Hacker News Reader

Comment by floatboth | Hacker News Reader

> renamed .jar files .ja so Microsoft System restore wouldn’t corrupt Firefox

OHH that's why it's called omni.ja.. But why was it "jar" in the first place, for a thing that's not Java?

Another reason was because people trying to open omni.jar with zip utilities were always filing bugs, when the real issue was that the utilities couldn’t handle our optimized format.

(I owned the JAR code for a few years after Taras left Mozilla)

It's simply a jar of files, not a JAR (JAva aRchive) of files.

Though even the Java JAR file is itself just a zip file.

As are apk, aar and ipa files among others. However, they aren’t just zip files as they must be in a specific layout, so they are a subset of the zip format.

You can make a valid APK/IPA/JAR polyglot, just put all the files in one folder, and use the jar tool to make it back into a zip, then rerun jarsigner because the APK has to be resigned after adding the Java and iOS files.

I believe the format specifies the META-INF/MANIFEST.MF path, but in practice the classloader and jar tools can deal with a missing manifest. Otherwise it is a zip, with all of its warts and non-reproducible default behavior.

Did you know you can have multiple zip entries with the same path? Ask me how I found out.

Another difference is that In a jar file, all file names are utf-8 encoded. Where as in a zip file the encoding is not specified.

Most of the old school archive formats allow adding the same path twice. It's to avoid having to rewrite a huge archive just to change a file.

You don't need the same path twice in the central directory record for that though.

That sounds like a recipe for a good time with ClassLoaders.

It's been the source of at least two Android vulns that I can recall, since code-path A uses the top manifest for signature verification but code-path B uses the bottom manifest for reading out "the file" and poof!

How did you find out?

The usual way to find out is using JarOutputStream without thinking about content name uniqueness. I suspect that of those who do know many have learned it this way.

There's plenty of JavaScript files in there.

That is nice, but they started to use the extension in 2010, when java had been using it for over a decade already. Sadly applications relying on the file extension alone as file type indication are still common so that was a rather big oversight.

Don't make the mistake of thinking the commenter you're responding to as authoritative on anything. The comment is bullshit.

Reply on news.ycombinator.com