Fat jar launcher mishandles root jar files with + characters in their path, making nested entries unloadable

[asibross]

When a URL contains a special character such as +, the call getRootJarFileFromUrl fails.
Here is a sample repro:

public static void main(String[] args) throws IOException {
    URL url = new URL("jar:file:/tmp/test/test+1.jar!/META-INF/MANIFEST.MF");
    JarFile jarFile = new Handler().getRootJarFileFromUrl(url);
}

This is the exception:

Exception in thread "main" java.io.IOException: Unable to open root Jar file 'file:/tmp/test/test+1.jar'
	at org.springframework.boot.loader.jar.Handler.getRootJarFile(Handler.java:324)
	at org.springframework.boot.loader.jar.Handler.getRootJarFileFromUrl(Handler.java:305)
	at Main.main(Main.java:11)
Caused by: java.lang.IllegalArgumentException: File /tmp/test/test 1.jar must exist
	at org.springframework.boot.loader.data.RandomAccessDataFile$FileAccess.openIfNecessary(RandomAccessDataFile.java:234)
	at org.springframework.boot.loader.data.RandomAccessDataFile$FileAccess.<init>(RandomAccessDataFile.java:216)
	at org.springframework.boot.loader.data.RandomAccessDataFile$FileAccess.<init>(RandomAccessDataFile.java:206)
	at org.springframework.boot.loader.data.RandomAccessDataFile.<init>(RandomAccessDataFile.java:49)
	at org.springframework.boot.loader.jar.JarFile.<init>(JarFile.java:88)
	at org.springframework.boot.loader.jar.Handler.getRootJarFile(Handler.java:318)
	... 2 more

I believe the root cause is the decoding of the root path that happens here.
The returned String from decode omits the special character.

[wilkinsona]

The special character hasn't been omitted but turned into a space. Arguably, that decoding should only be necessary for query parameters, but URLDecoder.decode does not make that distinction. You should be able to avoid the problem in your repro by encoding the + as %2B but I suspect you have a more real-world situation where the problem is occurring. If that's the case, can you please share a real-world reproduction that avoids low-level direct usage of Handler and getRootJArFileFromUrl(URL)?

[asibross]

You are right, I obviously don't have a direct low level usage on Handler, but I assume since it's a public API it should work as expected.
My real use case:
In the company I work for we name snapshot builds in this fashion - my-project-3.1.1-dev.44.uncommitted+pull.22.d76e266.jar.
When I try to run this executable jar with Hazelcast, I get this exception:

java.io.FileNotFoundException: JAR entry BOOT-INF/lib/hazelcast-3.11.2.jar!/META-INF/services/com.hazelcast.instance.NodeExtension not found in /apps/my-project-boot/lib/my-project-3.1.1-dev.44.uncommitted+pull.22.d76e266.jar
	at sun.net.www.protocol.jar.JarURLConnection.connect(JarURLConnection.java:144) ~[?:1.8.0_212]
	at sun.net.www.protocol.jar.JarURLConnection.getInputStream(JarURLConnection.java:152) ~[?:1.8.0_212]
	at java.net.URL.openStream(URL.java:1046) ~[?:1.8.0_212]
	at com.hazelcast.util.ServiceLoader.parse(ServiceLoader.java:132) ~[hazelcast-3.11.2.jar!/:3.11.2]
	at com.hazelcast.util.ServiceLoader.getServiceDefinitions(ServiceLoader.java:92) ~[hazelcast-3.11.2.jar!/:3.11.2]
	at com.hazelcast.util.ServiceLoader.classIterator(ServiceLoader.java:78) ~[hazelcast-3.11.2.jar!/:3.11.2]

[wilkinsona]

Thank you, @asibross, but that stack trace would suggest that Spring Boot's fat jar support isn't involved. If it was, I would expect the stack to show org.springframework.boot.loader.jar.JarURLConnection rather than sun.net.www.protocol.jar.JarURLConnection. If you'd like us to spend more time looking at this, can you please spend some time providing the real-world reproduction I requested above. A project zipped and attached to this issue or shared in a separate GitHub repository would be ideal.

[asibross]

Hey @wilkinsona, thank you very much for putting in the time to address this issue.
I am terribly sorry if it feels like I am not providing enough information, I just figured I'll spare the investigation and provide what I believe is the root cause.
However, as request I created a demo application and uploaded it to this Github repo.

Repro steps:

1. git clone https://github.com/asibross/spring-loader-error-demo.git
2. cd spring-loader-error-demo/
3. ./mvnw package
4. java -jar target/demo-0.0.1-SNAPSHOT+dev.jar

[wilkinsona]

Thank you, @asibross. I've been able to fill in the blanks now.

The reason that Spring Boot's loader does not appear in the stack trace is because of an earlier failure due to the + to conversion. The failure has resulted in Boot's jar URL connection handling falling back to the JDK's.