME/lib/.*)"), "$1:\\\$APP_HOME/plugin/*"
             )
         )
     }
 }
 
+distributions {
+    main {
+        contents {
+            from(pathingJar) {
+                into("lib")
+            }
+        }
+    }
+}
+
 val distTar = tasks.named<Tar>("distTar") {
     compression = Compression.GZIP
 }