We Keep Coding

How to find log4shell vulnerable classes in my assemblies (jar/ear/war)

Around the current log4shell situation i need a way to find out if i have vulnerable classes in my packaged products.
What is the easiest way to find if the following classes are contained in jar files packaged in EAR or WAR files?
JndiLookup.class
JMSAppenderBase.class
JMSAppender.class

One solution would be the following bat script:
#echo off
echo extraction step 1
"C:\Program Files\7-Zip\7z.exe" e -r -aos -bd -otmp *
echo creating filelist
"C:\Program Files\7-Zip\7z.exe" l -r -aos -bd tmp/* >filelist.txt
echo cleanup
rmdir /s /q tmp
echo analysis result:
find "JndiLookup.class" filelist.txt
find "JMSAppenderBase.class" filelist.txt
find "JMSAppender.class" filelist.txt
pause

Running Jar file with embedded JRE using batch script .

If i want to embed JRE with my application, i have this directory structure.
+---jre
| +---bin
RunMyApp.bat
myApp.jar
i have added this statement in RunMyApp.bat to access the java.exe
jre\bin\java.exe -help
Then how to run the myApp.jar, using RunMyApp.bat script?
i have tried this one, but not succeed
jre\bin\java.exe -jar "%cd%\..\..\myApp.jar"

Add an entry to your MANIFEST.MF (under META-INF directory) for the Main-Class attribute and say jre\bin\java.exe -jar <your-jar-filename>

compile files from different directories with javac, referring a depending jar file?

I have the following set up:
I have 4 packages:
root/src/terminal - has some java files
root/src/mail - has some java files
root/src/data - has some java files
root/src/main - has a single java file, Main.java
I also have the following files
root/bin - a folder to store .class files
root/mail.jar - a jar file which has important classes used in my code
Within the root, I would like to enter a terminal command which compiles root/src/main/Main.java and puts the class files in the root/bin location.
Can someone show me the command to do this? I'm on a Mac (running Leopard).

Here's the one liner:
cd /xyz/root
rm -rf bin/*
javac -d bin -classpath mail.jar -sourcepath src main/Main.java
Alternatively, you could use absolute directory names:
rm -rf /xyz/root/bin/*
javac -d /xyz/root/bin -classpath /xyz/root/mail.jar \
-sourcepath /xyz/root/src /xyz/root/ main/Main.java
In reference to Ant you said "I would rather keep it simple.".
In fact in the long term it is simpler to create a simple Ant build.xml file. The alternative is a bunch of non-portable scripts or batch file ... or lots of typing.
To run the application, assuming that you are still in the /xyz/root directory:
java -classpath bin:mail.jar main.Main
Or on Windows:
java -classpath bin;mail.jar main.Main
Or modify the above to use absolute pathnames in the classpath argument; e.g.
java -classpath /xyz/root/bin:/xyz/root/mail.jar main.Main

Without knowing your operating system?
What you should look into is using Apache Ant. It is a build tool that once installed and configured can utilize a build.xml file in your root to compile class files to a folder as well as package a jar file.
http://ant.apache.org/

try this:
javac -cp "/root/mail.jar;/root/src;" -d "/root/bin" Main.java
This is written hoping that you have package declarations in your classes from src folder like package terminal; and package main;.
See this: Options in javac command
Or use Apache Ant as suggested by maple_shaft.
From comment give by #maple_shaft:
In Unix, Linux operating systems the classpath separator is a colon instead of a semicolon.

Java execute jar which depends on other jar from command line

I have an application that uses an external jar. I used eclipse and it works fine. I export as jar from eclipse, having created a Manifest file that has as Class-Path: ./cab.v1.jar
I place both jars in the same directory.
I run in command line:
java -jar myApp.jar
and get java.lang.NoClassDefFoundError for the classes in the cab.v1.jar (the other jar)
Have also tried java -cp . -jar myApp.jar but no success.
What am I doing wrong?

Using the documentation for the Manifest it does not use a ./ for relative directories. Try it just with:
Class-Path: cab.v1.jar
Note that the -cp option is ignored when using -jar.

If you use the -jar option the classpath is ignored. You could start the application by
java -cp jar1.jar:jar2.jar mainclass
The class path separator ':' is ';' on windows.

Compiling multiple packages using the command line in Java

Hi i have been using an IDE but now I need to run and compile from the command line.
The problem is that I have multiple packages and I have tried to find the answer but nothing has worked.
So I have
src/
Support/ (.java files)
Me/ (.java files)
Wrapers/ (.java files)
Do you know how to compile everything with javac?

This should do it (may require additional classpath elements via the -cp command line switch):
javac Support/*.java Me/*.java Wrapers/*.java
But if your build process gets more complex (and it will!), you should look into using Apache Ant for build automation.

You should use build tools like Maven or Ant for such tasks.
In the initial stages, when the project is not very complex you can use the following line to compile, with appropriate classpath in place(as suggested by #Michael):
javac Support/*.java Me/*.java Wrapers/*.java

javac -d compiled $(find src -name *.java)

If you really need to just use javac and standard UNIX commands you could to this:
find src -name \*.java -print0 | xargs -0 javac -d classes

The real answer is javac -d (places where classes to be built and placed) -sourcepath (source of the package at the root) -cp (classpath of the dependencies which can again be classes folder where the classes are build and kept) full qualified name of the java file.
Ex javac -d classes -sourcepath src -cp classes src\com\test\FirstSample.java
The FirstSample.java contains the main method. Pacjage structure mentioned below.
Before compiling
HomeApp
--src
------com\test\FirstSample.java (First Sample using the FirstPojo.java)
------com\test\FirstPojo.java
--classes
After compiling
HomeApp
--src
------com\test\FirstSample.java (FirstSample.java using the FirstPojo.java)
------com\test\FirstPojo.java
--classes
------com\test\FirstSample.class (FirstSample.class using the FirstPojo.class)
------com\test\FirstPojo.class

In many cases Ant is overkill. Just use a BAT file if you are in windows or a shell script (sh file) if you are in linux. You can create a text file which includes all your javac commands and just run that file when you want to build.
For example, I use the following bat file to build one of my apps:
#echo off
echo Building Shazaam...
del classes\com\aepryus\shazaam\*.* /q
del classes\com\aepryus\shazaam\engine\*.* /q
del classes\com\aepryus\shazaam\domain\*.* /q
del classes\com\aepryus\shazaam\persist\*.* /q
del classes\com\aepryus\shazaam\view\*.* /q
del classes\com\aepryus\shazaam\task\*.* /q
del classes\com\aepryus\shazaam\action\*.* /q
del classes\com\aepryus\shazaam\controller\*.* /q
javac src\com\aepryus\shazaam\*.java -classpath \lib\AepUtil.jar;\lib\AepXML.jar;\lib\AepLoom.jar; -d classes
javac src\com\aepryus\shazaam\engine\*.java -classpath \lib\AepUtil.jar;\lib\AepXML.jar;\lib\AepLoom.jar;\lib\Sprout.jar;classes; -d classes
javac src\com\aepryus\shazaam\domain\*.java -classpath \lib\AepUtil.jar;\lib\AepLoom.jar;\lib\Sprout.jar;classes; -d classes
javac src\com\aepryus\shazaam\persist\*.java -classpath \lib\AepUtil.jar;\lib\AepLoom.jar;\lib\Sprout.jar;classes; -d classes
javac src\com\aepryus\shazaam\view\*.java -classpath \lib\Servlet.jar;\lib\AepUtil.jar;\lib\AepXML.jar;\lib\AepLoom.jar;\lib\AepHTML.jar;\lib\Sprout.jar;classes; -d classes
javac src\com\aepryus\shazaam\task\*.java -classpath \lib\AepUtil.jar;\lib\AepLoom.jar;\lib\AepHTML.jar;\lib\Sprout.jar;classes; -d classes
javac src\com\aepryus\shazaam\action\*.java -classpath \lib\Servlet.jar;\lib\AepUtil.jar;\lib\AepLoom.jar;\lib\AepHTML.jar;\lib\Sprout.jar;classes; -d classes
javac src\com\aepryus\shazaam\controller\*.java -classpath \lib\Servlet.jar;\lib\AepUtil.jar;\lib\AepXML.jar;\lib\AepRPC.jar;\lib\AepLoom.jar;\lib\AepHTML.jar;\lib\Sprout.jar;classes; -d classes
cd classes
jar cf ..\war\WEB-INF\lib\Shazaam.jar .
cd..
echo Complete

To compile Run below command [it will store all class files in classes folder]
javac -d classes Support/*.java Me/*.java Wrapers/*.java
**Note : classes folder should be created first
To Run java application, run below command
java -cp classes {mainfile_name}
Replace mainfile_name with your main file.