Security Policy

[🏠 Overview](../README.md) • [📦 Installation](INSTALLATION.md) • [📖 Usage](USAGE.md) • [🏗️ Architecture](ARCHITECTURE.md) • [🏢 Enterprise](ENTERPRISE.md) • [🔒 Locking](LOCKING.md) • [🌐 Networking](NETWORKING.md) • [🐚 Shells](SHELLS.md) • [🎯 Threat Matrix](THREAT-MATRIX.md) • [❓ FAQ](FAQ.md) • [⚖️ SDKMAN! Comparison](SDKMAN-Comparison.md) • [📜 Changelog](CHANGELOG.md) • [🛡️ Security](SECURITY.md) • [🤝 Contributing](CONTRIBUTING.md) • [💬 Support](SUPPORT.md)

`, or `--key-file `. Hardcoded fallback secrets are completely eliminated, failing closed with a structured diagnostic if omitted (`CWE-798: Use of Hard-coded Credentials`). - **GitHub Releases API Asset Digest Discovery**: When upstream projects hosted on GitHub Releases do not provide standalone `.sha256` files (such as Micronaut CLI `micronaut-projects/micronaut-starter`), JVM automatically queries the official GitHub Releases REST API (`https://api.github.com/repos///releases/tags/`) to retrieve the asset's cryptographic `digest` (`sha256:`). All API requests pass through strict `Test-TrustedJvmUri` domain allowlisting and open redirect validation (`CWE-918` / `CWE-601`). - **Interactive Unverified Fallback Prompt**: In interactive UI mode, if a tool payload has neither a standalone checksum file nor an API digest, JVM prompts the user: `Do you want to continue installation without checksum verification? (y/N)` instead of failing closed with an unusable CLI flag instruction. - Checksum validation is strictly decoupled from interactive prompts: passing `-y` / `--yes` only suppresses confirmation dialogs and will **never** bypass integrity verification. - In non-interactive or CLI mode, bypassing checksum validation requires an explicit, intentional `--skip-checksum` (or `--no-verify`) flag for air-gapped or legacy mirrors without published hashes. Environment-based bypasses (`JVM_SKIP_CHECKSUM=1`) are intentionally ignored and killed to prevent silent supply-chain tampering, and automated CI runs explicitly mandate `--yes` alongside `--skip-checksum` (`CWE-494`). ### 3. Repository File Fail-Closed Validation (`.java-version` & `.sdkmanrc` Hardening) - **Vulnerability Mitigated:** Arbitrary shell command execution or silent validation bypass via untrusted project repository files (`.java-version` or `.sdkmanrc`). - **Architectural Defense:** - **Fail-Closed Non-Filtering Parser Boundary:** Rather than using `findstr /v` as a pre-filter (which could silently drop an injected or malformed `java=` or ecosystem line and allow the rest of `.sdkmanrc` or `.java-version` to appear valid), `jvm.bat` inspects all non-comment lines (`%FINDSTR_BIN% /r /v "^[ \t]*# ^ï»¿[ \t]*# ^[ \t]*$"`) for shell and expansion metacharacters (`[&|<>`%%!;$()^{}\"]`) and missing `=` delimiters first—immediately setting `JV_PARSE_ERR=1`, `SDK_PARSE_ERR=1`, or `SDK_ECO_ERR=1` and aborting (`exit /b 1`) if any unsafe line is present. - Every active `java=` and ecosystem entry (`maven=`, `gradle=`, `kotlin=`, `scala=`, `groovy=`) is then passed (`tokens=1,* delims==`) to `:ParseJavaVersion`, `:ParseSdkmanrc`, and `:ProcessEcosystemSession` (`:ValidateStrictIdentifier`), failing closed on any invalid version, unsupported vendor, or reserved keyword (`current`). ### 4. Buffer Overflow & Environment Truncation Defense - **Vulnerability Mitigated:** Legacy Windows `setx.exe` imposes a hard 1,024-character buffer limit on the `PATH` environment variable. Running `setx` on a workstation with a long `PATH` silently truncates the tail of the variable, corrupting system-wide software installations. - **Architectural Defense:** All global and machine environment updates leverage infinite-length .NET environment APIs (`[Environment]::SetEnvironmentVariable`), completely bypassing `setx.exe` buffer overrun vulnerabilities. ### 5. Cryptographic Supply Chain Provenance (SLSA / Sigstore) - **Vulnerability Mitigated:** Unauthorized binary replacement or build injection. - **Architectural Defense:** Official release binaries (standalone MSIs, portable ZIPs) are built in isolated GitHub Actions runners and cryptographically signed using GitHub's OIDC Sigstore attestation authority (`actions/attest-build-provenance`). - **Verification Command:** ```bash gh attestation verify jvm-windows-1.0.1-x64.msi --owner DiamTek ``` ### 6. Dual Update Channel Integrity, Unified Uninstaller Verification & Downgrade Prevention - **Vulnerability Mitigated:** In-transit modification of self-updater or uninstaller payloads, local uninstaller tampering, malicious mirror spoofing, accidental or unauthorized rollbacks to older vulnerable versions, and script-locking denial-of-service. - **Architectural Defense:** - **`[Stable]` Channel:** Pulls release artifacts and computes SHA-256 digests in-memory via `System.Security.Cryptography.SHA256`, strictly matching against signed upstream `SHA256SUMS.txt` manifests before replacing or executing local files (`install.ps1`, `jvm.bat`, and `uninstall.ps1`). Any hash deviation immediately aborts execution and purges temporary files. - **`[Nightly]` Channel & Unified `uninstall.ps1` Trust Model:** Fetches the direct commit tip of `main`, parses semantic build stamps (`JVM_BUILD`), and cryptographically verifies downloaded and local payloads (`install.ps1` in `:SelfUpdate`, `jvm.bat` and `uninstall.ps1` in `install.ps1`, and `uninstall.ps1` in `:UninstallJVM_Complete` / `:VerifyDownloadedScript`) against the GitHub Contents API **Git Blob SHA-1** (`SHA1("blob " + length + "\0" + bytes)` matched against `.sha` at `ref=main`), backed by a DACL-protected `uninstall.ps1.sha256` sidecar digest written by `install.ps1` at install time for offline verification. Any tampering or hash mismatch immediately aborts with `MISMATCH`. - **Downgrade Safeguard:** Both channels compare local `JVM_BUILD` integers against remote payloads. If a local workstation is running a build with an integer greater than the upstream target (`local > remote`), the updater halts execution (`[ SKIP ] You are on a newer local build`), preventing accidental regression. - **Decoupled Ephemeral Runner:** Executable replacement occurs via a detached runner script that polls for file handle release before atomic filesystem replacement, preventing partial write corruption. ### 7. Windows Alternative Data Streams (ADS) and Poison Character Neutralization - **Vulnerability Mitigated:** Arbitrary filesystem stream targeting, file disguise via NTFS Alternate Data Streams (`filename:stream`), Win32 path canonicalization bypasses via trailing periods or whitespace, command-line parameter poisoning via shell metacharacters (`^`, `&`, `|`, `<`, `>`, `;`, `"`, `!`, `%`), argument/flag injection (`-`), wildcard expansion attacks (`*`, `?`), and Windows device namespace lockups (`CON`, `NUL`, `AUX`, `PRN`, `COM1-9`, `LPT1-9`). - **Architectural Defense:** - Implemented in `jvm.bat` under `:ValidateStrictIdentifier`, enforcing an airtight multi-phase defensive pipeline: - **Delayed Expansion Segregation:** Validation begins under `setlocal disabledelayedexpansion`. In Windows `cmd.exe`, evaluating untrusted strings containing exclamation marks (`!`) or percent signs (`%`) while delayed expansion is active can cause variable mutation or subshell command execution. The validator quarantines `%_VSI_RAW%` and uses parenthesized, quoted checks (`echo("%_VSI_RAW%" | findstr "!"` and `findstr "%%"`) to reject toxic inputs prior to enabling delayed expansion. - **Win32 Canonicalization Bypass Prevention (`:VSI_StripTrailing`):** The Win32 subsystem automatically strips trailing dots (`.`) and spaces (` `) during path normalization (e.g., `folder.` or `folder ` resolves identically to `folder`). Attackers exploit this behavior to bypass validation blacklists or trigger unexpected directory collisions. `:VSI_StripTrailing` iteratively strips trailing dots and spaces in a loop until the string is completely normalized. If stripping results in an empty value, execution immediately halts. - **Alternate Data Stream (ADS) Colon Neutralization:** On NTFS filesystems, colons separate filenames from Alternate Data Streams (e.g., `file.txt:hidden.exe`). Colon (`:`) characters are strictly forbidden and checked via batch substring substitution: ```cmd if not "!_VSI_VAL!"=="!_VSI_VAL::=!" ( endlocal & endlocal set "JVM_EXIT_CODE=1" exit /b 1 ) ``` - **Path Traversal & Separator Quarantine:** Slashes (`\`, `/`) and relative directory traversals (`..`) are filtered using internal substring substitutions (`!_VSI_VAL:\=!`, `!_VSI_VAL:/=!`, `!_VSI_VAL:..=!`), completely preventing directory traversal escapes. - **Leading Flag/Hyphen Neutralization:** Identifiers beginning with a hyphen (`-`) are immediately rejected (`if "!_VSI_VAL:~0,1!"=="-"`), neutralizing command-line flag injection into downstream sub-commands or native tools. - **Internal Substitution Checks vs. Piped FINDSTR:** Characters with syntactic meaning in `cmd.exe` (`^`, `&`, `|`, `<`, `>`, `;`, `"`) are tested through internal batch substitution (`set "_VSI_SUB=!_VSI_VAL:&=!"` etc.). Using batch substitution rather than piping to `findstr` prevents poison metacharacters from escaping into subshells or pipeline boundaries during the check itself. - **Wildcard, Extended DOS Device & Win32 Namespace Sanitization (`CWE-66` / `CWE-155`):** Wildcards (`*`, `?`) are detected using pure-batch character loops and quoted regular-expression pattern matching. Legacy MS-DOS reserved device names (`CON`, `PRN`, `AUX`, `NUL`, `COM1`-`COM9`, `LPT1`-`LPT9`), extended DOS device names with extensions (`CON.jdk`, `NUL.21`, `AUX.txt`, `COM1.jdk` via base-name extraction before `.`), and Win32 raw device path namespaces (`\\.\`, `\\?\`, `\??\`) are explicitly blocked to prevent Windows kernel file handle hangs or device access. - **Pre-Delayed-Expansion Exclamation Guard (`:RejectExclamationArg`):** Before `setlocal enabledelayedexpansion` is activated at script startup, `:RejectExclamationArg` inspects raw CLI parameters (`%~1`..`%~9`) under `setlocal disabledelayedexpansion`. This prevents `cmd.exe` from silently stripping unpaired `!` characters (e.g., turning `foo!bar` into `foobar`) during Phase 2 parser evaluation. - **Zero-Subshell Pure-Batch Character Loop (`:VSI_CharLoop`):** Identifier character validation (including `*`, `?`, and `"`) and `jvm doctor` / `jvm list` vendor checks execute entirely in pure batch using substring extraction and delayed-expansion substitution (`!VAR:sub=!`), avoiding piping untrusted strings to external utilities (`find.exe`, `findstr.exe`) or spawning subshells where command injection could occur. - **System32 Binary Pinning & CWD Planting Immunity (`CWE-426` / `CWE-427`):** `jvm.bat` verifies `%SystemRoot%\System32\cmd.exe` existence (`if not exist "%SystemRoot%\System32\cmd.exe" set "SystemRoot=C:\Windows"`), sets `NoDefaultCurrentDirectoryInExePath=1`, pins all external Windows binaries (`cmd.exe`, `reg.exe`, `find.exe`, `findstr.exe`, `where.exe`, `choice.exe`, `timeout.exe`, `fsutil.exe`, `powershell.exe`, `chcp.com`, `icacls.exe`, `attrib.exe`, `explorer.exe`) to `%SYS32%` (`%..._BIN%`), and executes `where.exe` exclusively as `%WHERE_BIN% $PATH:java`, preventing Trojan binary execution from untrusted working directories. - **ACL-Locked & Reparse-Safe Isolated Temp Workspace (`:EnsureSecureTemp` & `:EmitSessionEnv` — `CWE-20` / `CWE-276` / `CWE-377`):** All temporary helper scripts and `.jvm_session_target` files are isolated inside `%LOCALAPPDATA%\DiamTek\JVM\temp` after verifying the directory is not a reparse point (`%FSUTIL_BIN% reparsepoint query`) and locking DACLs atomically (`icacls /inheritance:r /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" "%USERNAME%:(OI)(CI)F"`), with `JVM_CALLER_PID` validated strictly as a positive numeric PID in `:EmitSessionEnv`. ### 8. Non-Destructive Reparse Point & Junction Lifecycle - **Vulnerability Mitigated:** Accidental or malicious destruction of host JDK directories during unlinking, uninstallation, or switching; recursive traversal into junction targets; and reparse point auto-recovery deadlocks caused by Win32 `if exist` semantics on dangling junctions. - **Architectural Defense:** - **Reparse Point Target Isolation (`Remove-DirectorySafely`):** Naive recursive folder deletion (such as standard PowerShell `Remove-Item -Recurse` or batch commands) can follow directory junctions and wipe the contents of the target installation folder (e.g., deleting the real JDK installation at `C:\Program Files\Java\jdk-21` when attempting to clean up `%LOCALAPPDATA%\DiamTek\JVM\current`). `Remove-DirectorySafely` (implemented in `uninstall.ps1` and `build-msi.ps1`) and `:CleanCache` (`jvm clean` / `jvm prune`) inspect directory attributes using `($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint)`: - If the directory root is a reparse point, it is unbound immediately using `[System.IO.Directory]::Delete($path, $false)` or `cmd.exe /c "rmdir /q \"$path\""`. The non-recursive unbind removes the junction pointer while leaving the target JDK directory contents 100% untouched. - Child reparse points within candidate and cache stores are enumerated and safely unbound bottom-up prior to deleting parent directories. - Tree deletion subsequently leverages `cmd.exe /c "rmdir /s /q \"$Path\""` to guarantee junction safety in Windows PowerShell 5.1 without risking target deletion. - **Broken Junction Auto-Recovery Without `if exist` Deadlock:** - In Windows `cmd.exe`, the `if exist ` operator evaluates whether the *target* directory of a directory junction exists, not whether the reparse point itself exists on disk. - If a user moves or deletes a JDK from disk, the junction pointing to it becomes "broken" or "dangling". A traditional script executing `if exist "%LINK%" rmdir "%LINK%"` evaluates to `false`, skipping deletion. When the script subsequently executes `mklink /J "%LINK%" "%NEW_TARGET%"`, Windows returns Win32 Error 183 (`ERROR_ALREADY_EXISTS: Cannot create a file when that file already exists`). - JVM completely eliminates this deadlock by unconditionally executing `rmdir "!CURRENT_SYMLINK!" >nul 2>&1` without preceding `if exist` checks before every junction creation, ensuring instant, deterministic unbinding and self-healing. ### 9. Registry ValueKind Preservation & Non-Blocking Broadcasts - **Vulnerability Mitigated:** Environment variable corruption through unintended type downgrades (converting dynamic `REG_EXPAND_SZ` variables to static `REG_SZ`), premature expansion of system variables (`%SystemRoot%`, `%USERPROFILE%`), buffer overflow truncation across user/machine boundaries, and terminal/installer deadlocks caused by unresponsive top-level desktop windows during environment broadcasts. - **Architectural Defense:** - **ValueKind Preservation (`REG_EXPAND_SZ` vs `REG_SZ`):** - Reading registry values via standard high-level APIs often automatically expands nested environment strings, converting paths like `%SystemRoot%\System32` into `C:\Windows\System32`. Writing this expanded value back as a standard `REG_SZ` permanently breaks roaming profiles, variable relocations, and dynamic OS resolution. - `install.ps1`, `uninstall.ps1`, and `build-msi.ps1` query registry keys directly using `[Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Environment')` with `[Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames`. - The engine determines the existing type via `$key.GetValueKind('Path')`. It strictly preserves `REG_EXPAND_SZ` (`[Microsoft.Win32.RegistryValueKind]::ExpandString`) whenever variable delimiters (`%`) are present or previously configured, preventing inadvertent type demotion to `REG_SZ`. - **PATH Buffer & Truncation Safeguards:** - The engine computes combined PATH lengths (Machine PATH + User PATH) and enforces an 8,191-character hard ceiling (aborting modifications if exceeded to prevent environment block overflow) and a 2,048-character Win32 compatibility threshold with visual warnings. - **Non-Blocking Environment Broadcast (`SendMessageTimeout`):** - To notify the Windows shell, File Explorer, and active services of environment updates (`PATH`, `JAVA_HOME`), scripts broadcast the `WM_SETTINGCHANGE` (`0x001A`) message to `HWND_BROADCAST` (`0xFFFF`) with `lParam = "Environment"`. - Standard synchronous `SendMessage` calls block indefinitely if any running application has an unresponsive message pump (e.g., a hung tray utility or frozen GUI program). - JVM executes a native Win32 P/Invoke call to `SendMessageTimeout` with flags `fuFlags = 2` (`SMTO_ABORTIFHUNG`) and a timeout parameter `uTimeout = 5000` (5,000ms): ```powershell [Win32.NativeMethods]::SendMessageTimeout( $HWND_BROADCAST, $WM_SETTINGCHANGE, [UIntPtr]::Zero, 'Environment', 2, # SMTO_ABORTIFHUNG (0x0002) 5000, # 5,000 ms timeout [ref]$result ) | Out-Null ``` - If any desktop window is hung, Windows immediately aborts waiting on that window and resumes broadcasting to the remaining windows, guaranteeing zero process hangs or installer freezeups. ### 10. Enterprise PowerShell & Constrained Language Mode - **Vulnerability Mitigated:** Script crashes, permission denials, and installation failures on corporate enterprise endpoints enforced by AppLocker or Windows Defender Application Control (WDAC) running in PowerShell Constrained Language Mode (CLM); network download failures in enterprise proxy environments requiring integrated Windows authentication (NTLM/Kerberos). - **Architectural Defense:** - **Constrained Language Mode (CLM) Fail-Closed Installer Guard & Runtime Hook Resiliency (`CWE-754` / `CWE-755`):** - Because `install.ps1` and `uninstall.ps1` must enforce NTFS DACL isolation (`icacls /inheritance:r`), .NET cryptographic SHA-256 verification, and `DoNotExpandEnvironmentNames` registry preservation, both scripts enforce an early fail-closed check (`if ($ExecutionContext.SessionState.LanguageMode -ne 'FullLanguage') { exit 1 }`) so they never execute partially without cryptographic or ACL protections. - For daily runtime usage under WDAC / AppLocker, the core `jvm.bat` engine runs in native `cmd.exe` (outside PowerShell language mode restrictions) and the `$PROFILE` session hook (`Set-JvmVar`) uses CLM-compliant `Set-Item -Path "env:$Name"` provider cmdlets. - **Enterprise Authenticated Proxy Support (`DefaultNetworkCredentials`):** - Corporate networks typically route outbound traffic through enterprise proxy firewalls requiring Integrated Windows Authentication (IWA). Unauthenticated requests fail with HTTP 407 (Proxy Authentication Required). - When running in Full Language mode, `install.ps1` binds system proxy credentials to native Kerberos/NTLM credentials: ```powershell if ([System.Net.WebRequest]::DefaultWebProxy) { [System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials } ``` - On modern PowerShell (PS 6+ / 7+), it configures automatic corporate proxy delegation via default parameter values: ```powershell $PSDefaultParameterValues['Invoke-WebRequest:ProxyUseDefaultCredentials'] = $true $PSDefaultParameterValues['Invoke-RestMethod:ProxyUseDefaultCredentials'] = $true ``` - This allows seamless downloads from vendor endpoints (Adoptium, GitHub, Azul) across enterprise proxy gateways without credential prompts or plaintext credential storage. ### 11. Atomic Failure-Path Rollback, Deterministic Resource Hygiene & Zero Silent Exceptions - **Vulnerabilities Mitigated:** Broken filesystem states, orphaned junctions, dangling registry entries, leaked Win32/COM handles, silent exception swallowing (`CWE-390`), untracked command failures (`CWE-252`), incomplete partial downloads (`CWE-459`), and sensitive path leakage in error logs (`CWE-209`). - **Architectural Defense:** - **Atomic Junction & State Rollback (`CWE-460`):** When switching the active JDK (`CURRENT_SYMLINK`) or an ecosystem candidate (`:SwitchCandidate`), `jvm.bat` reads the existing junction target into `PREV_JUNCTION_TARGET` before unlinking. If `mklink /J` fails (`if errorlevel 1`), the engine automatically restores the previous junction target, outputs an error diagnostic, and halts with `exit /b 1` rather than proceeding with a severed junction. - **Staged Installation & Package Rollback (`CWE-460`):** `install.ps1` snapshots existing `jvm.bat` to `$batBackup = "$batPath.bak..tmp"` prior to staging. If companion verification fails or an exception occurs, the overarching `finally` block atomically restores `$batBackup` back to `$batPath`. `packages/msi/test-msi.ps1` registers an emergency `msiexec /x` rollback in its outer `finally` block if interrupted mid-test. `packages/choco/build-choco.ps1` snapshots all package manifests (`.nuspec`, `chocolateyInstall.ps1`, `chocolateyUninstall.ps1`) and restores originals on build failure. - **Deterministic Resource & Handle Lifecycle (`CWE-459`):** All Win32 Registry keys (`OpenSubKey`), network handles (`HttpWebResponse`, `StreamReader`), COM objects (`WScript.Shell`, `IWshShortcut`, `WindowsInstaller.Installer`), and cryptography providers (`SHA1`, `SHA256`) are managed within deterministic `try / finally` disposal patterns. All temporary staging files (`*.stage.*.tmp`, `*.bak.*.tmp`) and truncated downloads (`Invoke-TrustedGitHubDownload`) are purged in `finally` blocks. - **Zero Silent `catch {}` Swallowing & Path Redaction (`CWE-209` / `CWE-390`):** PowerShell AST analysis enforces **0 empty `catch {}` blocks across all 9 repository PowerShell scripts** (`Test 157`). All error handlers log structured single-line warnings via `Write-Verbose` or `[ WARN ]`, stripping raw stack traces and redacting sensitive user profile paths (`%LOCALAPPDATA%`, `%USERPROFILE%`). - **Strict Exit Code Propagation (`CWE-252` / `CWE-754` / `CWE-755`):** All CLI subcommands (`doctor`, `which`, `open`, `exec`, `hook`, `clear`, `channel`, `pin`) route through `:CLI_DONE` with `endlocal & set "CMD_EXIT_CODE=%CMD_EXIT_CODE%" & exit /b %CMD_EXIT_CODE%`, propagating non-zero codes across batch scope boundaries. All 6 elevated UAC handoffs (`Start-Process -Verb RunAs`) specify `-PassThru`, dispose child process handles, and propagate `$p.ExitCode`. ### 12. Automated 327-Test Security Suite & 41-CWE Coverage Matrix (`tests/Test-JvmSecurity.ps1`) Every commit and release is continuously verified by `tests/Test-JvmSecurity.ps1`, which executes **327 automated adversarial test cases across 16 defensive suites** with a 100% pass rate (`327 / 327 PASS`) and outputs a numerically sorted **41-CWE Coverage Summary**: | CWE ID | Vulnerability Class | Tests Verified | Status | |:---|:---|:---:|:---:| | **`CWE-20`** | Improper Input & Config Validation (`.java-version` BOM/CRLF, `.sdkmanrc` fail-closed validation, `JVM_CALLER_PID`, `LATEST_VER`, `CUSTOM_VER`, `REL_ADOPTIUM`, `bump-version.ps1`, winget schema, Semeru/Corretto build parsing, interactive uninstaller menu, `--json` parsing contract, `DO_PIN_WRITE` validation, locked candidate/version validation, lock CLI aliases, PowerShell dynamic tab completion coverage, exact semantic build `+` support, `jvm cache` CLI arguments, `jvm search` candidate tool routing and shorthand queries, `jvm compare` specification baseline and multi-LTS milestone JEP chaining, PowerShell profile hook status inspection, single-value queries, `why` resolution graph, `explain` 7-layer architecture, `welcome` tutorial, toolchain conflict detectors, subcommand dedicated help card routing, universal structured JSON API contract envelope) | **70 / 70** | **PASS** | | **`CWE-22`** | Path Traversal & ZipSlip (`..`, `/`, `\`, sibling-prefix collisions, rooted archive entries, `:FetchAndExtract` `GetFullPath`, `jvm cache import` entry containment validation, `jvm install --locked` ancestor traversal, locked tool candidate traversal) | **25 / 25** | **PASS** | | **`CWE-41`** | Win32 Canonicalization Bypass (`current.`, `current `, multiple trailing dots/spaces) | **6 / 6** | **PASS** | | **`CWE-59`** | Symlink & Junction Safety (`Remove-DirectorySafely`, `Remove-ReparsePointOrFail`, `Test-HasReparsePointInLineage`, `CURRENT_SYMLINK`, `:WriteConfigFile`, `:EmitSessionEnv`, `jvm link`/`unlink`, `:UninstallCandidate`, elevated `:UninstallJDK`, `build-msi.ps1` hooks, `:CleanCache`, `jvm pin`, `$PROFILE` reparse guards, `.jvm.lock` reparse point / junction rejection, `jvm cache import` reparse point rejection) | **36 / 36** | **PASS** | | **`CWE-66`** | DOS Reserved Device (`CON`, `NUL.jdk`, archive entry device names) & NTFS ADS (`:stream`, `\\.\`) Abuse | **5 / 5** | **PASS** | | **`CWE-73`** | Environment, Registry ValueKind, `Test-TrustedJvmInstallDirectory` (`InstallLocation` / `-SourceDir` early abort), System Root Protection, Content-Addressed Storage layout, and `ownership.json` variable tracking | **14 / 14** | **PASS** | | **`CWE-74`** | XML Attribute & Template Injection (`Escape-XmlAttr` / `[System.Security.SecurityElement]::Escape` in `build-msi.ps1`) | **2 / 2** | **PASS** | | **`CWE-78`** | OS Command & Shell Metacharacter Injection (`:ValidateStrictIdentifier`, `:RejectExclamationArg`, `:EcoPerformCheck`, `:ShowDynamicMenu`, `:ShowCurrentStatus`, `:DoctorDiagnostics`, pipe-free `:SwitchCandidate`, `Invoke-DeferredDirectoryCleanup`, `UPDATE_CHECKER_PS1` pipe character escaping, Oracle JDK 27 batch parenthesis integrity) | **28 / 28** | **PASS** | | **`CWE-88`** | Argument & Flag Injection (`--evil-flag`, `--vendor` poisoning, `jvm exec`, `jvm open` comma delimiter guard, `DL_STRIP_ROOT` leading hyphen guard, URL/PS metacharacter filter in `:ValidateStrictIdentifier`, `jvm run` contextual wrapper arguments) | **10 / 10** | **PASS** | | **`CWE-94`** | Batch `set /a` Arithmetic Expression & Variable Assignment Evaluation Defense (`:ShowDynamicMenu` `JAVA_VERSION` numeric guard) | **1 / 1** | **PASS** | | **`CWE-155`** | Wildcard Expansion Injection (`*`, `?`) | **2 / 2** | **PASS** | | **`CWE-184`** | Incomplete List-Based Input Sanitization (Clean working tree enforcement in `bump-version.ps1` & manifest validation) | **4 / 4** | **PASS** | | **`CWE-209`** | Error Message Stack-Trace, Contextual Actionable Errors, Sensitive User Path Suppression, Universal CLI Logging (`--quiet`, `--verbose`), Diagnostic Report Secret Redaction (`jvm report`) & Centisecond Execution Timing Breakdown (`--timings`) Stderr Isolation | **10 / 10** | **PASS** | | **`CWE-250`** | Privilege Boundary Isolation (Base64 UTF-16LE `-EncodedCommand` AST immunity & `persist-credentials: false` in GitHub Actions) | **2 / 2** | **PASS** | | **`CWE-252`** | Unchecked Return Value, Semantic Exit Codes (0-10) & Process Exit Code Propagation | **20 / 20** | **PASS** | | **`CWE-276`** | Strict Directory DACL & Reparse Isolation (`%JVM_SECURE_TEMP%`, `Initialize-SecureDirectory` fail-closed enforcement, First-Run `.initialized` permission bounds) | **3 / 3** | **PASS** | | **`CWE-295`** | TLS 1.2 / 1.3 Cryptographic Protocol Enforcement (`:ExecuteSharedDownloader`, `:SelfUpdate`, `:CheckUpdateStatus`) | **3 / 3** | **PASS** | | **`CWE-319`** | Strict `https://` URI Scheme & Redirect Enforcement (`:ExecuteSharedDownloader`, `chocolateyInstall.ps1`, `.jvm.lock` non-HTTPS rejection, enterprise download mirror URL validation) | **5 / 5** | **PASS** | | **`CWE-330`** | CSPRNG Temp Filename Entropy (Zero predictable `!RANDOM!` paths; `[System.IO.Path]::GetRandomFileName()`) | **1 / 1** | **PASS** | | **`CWE-345`** | Version & Monotonic `JVM_BUILD` Downgrade Attack Defense (Alongside MSI Authenticode signing hook verification & 3-state lockfile signature verification) | **7 / 7** | **PASS** | | **`CWE-354`** | Checksum Manifest Format Validation & SHA-256 Gate Enforcement (`.jvm.lock` SHA-256 validation, authentic distribution archive freeze resolution & tamper defense) | **18 / 18** | **PASS** | | **`CWE-362`** | Race Condition & Concurrent State (`state.lock` mutex wait loop, atomic dead-PID takeover via staged `owner.pid` replacement with `--no-lock` unsafe override, `:WriteConfigFile` atomic replacement via `.stage.!_CFG_RND!.tmp`, `.jvm.lock` atomic staged write `.stage..tmp`, `jvm transaction` journaling & rollback) | **12 / 12** | **PASS** | | **`CWE-367`** | Atomic Staged Profile & Config File Writes (`Move-Item -LiteralPath`, Windows Terminal file-lock retry/backup, UTF-8 No BOM) | **3 / 3** | **PASS** | | **`CWE-377`** | Insecure Temporary File & Protected DACL Verification (Get-Acl / icacls fallback cross-version compatibility) | **2 / 2** | **PASS** | | **`CWE-390`** | Error Condition Action, AST Zero-Silent-Catch Audit & Logging | **4 / 4** | **PASS** | | **`CWE-400`** | Hang & Parser Resilience (`SendMessageTimeout`, state lock wait timeout, PATH boundaries, `NO_COLOR`, JSONC, Resumable Range `.part` download staging, Adaptive Terminal Width, Real-time speed/ETA throttling, Cache telemetry & dedupe loops) | **14 / 14** | **PASS** | | **`CWE-409`** | Zip Bomb & Decompression Bounds (`40,000` entry ceiling & `1.75 GB` cumulative decompressed byte cap) | **1 / 1** | **PASS** | | **`CWE-426`** | Untrusted Search Path & CWD Trojan Binary Planting Defense (`%SYS32%`, `$PATH:java`, `chocolateyUninstall.ps1`, `test-msi.ps1`, license header pinning bootstrapping) | **9 / 9** | **PASS** | | **`CWE-427`** | Uncontrolled `PATH` Search-Order Hijack Immunity & Canonical `%LOCALAPPDATA%\DiamTek\JVM\bin` Registration | **4 / 4** | **PASS** | | **`CWE-428`** | Quoted `System32` `UninstallString` / `QuietUninstallString` & Pinned Shortcut `TargetPath` | **1 / 1** | **PASS** | | **`CWE-459`** | Failure-Path Handle Disposal (`finally`), Temporary Artifact & Stream Cleanup, Transaction Rollback Stale Lock Cleanup | **14 / 14** | **PASS** | | **`CWE-460`** | Exception Cleanup, Atomic State Rollback (`PREV_JUNCTION_TARGET`, `.old`, `.jvm_bak_`, `$batBackup`, `jvm transaction` rollback & aliases, cache import fail-safe cleanup, transactional snapshot restore dual rollback) & Universal `--dry-run` Simulation | **25 / 25** | **PASS** | | **`CWE-494`** | Supply Chain, Package Manifest, Fail-Closed Nightly Git Blob SHA-1, `Invoke-TrustedGitHubDownload`, `jvm install --locked` Checksum Verification, `jvm cache import` Content-Addressed Storage SHA-256 verification, explicit `--skip-checksum` warning flag, CI gating, Multi-Phase Installation pipeline & Rollback verification | **28 / 28** | **PASS** | | **`CWE-532`** | Sensitive Registry Backup (`%LOCALAPPDATA%\DiamTek\JVM\backups`) DACL & Reparse Isolation, Redacted Issue & Support Bundles (`jvm doctor --report`, `jvm support`) | **2 / 2** | **PASS** | | **`CWE-601`** | Open Redirect Host Verification (`ResponseUri` validation on payload, `Get-TrustedChecksumText`, `:ResolveLatestEcosystemCandidate`, & `:CheckUpdateStatus`) | **4 / 4** | **PASS** | | **`CWE-611`** | XML External Entity (XXE) & DTD Prohibition (`DtdProcessing::Prohibit` & `XmlResolver = $null`) | **4 / 4** | **PASS** | | **`CWE-674`** | Uncontrolled Recursion & Cyclic Loops (`Remove-DirectorySafely` iterative non-recursive queue pattern immune to self-referential junctions) | **1 / 1** | **PASS** | | **`CWE-754`** | Exceptional Condition Check, Local NTFS Volume Advisories, Colon Guards (`::::::::::::::::::::`), Fail-Closed Parameter Validation, Smart Retry Exponential Backoff (429/5xx handling), Universal JSON Contract Schema Envelope Validation | **20 / 20** | **PASS** | | **`CWE-755`** | Exceptional Condition Handling, Early `ConstrainedLanguageMode` Guard, Ctrl+C Offset Skip Absorption & Sanitized Exception Redaction | **8 / 8** | **PASS** | | **`CWE-798`** | Hardcoded Credentials Defense (Rejection of hardcoded default secrets in HMAC-SHA256 lockfile signing; strict fail-closed enforcement of caller-managed secrets via `$env:JVM_LOCK_SECRET`, `--secret`, or `--key-file`) | **1 / 1** | **PASS** | | **`CWE-918`** | SSRF & Vendor Domain Allowlist Enforcement (`Test-TrustedJvmUri` regex bounds, `chocolateyInstall.ps1` `$allowedHosts`, live CLI `--offline` network barrier, `jvm install --locked` host allowlist, and CAS offline install verification) | **7 / 7** | **PASS** | ### 13. Security & Error Management Audit Scorecard (`10.0 / 10.0`) | Audit Area | Subsystem Scope | CWE Classes Covered | Pass 4 Verification Status | Score | | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :---: | | **Core Batch Engine & Junctions** | `jvm.bat` (`CURRENT_SYMLINK`, `:SwitchCandidate`, `:UpdateSystemPath`, `:InstallGlobalCommand`, `:BackupRegistry`) | `CWE-59`, `CWE-252`, `CWE-459`, `CWE-460`, `CWE-754` | Verified atomic rollback on switch failures with emergency alert, local NTFS volume UNC advisories, verified exit-code propagation, and quarantined registry backups. | **10.0 / 10.0** | | **Downloader, APIs & Elevation** | `jvm.bat` (`:ExecuteSharedDownloader`, `:VerifyDownloadedScript`, `:SelfUpdate`, `:Run_API_Query`, UAC handoffs) | `CWE-209`, `CWE-252`, `CWE-459`, `CWE-460`, `CWE-755` | Verified deterministic `try / finally` disposal on `HttpWebResponse`, `StreamReader`, `SHA1`, and process elevation handles (`Start-Process -PassThru`). | **10.0 / 10.0** | | **Installers & Uninstallers** | `install.ps1` & `uninstall.ps1` | `CWE-73`, `CWE-209`, `CWE-252`, `CWE-276`, `CWE-367`, `CWE-390`, `CWE-459`, `CWE-460`, `CWE-494`, `CWE-674`, `CWE-754`, `CWE-755` | Verified atomic `$batBackup` rollback, fail-closed Nightly Git-blob SHA-1 verification, fail-closed `Initialize-SecureDirectory` DACL enforcement, partial download purging, COM apartment release, safe shortcut validation, early `ConstrainedLanguageMode` fail-closed policy, fail-closed invalid `-SourceDir` abort, and cyclic junction immunity (`Remove-DirectorySafely`). | **10.0 / 10.0** | | **Packaging & Build Pipelines** | `packages/msi/build-msi.ps1`, `packages/msi/test-msi.ps1`, `packages/choco/build-choco.ps1`, `scripts/bump-version.ps1` | `CWE-184`, `CWE-209`, `CWE-252`, `CWE-390`, `CWE-459`, `CWE-460`, `CWE-611`, `CWE-754` | Verified zero empty `catch {}` blocks via AST, emergency `msiexec /x` rollback, manifest rollback, clean git tree enforcement, and XXE prohibition. | **10.0 / 10.0** | | **Concurrency & State Synchronization** | `jvm.bat` (`:AcquireStateLock`, `:ReleaseStateLock`, `:WriteConfigFile`, `:EmitSessionEnv`, `%JVM_SECURE_TEMP%`) | `CWE-330`, `CWE-362`, `CWE-367`, `CWE-377`, `CWE-400` | Verified cross-process mutual exclusion (`state.lock`), atomic staged configuration replacement (`.stage.!_CFG_RND!.tmp` + `move /y`), CSPRNG random file naming, and per-user ACL lockdown. | **10.0 / 10.0** | | **Adversarial Test Suite** | `tests/Test-JvmSecurity.ps1` | All 41 MITRE CWE Classes | 327/327 tests passing (`0` failures) with runtime error injection, cyclic directory junction fuzzing, live process tree kill recovery, CAS cache verification, download throughput telemetry, subcommand dedicated help card routing, centisecond execution timing breakdown, universal structured JSON API contract envelope, environment profiles, snapshots, portable bundles, air-gapped distro kits, and automatic environment state preservation. | **10.0 / 10.0** | | **Overall Posture** | **Complete Repository Ecosystem** | **41 MITRE CWE Classes** | **Zero unhandled failure paths, zero leaked handles, zero silent catches, zero cyclic recursion hazards.** | **`10.0 / 10.0`** | --- ## Vulnerability Scope Matrix | Category | In-Scope | Out-of-Scope | |---|---|---| | **Remote Code Execution** | Unauthenticated RCE via auto-downloader, candidate engine, or archive unpacking | Code execution requiring an attacker to already control local administrator credentials | | **Path Traversal (Zip Slip)** | Archive extraction writing files outside `%LOCALAPPDATA%\DiamTek\JVM` | User explicitly running `jvm link` pointing to a compromised local directory | | **Privilege Escalation** | Bypassing standard user boundaries to gain Administrator rights without UAC consent | Attacker already having elevated Administrator or SYSTEM privileges on the machine | | **Command Injection** | Injecting commands via `.java-version`, `.sdkmanrc`, or CLI argument parsing | Manually editing the `jvm.bat` file on local disk | | **Alternative Data Streams & Canonicalization** | NTFS ADS stream injection (`:stream`) or trailing dot/space Win32 canonicalization bypasses in identifiers | Modifying NTFS metadata with raw disk write privileges | | **Reparse Point & Junction Target Deletion** | Recursive deletion traversing directory junctions to wipe host JDK installations | Manual deletion of target JDK folders by external tools or users | | **Environment & Registry Integrity** | Accidental type demotion of `REG_EXPAND_SZ` to `REG_SZ`, or PATH overflow truncation | Malicious software directly altering registry keys via background elevated service | | **Broadcast Deadlock & Hanging** | Stalled process execution during `WM_SETTINGCHANGE` environment broadcasts | Operating system kernel deadlock or failure of `user32.dll` subsystem | | **Transport Security** | Silent acceptance of tampered/corrupted downloads when checksum is expected | Network denial-of-service or outages on vendor APIs (Adoptium, Oracle, GitHub, BellSoft) | --- ## Reporting a Vulnerability If you discover a potential security vulnerability in DiamTek Java Version Manager, please report it through coordinated disclosure. **Do not create public GitHub issues or forum discussions for security vulnerabilities.** ### Reporting Channels 1. **GitHub Security Advisories (Preferred):** Navigate to the repository's [Private Vulnerability Reporting](https://github.com/DiamTek/Java-Version-Manager-Windows/security/advisories/new) page to open a confidential report. 2. **Direct Email:** Send an encrypted or plaintext report to the project maintainer: - **Contact:** Alexéy Shishkin - **Email:** **salexey09@gmail.com** 3. **Discord (Direct Message):** Reach out directly to **@thehawk01** on Discord for initial coordination. ### What to Include in Your Report To help us triage and reproduce the issue rapidly, please include: - The exact build number (`jvm version` or `cmd.exe /c "jvm.bat --version"`). - Target operating system and environment (e.g., Windows 11 23H2, standard user account vs. admin). - Step-by-step reproduction instructions or a minimal Proof of Concept (PoC) payload. - Assessment of the potential impact (e.g., LPE, arbitrary file write, shell injection). --- ## Response & Remediation SLA We take all security reports with utmost urgency: | Phase | Target SLA | Description | |---|---|---| | **Initial Acknowledgment** | **< 48 hours** | We confirm receipt of your report and begin preliminary assessment. | | **Triage & Reproduction** | **< 7 days** | We validate the PoC in an isolated Windows sandbox and determine severity. | | **Patch & Release** | **< 30 days** | We develop, verify via the automated test suite, and deploy a patched release. | | **Coordinated Disclosure** | Negotiated | We publish security advisories and credit reporters (unless anonymity is requested). | --- [← Back to Documentation Overview](../README.md#documentation)