From a2ad23548cc37adefdab4000308f20a42ed597d8 Mon Sep 17 00:00:00 2001 From: Andrew Date: Fri, 17 Jun 2022 19:08:57 -0400 Subject: [PATCH 1/3] Check for Oracle Java before changing start string --- app/classes/shared/server.py | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/app/classes/shared/server.py b/app/classes/shared/server.py index cdd5f796..2463ac2b 100644 --- a/app/classes/shared/server.py +++ b/app/classes/shared/server.py @@ -239,18 +239,22 @@ class ServerInstance: "Detected nebulous java in start command. " "Replacing with full java path." ) - which_java_raw = self.helper.which_java() - java_path = which_java_raw + "\\bin\\java" - if str(which_java_raw) != str(self.helper.get_servers_root_dir) or str( - self.helper.get_servers_root_dir - ) in str(which_java_raw): - self.server_command[0] = java_path - else: - logger.critcal( - "Possible attack detected. User attempted to exec " - "java binary from server directory." + if "/Oracle/Java/" in str(shutil.which("java")): + logger.info( + "Oracle Java detected. Changing start command to avoid re-exec." ) - return + which_java_raw = self.helper.which_java() + java_path = which_java_raw + "\\bin\\java" + if str(which_java_raw) != str(self.helper.get_servers_root_dir) or str( + self.helper.get_servers_root_dir + ) in str(which_java_raw): + self.server_command[0] = java_path + else: + logger.critcal( + "Possible attack detected. User attempted to exec " + "java binary from server directory." + ) + return self.server_path = Helpers.get_os_understandable_path(self.settings["path"]) # let's do some quick checking to make sure things actually exists From 9bbf316494f74dc2a6eaf8de18ced9908a60031a Mon Sep 17 00:00:00 2001 From: Andrew Date: Fri, 17 Jun 2022 19:11:03 -0400 Subject: [PATCH 2/3] Check for Oracle Java before changing start string --- app/classes/shared/server.py | 1 + 1 file changed, 1 insertion(+) diff --git a/app/classes/shared/server.py b/app/classes/shared/server.py index 2463ac2b..93b83459 100644 --- a/app/classes/shared/server.py +++ b/app/classes/shared/server.py @@ -239,6 +239,7 @@ class ServerInstance: "Detected nebulous java in start command. " "Replacing with full java path." ) + # Checks for Oracle Java. Only Oracle Java's helper will cause a re-exec. if "/Oracle/Java/" in str(shutil.which("java")): logger.info( "Oracle Java detected. Changing start command to avoid re-exec." From aac3a84ab827cf1a3ec93422096181cef97fc6e9 Mon Sep 17 00:00:00 2001 From: Andrew Date: Fri, 17 Jun 2022 20:03:42 -0400 Subject: [PATCH 3/3] Update changelog.md --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f9f61e90..9410043a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,10 @@ TBD ### Tweaks TBD +## [4.0.2-hotfix2] - 2022/06/17 + +### Crit Bug fixes +Ammend Java system variable fix to be more specfic since they only affect Oracle. ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/364)) ## [4.0.2-hotfix1] - 2022/06/17