chore(deps): Bump io.github.classgraph:classgraph from 4.8.184 to 4.8.189

[dependabot]

Bumps io.github.classgraph:classgraph from 4.8.184 to 4.8.189.

Release notes

Sourced from io.github.classgraph:classgraph's releases.

classgraph-4.8.189

This release is the result of a file-by-file audit of the whole codebase. None of the bugs below had been reported — they were found by reading the code. Each one that could be triggered through the API has a regression test that was checked to fail before the fix was applied.

Bug fixes: class metadata

• ClassInfo#getClassesWithFieldAnnotation() passed the classes with an annotated method as its set of directly-annotated classes, so calling directOnly() on the result returned the classes with an annotated method rather than the classes with an annotated field.

• ScanResult#getClassesWithAllAnnotations() and #getClassesWithAnyAnnotation() threw NullPointerException when called with no annotation names, rather than returning the empty list: the result was sorted before it was tested for null.

• ModuleInfo#getClassInfo() and #getClassInfo(String) threw NullPointerException for a module with no accepted classes. A ModuleInfo is created as soon as any classfile is read from a module, including a module-info.class file, which does not itself contribute a ClassInfo. The sibling package accessors have always handled this.

• ArrayTypeSignature#getClassName() was implemented as toString(), so the array class name included any type annotations and type arguments, e.g. "java.lang.String @Ann []" or "java.util.List<java.lang.String>[]". Neither is a class name, and this name is used both as the cache key for ArrayClassInfo and as the name to classload by.

• A type parameter named Object caused a ClassCastException while rendering a type signature. The suppression of a redundant extends java.lang.Object bound detected the simple-name form of the bound by string comparison, then cast it to ClassRefTypeSignature; a type parameter may legally shadow java.lang.Object, in which case the bound is a TypeVariableSignature.

• A truncated or malformed type signature threw IllegalArgumentException rather than ParseException, which is what the callers of the signature parser catch (they log and skip the offending constant pool entry). The end of the string is a valid parser position, but Parser#advance() rejected it, so a signature ending in $ or . escaped as the wrong exception type.

• ClassInfo#getOrCreateClassInfo() mis-handled being passed a class descriptor ("Ljava/lang/String;") rather than a class name: it stripped the descriptor by keeping only its last character, instead of removing the leading L and the trailing ;.

• ResourceList#getPathsRelativeToClasspathElement() returned the same paths as getPaths(), since it called Resource#getPath() rather than Resource#getPathRelativeToClasspathElement(), so the package root prefix was not stripped.

• ObjectTypedValueWrapper#equals() ignored its boolean[], char[] and double[] fields (hashCode() hashes all of them), so wrappers holding different arrays of those types compared equal.

• An annotation with an array-typed parameter could not be instantiated when the annotation's own classfile was not scanned. The element type is then inferred from the array elements; that fallback did not handle String elements, and for anything it did not recognize it returned the type of the wrapper object rather than Object, so an array of the wrong element type was allocated.

• FieldInfo#toString() did not escape a single quote in a char constant initializer value. It used replaceAll("'", "\\'"), and in a replaceAll replacement string a backslash escapes the character that follows it, so the quote was replaced with itself.

• toStringWithSimpleNames() left parts of the output fully qualified: for a generic class, the type parameter bounds, superclass and superinterfaces; and for a method type signature, the return type.

Bug fixes: zipfile and classfile reading

• A zip entry whose local header declares a filename or extra field of 32768 bytes or more could not be read. Both lengths are unsigned 16-bit values but were read as signed shorts, so the computed start of the entry's data pointed before the local header instead of after it.

• The last four bytes were dropped from every entry name read from an Info-ZIP Unicode path extra field (tag 0x7075). The data area is version(1) + nameCRC32(4) + name, so the name is size - 5 bytes long, but it was read as size - 9 bytes.

• skip() on the InputStream for a deflated zip entry skipped the whole stream and returned a negative count, because the skip loop subtracted rather than added the number of bytes read.

• ClassfileReader#readString(int) (the sequential overload) read out of an unfilled buffer. A reader built on an InputStream starts with an allocated but empty buffer, and every other sequential read method delegates to its random access counterpart, which buffers the requested range first.

• Two bugs in the reader used for memory-mapped files (enableMemoryMapping()): readUnsignedShort() masked with 0xff rather than 0xffff, discarding the high byte; and readString() applied the slice offset a second time, to a buffer that had already had it applied.

• Nested jars extracted to RAM from the same outer zipfile shared an identity key, since the key was the outermost File (which is also null for Path-backed zipfiles). The path string is now used.

• Fixed a potential overflow in Slice#skip() for a very large skip count, and a case where a non-positive skip count could seek backwards.

Bug fixes: classpath and classloading

• ClassGraphClassLoader#getResource(), #getResources() and #getResourceAsStream() did not follow the delegation order of findClass(String). They dereferenced both classloader delegation orders without a null check (the first entry of the environment order is a null ClassLoader, standing for the bootstrap classloader, and the added order is null unless addClassLoader() was called), and they never delegated to the override classloaders, which is where an overridden classpath ends up — so a resource on an overridden classpath that was not accepted by the scan spec could not be found at all. They now use the same delegation order as findClass(String), and always fall back to the bootstrap classloader. getResources() also now returns the resources found by every classloader, in delegation order and deduplicated by URL, rather than only those found by the first classloader that had any.

• A , was accepted as part of a URL scheme when deciding whether a classpath element is a URL: the scheme pattern contained +-., which is a character range from + to ., and so also matched , and /.

... (truncated)

Commits

• 96ca1e6 [maven-release-plugin] prepare release classgraph-4.8.189
• 1751d1a Codebase audit: fix bugs found by a file-by-file review, and polish
• bd650de [maven-release-plugin] prepare for next development iteration
• 23ec5f6 [maven-release-plugin] prepare release classgraph-4.8.188
• 9d54130 Make ModulePathInfo.getRuntimeInfo() block rather than skip
• 71714fb Fix racy and JVM-lifetime static state found by audit (#810, #913 follow-up)
• 8fb0731 Fix StringIndexOutOfBoundsException in sanitizeEntryPath, and drop its char[]...
• 08bd83c ClassLoaderHandler: use an interface instead of reflection
• 322431b Compute Resource path once in ClasspathElementDir, rather than per getPath() ...
• 7b7a7fa Add end-to-end acceptPaths test for mid-path '**' (#940)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)