Some misc bug fixes

client/src/main/java/org/apache/karaf/client/Main.java

@@ -367,7 +367,7 @@ private static ClientSession connectWithRetries(SshClient client, ClientConfig c
                 session = future.getSession();
             } catch (RuntimeSshException ex) {
                 if (retries++ < config.getRetryAttempts()) {
-                    Thread.sleep(config.getRetryDelay() * 1000);
+                    Thread.sleep(config.getRetryDelay() * 1000L);
                     System.out.println("retrying (attempt " + retries + ") ...");
                 } else {
                     throw ex;

features/core/src/main/java/org/apache/karaf/features/internal/service/Blacklist.java

@@ -77,7 +77,7 @@ public Blacklist(String blacklistUrl) {
                     .filter(line -> !line.isEmpty() && !line.startsWith("#"))
                     .forEach(blacklist::add);
             } catch (FileNotFoundException e) {
-                LOGGER.debug("Unable to load blacklist bundles list", e.toString());
+                LOGGER.debug("Unable to load blacklist bundles list {}", e.toString());
             } catch (Exception e) {
                 LOGGER.debug("Unable to load blacklist bundles list", e);
             }

features/core/src/main/java/org/apache/karaf/features/internal/service/Overrides.java

@@ -159,7 +159,7 @@ public static Set<String> loadOverrides(String overridesUrl) {
                 }
             }
         } catch (FileNotFoundException e) {
-            LOGGER.debug("Unable to load overrides bundles list", e.toString());
+            LOGGER.debug("Unable to load overrides bundles list {}", e.toString());
         } catch (Exception e) {
             LOGGER.debug("Unable to load overrides bundles list", e);
         }

http/src/main/java/org/apache/karaf/http/core/internal/ProxyServlet.java

@@ -188,7 +188,7 @@ protected boolean doResponseRedirect(HttpServletRequest servletRequest, HttpServ
         // check if the proxy is a redirect
         if (statusCode >= HttpServletResponse.SC_MULTIPLE_CHOICES && statusCode < HttpServletResponse.SC_NOT_MODIFIED) {
             Header locationHeader = proxyResponse.getLastHeader(HttpHeaders.LOCATION);
-            if (locationHeader != null) {
+            if (locationHeader == null) {
                 throw new ServletException("Received a redirect (" + statusCode + ") but without location (" + HttpHeaders.LOCATION + " header)");
             }
             // modify the redirect to go to this proxy servlet rather than the proxied host

jaas/boot/src/main/java/org/apache/karaf/jaas/boot/principal/ClientPrincipal.java

@@ -41,6 +41,14 @@ public String getAddress() {
         return address;
     }
 
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+        ClientPrincipal that = (ClientPrincipal) o;
+        return Objects.equals(getName(), that.getName());
+    }
+
     @Override
     public int hashCode() {
         return Objects.hash(getName());

jaas/boot/src/main/java/org/apache/karaf/jaas/boot/principal/GroupPrincipal.java

@@ -2,9 +2,9 @@
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
  *  You may obtain a copy of the License at
- * 
+ *
  *       http://www.apache.org/licenses/LICENSE-2.0
- * 
+ *
  *  Unless required by applicable law or agreed to in writing, software
  *  distributed under the License is distributed on an "AS IS" BASIS,
  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -65,7 +65,7 @@ public boolean removeMember(Principal user) {
     }
 
     public boolean isMember(Principal member) {
-        return members.contains(member.getName());
+        return members.containsKey(member.getName());
     }
 
     public Enumeration<? extends Principal> members() {

obr/src/main/java/org/apache/karaf/obr/command/util/FileUtil.java

@@ -80,10 +80,10 @@ public static void downloadSource(
 
             if (extract)
             {
-                JarInputStream jis = new JarInputStream(new FileInputStream(file));
-                out.println("Extracting...");
-                unjar(jis, dir);
-                jis.close();
+                try (JarInputStream jis = new JarInputStream(new FileInputStream(file))) {
+                    out.println("Extracting...");
+                    unjar(jis, dir);
+                }
                 file.delete();
             }
         }

tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/KarMojo.java

@@ -288,8 +288,7 @@ private File createArchive(List<Artifact> bundles, File featuresFile, String gro
                     metadata.setVersioning(versioning);
 
                     MetadataXpp3Writer metadataWriter = new MetadataXpp3Writer();
-                    try {
-                        Writer writer = new FileWriter(metadataTarget);
+                    try (Writer writer = new FileWriter(metadataTarget)) {
                         metadataWriter.write(writer, metadata);
                     } catch (Exception e) {
                         getLog().warn("Could not create maven-metadata-local.xml", e);

tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/RunMojo.java

@@ -257,6 +257,10 @@ private static void extract(ArchiveInputStream is, File targetDir) throws IOExce
                 String name = entry.getName();
                 name = name.substring(name.indexOf("/") + 1);
                 File file = new File(targetDir, name);
+                if (!file.getCanonicalPath().startsWith(targetDir.getCanonicalPath())) {
+                    throw new IOException("Archive cannot contain paths with .. characters");
+                }
+
                 if (entry.isDirectory()) {
                     file.mkdirs();
                 }