(poi) branch trunk updated: Msg2txt: reject path traversal filenames during MSG attachment extraction (#1348)

[fa...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 33eb61bdf1 Msg2txt: reject path traversal filenames during MSG attachment extraction (#1348)
33eb61bdf1 is described below

commit 33eb61bdf1e79d87094f00cc8c1d64202a597e27
Author: PJ Fanning <pj...@users.noreply.github.com>
AuthorDate: Tue Sep 22 14:10:19 2026 +0100

    Msg2txt: reject path traversal filenames during MSG attachment extraction (#1348)
    
    * Msg2txt: reject path traversal filenames during MSG attachment extraction
    
    Msg2txt.processAttachment writes each attachment to new File(dir, fileName)
    where fileName is PR_ATTACH_LONG_FILENAME (falling back to PR_ATTACH_FILENAME)
    taken verbatim from the Outlook message. Both are attacker controlled, so a
    crafted .msg file can write outside the directory the caller nominated.
    
    Route the name through IOUtils.newFile, the same guard HMEFContentsExtractor
    uses for TNEF attachments since #1066 and VBAMacroExtractor uses for extracted
    modules.
    
    Found while checking a report against HMEFContentsExtractor, which trunk
    already fixes; this is the same defect class at a sink the earlier fix did not
    cover.
    
    Co-Authored-By: Claude Opus 5 (1M context) <no...@anthropic.com>
    
    * Clarify attachment name handling in Msg2txt
    
    Updated comment to clarify handling of attachment names.
    
    ---------
    
    Co-authored-by: Claude Opus 5 (1M context) <no...@anthropic.com>
---
 poi-examples/src/main/java/org/apache/poi/examples/hsmf/Msg2txt.java | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/poi-examples/src/main/java/org/apache/poi/examples/hsmf/Msg2txt.java b/poi-examples/src/main/java/org/apache/poi/examples/hsmf/Msg2txt.java
index 5b4d48f142..cf83ea2070 100644
--- a/poi-examples/src/main/java/org/apache/poi/examples/hsmf/Msg2txt.java
+++ b/poi-examples/src/main/java/org/apache/poi/examples/hsmf/Msg2txt.java
@@ -27,6 +27,7 @@ import java.nio.charset.StandardCharsets;
 import org.apache.poi.hsmf.MAPIMessage;
 import org.apache.poi.hsmf.datatypes.AttachmentChunks;
 import org.apache.poi.hsmf.exceptions.ChunkNotFoundException;
+import org.apache.poi.util.IOUtils;
 
 /**
  * Reads one or several Outlook MSG files and for each of them creates
@@ -130,7 +131,9 @@ public class Msg2txt {
           fileName = attachment.getAttachLongFileName().toString();
        }
 
-        File f = new File(dir, fileName);
+        // the attachment name comes from the message and may have problematic characters, so we should use
+        // IOUtils which has some code to escape problematic chars
+        File f = IOUtils.newFile(dir, fileName);
         try (OutputStream fileOut = new FileOutputStream(f)) {
             fileOut.write(attachment.getAttachData().getValue());
         }


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org