You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ms...@apache.org on 2026/08/25 20:02:27 UTC
svn commit: r1937451 - pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap
Author: msahyoun
Date: Tue Aug 25 20:02:27 2026
New Revision: 1937451
Log:
PDFBOX-5660: validate CMap name
Modified:
pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Modified: pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
==============================================================================
--- pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java Tue Aug 25 20:02:09 2026 (r1937450)
+++ pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java Tue Aug 25 20:02:27 2026 (r1937451)
@@ -502,6 +502,13 @@ public class CMapParser
*/
protected InputStream getExternalCMap(String name) throws IOException
{
+ // Validate name to point to the (predefined) resources in the classpath.
+ if (name.isEmpty() || name.indexOf('/') > -1 || name.indexOf('\\') > -1
+ || name.charAt(0) == '.')
+ {
+ throw new IOException("Error: Invalid CMap name " + name);
+ }
+
InputStream resourceAsStream = getClass().getResourceAsStream(name);
if (resourceAsStream == null)
{