[PR] Msg2txt: reject path traversal filenames during MSG attachment extraction [poi]

["pjfanning (via GitHub)" <gi...@apache.org>]

pjfanning opened a new pull request, #1348:
URL: https://github.com/apache/poi/pull/1348

   `Msg2txt.processAttachment` writes each attachment to a path built directly from the message:
   
   ```java
   String fileName = attachment.getAttachFileName().toString();
   if (attachment.getAttachLongFileName() != null) {
       fileName = attachment.getAttachLongFileName().toString();
   }
   
   File f = new File(dir, fileName);
   try (OutputStream fileOut = new FileOutputStream(f)) {
       fileOut.write(attachment.getAttachData().getValue());
   }
   ```
   
   `PR_ATTACH_LONG_FILENAME` / `PR_ATTACH_FILENAME` are attacker controlled and never normalized, so a crafted `.msg` file can write outside the directory the caller nominated.
   
   Now routed through `IOUtils.newFile`, the project's designated traversal guard — the same one `HMEFContentsExtractor` uses for TNEF attachments (since #1066) and `VBAMacroExtractor` uses for extracted modules.
   
   ### Context
   
   Found while checking a security report filed against `HMEFContentsExtractor.extractAttachments`. That report is **already fixed on trunk** by #1066, which added the `IOUtils.newFile` guard there. This is the same defect class at a sink that fix did not cover.
   
   I swept the other `new File(dir, name)` write sinks at the same time; the rest are already safe:
   
   | Site | Why it's safe |
   |---|---|
   | `VBAMacroExtractor` | uses `IOUtils.newFile` |
   | `VsdxToPng`, `HierarchyPrinter` | `Util.sanitizeFilename` replaces every path separator |
   | `PPTX2PNG` | `new File(filename).getName()` drops any directory component |
   | `HMEFContentsExtractor` (`message.rtf`) | constant name |
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org

Re: [PR] Msg2txt: reject path traversal filenames during MSG attachment extraction [poi]

["pjfanning (via GitHub)" <gi...@apache.org>]

pjfanning merged PR #1348:
URL: https://github.com/apache/poi/pull/1348


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org