[jira] [Commented] (PDFBOX-2233) Make PreflightParser sandbox safe

["Tilman Hausherr (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/PDFBOX-2233?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14070617#comment-14070617 ] 

Tilman Hausherr commented on PDFBOX-2233:
-----------------------------------------

We need a class to buffer a stream in memory, and that can also be used as input for PushBackInputStream. MemoryCacheImageInputStream can buffer a stream, but can't be used as input for PushBackInputStream :-(

> Make PreflightParser sandbox safe
> ---------------------------------
>
>                 Key: PDFBOX-2233
>                 URL: https://issues.apache.org/jira/browse/PDFBOX-2233
>             Project: PDFBox
>          Issue Type: Improvement
>          Components: Preflight
>    Affects Versions: 2.0.0
>            Reporter: simon steiner
>
> It should be possible to pass a DataSource into PreflightParser without a temp file being created. Temp file is being created in NonSequentialPDFParser causing a SecurityException.
> java.lang.SecurityException: Unable to create temporary file
> 	at java.io.File.createTempFile(File.java:2018)
> 	at java.io.File.createTempFile(File.java:2070)
> 	at org.apache.pdfbox.pdfparser.NonSequentialPDFParser.createTmpFile(NonSequentialPDFParser.java:281)
> 	at org.apache.pdfbox.pdfparser.NonSequentialPDFParser.<init>(NonSequentialPDFParser.java:261)
> 	at org.apache.pdfbox.pdfparser.NonSequentialPDFParser.<init>(NonSequentialPDFParser.java:247)
> 	at org.apache.pdfbox.preflight.parser.PreflightParser.<init>(PreflightParser.java:125)



--
This message was sent by Atlassian JIRA
(v6.2#6252)