From 158291b82c96f53095bd8b291cbb771c2a239d00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20L=C3=A4ubrich?= <laeubi@laeubi-soft.de>
Date: Fri, 20 Oct 2023 18:17:39 +0200
Subject: [PATCH] Do content sensing to make sure the file is really not a jar

Currently we rely on the file-ending to determine the type of file but
this can fail in cases a CacheManger returns a cached file without that
extension (for whatever reason).

This now adds another check for content sensing if the simple check
fails to ensure a zipped item is not parsed as plain text.
---
 .../SimpleMetadataRepositoryFactory.java      | 24 +++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/bundles/org.eclipse.equinox.p2.metadata.repository/src/org/eclipse/equinox/internal/p2/metadata/repository/SimpleMetadataRepositoryFactory.java b/bundles/org.eclipse.equinox.p2.metadata.repository/src/org/eclipse/equinox/internal/p2/metadata/repository/SimpleMetadataRepositoryFactory.java
index 387cd39f5f..94180a1f32 100644
--- a/bundles/org.eclipse.equinox.p2.metadata.repository/src/org/eclipse/equinox/internal/p2/metadata/repository/SimpleMetadataRepositoryFactory.java
+++ b/bundles/org.eclipse.equinox.p2.metadata.repository/src/org/eclipse/equinox/internal/p2/metadata/repository/SimpleMetadataRepositoryFactory.java
@@ -91,7 +91,7 @@ public IMetadataRepository load(URI location, int flags, IProgressMonitor monito
 			JarInputStream jarStream = null;
 			try {
 				//if reading from a jar, obtain a stream on the entry with the actual contents
-				if (localFile.getAbsolutePath().endsWith(JAR_EXTENSION)) {
+				if (localFile.getAbsolutePath().endsWith(JAR_EXTENSION) || hasZipMagicHeader(inStream)) {
 					jarStream = new JarInputStream(inStream);
 					JarEntry jarEntry = jarStream.getNextJarEntry();
 					String entryName = URLMetadataRepository.CONTENT_FILENAME + URLMetadataRepository.XML_EXTENSION;
@@ -133,10 +133,30 @@ public IMetadataRepository load(URI location, int flags, IProgressMonitor monito
 		}
 	}
 
+	/**
+	 * Check if given stream is a jar ...
+	 *
+	 * @param stream the stream
+	 * @return <code>true</code> if the stream supports mark/reset and has the two
+	 *         magic bytes PK at its current position
+	 * @throws IOException
+	 */
+	private static boolean hasZipMagicHeader(InputStream stream) throws IOException {
+		if (stream.markSupported()) {
+			stream.mark(2);
+			// 50 4B
+			int one = stream.read();
+			int two = stream.read();
+			stream.reset();
+			return ((one & 0xFF) == 0x50 && (two & 0xFF) == 0x4B);
+		}
+		return false;
+	}
+
 	/**
 	 * Closes a stream, ignoring any secondary exceptions
 	 */
-	private void safeClose(InputStream stream) {
+	private static void safeClose(InputStream stream) {
 		if (stream == null)
 			return;
 		try {