svn commit: r1937255 - pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane

[ti...@apache.org]

Author: tilman
Date: Thu Aug 20 09:58:25 2026
New Revision: 1937255

Log:
PDFBOX-2941: avoid / confirm URI

Modified:
   pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane/PagePane.java

Modified: pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane/PagePane.java
==============================================================================
--- pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane/PagePane.java	Thu Aug 20 09:51:49 2026	(r1937254)
+++ pdfbox/branches/3.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane/PagePane.java	Thu Aug 20 09:58:25 2026	(r1937255)
@@ -61,6 +61,7 @@ import java.util.Map.Entry;
 import java.util.Set;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.TimeUnit;
+import javax.swing.JOptionPane;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.apache.pdfbox.debugger.ui.ErrorDialog;
@@ -493,7 +494,25 @@ public class PagePane implements ActionL
         {
             try
             {
-                Desktop.getDesktop().browse(new URI(currentURI));
+                URI uri = new URI(currentURI);
+                if (!isBrowsableScheme(uri))
+                {
+                    // The URI comes from the document and must not reach the OS URI dispatcher:
+                    // file:, smb: or custom protocol handlers can leak credentials or run code
+                    JOptionPane.showMessageDialog(panel,
+                            "Link not opened, only http, https and mailto links are allowed:\n\n" +
+                                    currentURI,
+                            "Link blocked", JOptionPane.WARNING_MESSAGE);
+                    return;
+                }
+                // ask the user before opening, the link target is document controlled
+                int answer = JOptionPane.showConfirmDialog(panel,
+                        "Open this link in your browser?\n\n" + currentURI,
+                        "Open link", JOptionPane.YES_NO_OPTION, JOptionPane.WARNING_MESSAGE);
+                if (answer == JOptionPane.YES_OPTION)
+                {
+                    Desktop.getDesktop().browse(uri);
+                }
             }
             catch (URISyntaxException | IOException ex)
             {
@@ -502,6 +521,25 @@ public class PagePane implements ActionL
         }
     }
 
+    /**
+     * Tells whether a document supplied URI is safe to hand to the operating system, i.e. uses
+     * one of the allowed schemes http, https or mailto. Anything else (file:, smb:, jar: or
+     * custom protocol handlers) must not be dispatched.
+     *
+     * @param uri the URI to check, may be null
+     * @return true if the URI scheme is allowed
+     */
+    static boolean isBrowsableScheme(URI uri)
+    {
+        if (uri == null)
+        {
+            return false;
+        }
+        String scheme = uri.getScheme();
+        return "http".equalsIgnoreCase(scheme) || "https".equalsIgnoreCase(scheme) ||
+                "mailto".equalsIgnoreCase(scheme);
+    }
+
     @Override
     public void mousePressed(MouseEvent e)
     {