maven fails to find files in main package: ZIP file can't be opened as a file system because an entry has a '.' or '..' element in its name

Question

I have a maven project that I can no longer get to build:

mvn clean compile

ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.10.1:compile (default-compile) on project dise_java: Compilation failure: Compilation failure: 
[ERROR] /home/jeffemandel/springdise/dise_java/src/main/java/org/jeffmandel/springdise/CSPNonceFilter.java:[1,1] cannot access org.jeffmandel.springdise
[ERROR]   ZIP file can't be opened as a file system because an entry has a '.' or '..' element in its name

CSPNonceFilter is the first file encountered, otherwise, nothing special, but the first line is:

package org.jeffmandel.springdise;

I've updated JDK and maven to the latest versions, deleted my ~/.m2/repository and rebuilt it without success. Being desperate, I started commenting out dependencies in my POM, and found a single dependency that would cause the failure:

<dependency>
    <groupId>org.webjars.npm</groupId>
    <artifactId>vega</artifactId>
    <version>5.21.0</version>
</dependency>

Now I've had vega in my POM for some time, and it's a webjar, so why javac would care is beyond me. I can certainly work around this, but having killed a day on this, I want to understand. Thoughts?

Update: The reason for the sudden malfunction was that webjarlocator pulled in a new dependency for node-fetch that has a '.' in the path. The patch to JDK allowed me to see this:

 ZipException opening "node-fetch-3.0.0-beta.9.jar": ZIP file can't be opened as a file system because entry "/META-INF/resources/webjars/node-fetch/3.0.0-beta.9/./@types/index.d.ts" has a '.' or '..' element in its name

Explicitly providing version 2.6.7 in DependencyManagement fixes the problem. There is an open issue on this at webjars.org that I appended. I suspect there is some bug in the code that creates the jar from the npm.

Note that this was with Java 17.0.5:

mvn --version
Apache Maven 3.8.6 (84538c9988a25aec085021c365c560670ad80f63)
Maven home: /opt/mvn
Java version: 17.0.5, vendor: Private Build, runtime: /usr/lib/jvm/java-17-openjdk-amd64
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "5.4.0-132-generic", arch: "amd64", family: "unix"

Answer 1

I ran into the same issue for a Gradle project a few days ago and resolved it after some digging. Though not all details are exactly the same, I guess you probably had the same issue with me.

TL;DR:

It is caused by: 1) a JDK behavior change with certain zip files and, 2) certain dependency jars that are not standard formatted.

Fix the issue by: re-zipping the problematic zip file.

---

I'll explain my issue below:

1. JDK behavior change due to a bug fix

JDK had an issue processing zip files that contains certain special zip entries; '.' and '..' are such zip entries.

This JDK issue ticket https://bugs.openjdk.java.net/browse/JDK-8251329 fixed the issue by detecting such entries and throwing a ZipException. If you're interested in the code change, here's the commit (as commented in the ticket): https://github.com/openjdk/jdk/commit/3e3051e2ee93142983e9a3edee038e4f7b5ac0f2

Note:

This issue has also been backported to other major JDK versions like JDK 11/13/15/17/etc. so for all these major JDK versions, there is a certain minor version that included the code for such bug fix, and all minor versions after that one would have such behavior of throwing the Exception.

For my case, we first found such issue when trying to upgrade from JDK 8 to JDK 11; and this might also explain why you "can no longer get to build".

2. Dependency jars that are not "standard"

Normally in a dependency jar such entries shouldn't exist, but things may go wrong sometimes.

For my case, it's a locally imported javawddx.jar, originally downloaded from https://sourceforge.net/projects/javawddx/ as it's not published to maven repository.

(Notice there's a '.' directory entry in the jar.)

I solved the issue by deleting the '.' directory and re-zip the jar.

Answer 2

Unfortunately the exception does not tell you what entry caused it and in what file: They fixed it in JDK 19 however, you have to install it if you have this problem or write your own zip search code.... I decided to install JDK 19. This told me the spot so i was able to fix it:

ZipException opening "jcom.jar": ZIP file can't be opened as a file system because entry "/../manifest.mf" has a '.' or '..' element in its name

Answer 3

I wrote a Mojo to detect bad jars in the local repository.

@Mojo(name = "zipchecker")
public class zipcheckerMojo
        extends AbstractMojo {
    @Parameter(defaultValue = "${settings}", readonly = true)
    private Settings settings;
    private int numJars=0, numBadJars=0;

    public void execute() throws MojoExecutionException {
        String localRepository = settings.getLocalRepository();
        getLog().info("Scanning repository " + localRepository);
        try {
            Files.walk(Paths.get(localRepository)).filter(t -> {
                return FilenameUtils.isExtension(t.toString(), "jar");
            }).forEach(path -> {
                numJars++;
                try {
                    FileSystem zipfs = FileSystems.newFileSystem(path);
                    zipfs.close();
                } catch (ZipException ex) {
                    numBadJars++;
                    getLog().error(ex.getLocalizedMessage());
                } catch (IOException ex) {
                    System.out.println(ex.getLocalizedMessage());
                }
            });
        } catch (IOException ex) {
            System.out.println(ex.getLocalizedMessage());
        }
        String jarString = numBadJars==1 ? "jar" : "jars";
        getLog().info("Scanned " + numJars + " jars, found " + numBadJars + " bad " + jarString);
    }
}

Here is the output for my repository:

$ mvn zipchecker:zipchecker
[INFO] Scanning for projects...
[INFO] 
[INFO] ---------------< org.jeffmandel:zipchecker-maven-plugin >---------------
[INFO] Building zipchecker-maven-plugin Maven Mojo 1.0
[INFO] ----------------------------[ maven-plugin ]----------------------------
[INFO] 
[INFO] --- zipchecker-maven-plugin:1.0:zipchecker (default-cli) @ zipchecker-maven-plugin ---
[INFO] Scanning repository /home/jeffemandel/.m2/repository
[ERROR] ZIP file can't be opened as a file system because entry "/META-INF/resources/webjars/node-fetch/3.0.0-beta.9/./@types/index.d.ts" has a '.' or '..' element in its name
[INFO] Scanned 705 jars, found 1 bad jar

I may submit it to Codehaus. I think it should be in the validate lifecycle. Not sure if it needs any parameters or additional bells and whistles.