command line option for jar file matching

[danielgrahl]

In the scanner, the file name extensions are hard-coded to jar/war/ear; at least rar (resource adapter archive) is missing.
It would be a great improvement to configure the file names to match on the command line, e.g., log4j-vuln-scanner --jarfiles jar,war,ear,rar

[martin-schlossarek]

Do you have any real world examples for this? Could this also apply to *.zip or other file containers?

[hillu]

Sure. If anyone does a PR, I'd accept that.

[martin-schlossarek]

Now I get it.

I didn't know there are two different RAR file formats.

[danielgrahl]

it's just some other name for a jar. But you are right, any zip should be considered.

[StyleTec]

Zip magic is just 0x504B0304 at offset 0 fyi

[martin-schlossarek]

it's just some other name for a jar. But you are right, any zip should be considered.

Do you have any example files? Googling for java+rar is useless: just winrar related results.

[hillu]

But you are right, any zip should be considered.

Not by default. This tool is intended for quick assessments.

Like I said, I'll happily take pull requests.