43 lines
1.9 KiB
Python
43 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""Inspect the built WAR without launching the application or reading business data."""
|
|
from pathlib import Path
|
|
import collections
|
|
import hashlib
|
|
import json
|
|
import struct
|
|
import zipfile
|
|
|
|
root = Path(__file__).resolve().parents[1]
|
|
war = root / 'target/syly.war'
|
|
required = [
|
|
'WEB-INF/web.xml',
|
|
'WEB-INF/classes/com/zzc/web/system/controller/core/LoginController.class',
|
|
'WEB-INF/classes/com/zzc/core/interceptors/AuthInterceptor.class',
|
|
'WEB-INF/classes/com/zzc/web/htoal/controller/HotelMonthlyController.class',
|
|
'WEB-INF/classes/com/zzc/core/util/RuntimeSecrets.class',
|
|
]
|
|
with zipfile.ZipFile(war) as archive:
|
|
assert archive.testzip() is None, 'WAR CRC failure'
|
|
names = archive.namelist()
|
|
assert all(name in names for name in required), 'Missing application entry'
|
|
classes = [n for n in names if n.startswith('WEB-INF/classes/') and n.endswith('.class')]
|
|
versions = collections.Counter(struct.unpack('>H', archive.read(n)[6:8])[0] for n in classes)
|
|
assert set(versions) == {52}, versions
|
|
libs = [n for n in names if n.startswith('WEB-INF/lib/') and n.endswith('.jar')]
|
|
for name in ['dbconfig.properties', 'sysConfig.properties', 'zzc/zzc_database.properties']:
|
|
data = archive.read('WEB-INF/classes/' + name).decode('utf-8')
|
|
for line in data.splitlines():
|
|
if line.startswith(('jdbc.password=', 'mail.pwd=', 'password=')):
|
|
assert not line.split('=', 1)[1].strip(), 'Packaged credential in ' + name
|
|
assert 'druidStatView' not in archive.read('WEB-INF/web.xml').decode('utf-8')
|
|
print(json.dumps({
|
|
'war_sha256': hashlib.sha256(war.read_bytes()).hexdigest(),
|
|
'war_bytes': war.stat().st_size,
|
|
'zip_crc_check': 'passed',
|
|
'compiled_class_files': len(classes),
|
|
'class_major_versions': dict(versions),
|
|
'bundled_jars': len(libs),
|
|
'required_entries_present': required,
|
|
'packaged_credential_checks': 'passed',
|
|
}, indent=2))
|