[platform-dev] ant properties provided via org.eclipse.ant.core.antPrope

["Homer, Tony" <tony.homer@xxxxxxxxx>]

I wrote a plugin which provides an org.eclipse.ant.core.antProperties extension.  The property it provides shows up in the Ant properties editor along with the eclipse-provided ant properties.  However, when I execute an ant target (via the Eclipse ant view) that references the property, the property is not accessible.  Similarly, the eclipse-provided ant property, eclipse.home, is not accessible.  If I define a property (ant.foo with value “foo”) in the Ant properties page, it is accessible.  Ant built-ins (such as ant.home) are accessible. 

 

Here is an example antfile + output from Eclipse console that demonstrates this.

 

ant.xml contents:

<project>

    <target name="echo-ant.tmpdir">

                <echo message="ant.foo: ${ant.foo}" />

                <echo message="ant.home: ${ant.home}" />

                <echo message="eclipse.home: ${eclipse.home}" />

                <echo message="ant.tmpdir: ${ant.tmpdir}" />

    </target>

</project>

 

console output:

Buildfile: /home/tony/spinny_mount/development/test/runtime-test/AntTest/ant.xml

echo-ant.tmpdir:

     [echo] ant.foo: foo

     [echo] ant.home: /home/tony/spinny_mount/development/iss/workspace_nda_clean/.metadata/.plugins/org.eclipse.pde.core/.bundle_pool/plugins/org.apache.ant_1.10.8.v20200515-1239

     [echo] eclipse.home: ${eclipse.home}

     [echo] ant.tmpdir: ${ant.tmpdir}

BUILD SUCCESSFUL

Total time: 200 milliseconds

 

Is this a bug or am I attempting to use the feature incorrectly?

 

Additional background for context: I am attempting to mitigate CVE-2020-11979 in an Eclipse product.  Please refer to the advisory from Apache Ant:

https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920edfb6e917fa21eb6c64ea%40%3Cdev.ant.apache.org%3E

Eclipse currently includes Ant 1.10.8 which is affected by CVE-2020-11979, but even if updated to use 1.10.9, the advisory recommends that the directory be explicitly created with the correct permissions and the ant.tmpdir property be set so that ant will use it.

My mitigation plan is to create a temp folder with the recommended permissions, then set the ant.tmpdir property using the org.eclipse.ant.core.antProperties extension point.  I wrote a plugin which successfully sets ant.tmpdir to the desired value, but when I attempt to access the value in an antfile in eclipse, exercising the relevant target shows that the property is not available to ant.

 

Is there some way other than via the org.eclipse.ant.core.antProperties extension point to have Eclipse pass the ant.tmpdir property to Ant?

 

FWIW, I tried to step further into the code to see how the set of arguments is passed to Ant, but I couldn’t find my way to the class which performs the actual Ant invocation.  It appears that there may be an extra class loader which loads Ant and some of the inner eclipse ant wrapping implementation, maybe for security reasons?  In any case, I haven’t been able to puzzle out how the set of properties in the Ant property editor get passed to Ant.  Because of this, I can’t tell if this is a bug or user error.  If someone can guide me in how to troubleshoot more effectively or identify the right place to look and how to configure my Eclipse environment so that I can set a breakpoint there, I’d be interested in delving further.

 

Thanks!

Tony Homer