Recursive depth-first Deep inspection of EAR/WAR/JAR

[stefan123t]

Given an EAR file a.ear containing amongst others eg. a WAR file b.war which again contains a JAR file named c.jar which may contain a repackaged / rebundled version of the susceptible JndiLookup/JndiContextSelector.classes make the script recurse into a.ear to unpack b.war and then c.jar to generate the hashes for comparison of the class files.

Ie. can the script run a recursive, depth-first search to find log4j or the suspected Class files in any packaged EAR/WAR/JAR combination our fellow developers came/come up with when developing and adding dependencies to their application stack of libraries ?

I would like to vote for such a deep inspection feature as I cannot get most other frameworks python3, Go based to run on the Servers for lack of language support.

Many thanks

[rubo77]

Go for it!

I'll accept a pull request