Shiro was used in an old spring boot project. Recently, Shiro broke a security vulnerability. So we need to upgrade the Shiro version in the project. However, this project was developed by former employees a long time ago, and the source code can no longer be found. So try to upgrade Shiro by replacing jar directly.

Wrong attempt

Usually, HTML can be replaced directly. JS can directly open WinRAR and replace the file directly. I thought jar packages can also be replaced directly. If you find that the jar is directly replaced, an error will be reported.

The error information is as follows:

java -jar spring-zs-1.0-update.jar                                                          [18:02:05]
Exception in thread "main" java.lang.IllegalStateException: Unable to open nested entry 'BOOT-INF/lib/shiro-web-1.5.3.jar'. It has been compressed and nested jar files must be stored without compression. Please check the mechanism used to create your executable jar file
	at org.springframework.boot.loader.jar.JarFile.createJarFileFromFileEntry(JarFile.java:285)
	at org.springframework.boot.loader.jar.JarFile.createJarFileFromEntry(JarFile.java:260)
	at org.springframework.boot.loader.jar.JarFile.getNestedJarFile(JarFile.java:248)
	at org.springframework.boot.loader.jar.JarFile.getNestedJarFile(JarFile.java:237)
	at org.springframework.boot.loader.archive.JarFileArchive.getNestedArchive(JarFileArchive.java:103)
	at org.springframework.boot.loader.archive.JarFileArchive.getNestedArchives(JarFileArchive.java:87)
	at org.springframework.boot.loader.ExecutableArchiveLauncher.getClassPathArchives(ExecutableArchiveLauncher.java:72)
	at org.springframework.boot.loader.Launcher.launch(Launcher.java:49)
	at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:51)

Correct steps

Unpack through jar command

My project jar name is spring-zs-1.0. Jar

jar -xvf spring-zs-1.0.jar

After decompression, replace the jar package in./boot-inf/lib directory. I replaced Shiro — 1.2.2.jar with Shiro — 1.5.3.jar

Repackage

jar -cfM0 new.jar ./

This will generate a new jar package!

If you also use MacOS system, you should pay attention to one thing. The MacOS system will automatically generate
. DS in some directories_ Store files, so you should delete these hidden. DS files before repackaging_ Store, otherwise an error will be reported.

reference resources

https://blog.csdn.net/weixin_ 45417347/article/details/101539040