Author: tilman
Date: Wed Aug 19 10:27:20 2026
New Revision: 1937225
Log:
PDFBOX-5660: add allowlist
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
==============================================================================
---
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
Wed Aug 19 10:27:15 2026 (r1937224)
+++
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
Wed Aug 19 10:27:20 2026 (r1937225)
@@ -75,6 +75,26 @@ public class SigUtils
{
private static final Logger LOG = LogManager.getLogger(SigUtils.class);
+ // Certificates / CRLs / LDAP needed for our unit tests; add yours
+ // or create your own logic in checkAccess()
+ private static final Set<String> allowUrlSet =
+ Set.of("http://www.pki.admin.ch/aia/RegularCA01.crt";,
+ "http://www.pki.admin.ch/aia/RootCAII.crt";,
+ "http://www.pki.admin.ch/aia/RootCAIV.crt";,
+ "http://www.pki.admin.ch/crl/RegularCA01.crl";,
+ "http://www.pki.admin.ch/crl/RootCAII.crl";,
+ "http://www.pki.admin.ch/aia/RegulatedCA02.crt";,
+ "http://www.pki.admin.ch/aia/ocsp";,
+ "http://www.pki.admin.ch/crl/RegulatedCA02.crl";,
+ "http://repository.certum.pl/ctnca2.cer";,
+ "http://repository.certum.pl/ctnca.cer";,
+ "http://subca.repository.certum.pl/ctsca2021.cer";,
+ "http://crl.geotrust.com/crls/adobeca1.crl";,
+ "http://crl.adobe.com/cds.crl";,
+ "http://subca.crl.certum.pl/ctsca2021.crl";,
+ "http://subca.ocsp-certum.com";,
+ "http://crl.certum.pl/ctnca2.crl";);
+
private SigUtils()
{
}
@@ -423,6 +443,22 @@ public class SigUtils
}
}
}
+
+ /**
+ * A simple but very restrictive access control logic.
+ * <p>
+ * Create your own but use a zero-trust mindset.
+ *
+ * @param uri
+ * @throws IOException
+ */
+ public static void checkAccess(URI uri) throws IOException
+ {
+ if (!allowUrlSet.contains(uri.toString()))
+ {
+ throw new IOException("URL '" + uri + "' not in allowUrlSet");
+ }
+ }
/**
* Like {@link URL#openStream()} but will follow redirection from http to
https.
@@ -434,12 +470,15 @@ public class SigUtils
*/
public static InputStream openURL(String urlString) throws IOException,
URISyntaxException
{
- URL url = new URI(urlString).toURL();
- if (!url.getProtocol().startsWith("http"))
+ URI uri = new URI(urlString);
+ if (!uri.getScheme().startsWith("http"))
{
- throw new IOException(url.getProtocol() + " protocol not
supported");
+ throw new IOException(uri.getScheme() + " schema not supported");
}
- HttpURLConnection con = (HttpURLConnection) url.openConnection();
+
+ checkAccess(uri);
+
+ HttpURLConnection con = (HttpURLConnection)
uri.toURL().openConnection();
int responseCode = con.getResponseCode();
LOG.info("{} {}", responseCode, con.getResponseMessage());
if (responseCode == HttpURLConnection.HTTP_MOVED_TEMP ||
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
==============================================================================
---
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Wed Aug 19 10:27:15 2026 (r1937224)
+++
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Wed Aug 19 10:27:20 2026 (r1937225)
@@ -22,10 +22,9 @@ package org.apache.pdfbox.examples.signa
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
+import java.net.URI;
import java.net.URISyntaxException;
import java.security.GeneralSecurityException;
-import java.security.cert.CRLException;
-import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509CRL;
import java.security.cert.X509CRLEntry;
@@ -258,12 +257,12 @@ public final class CRLVerifier
* Downloads a CRL from given LDAP url, e.g.
* ldap://ldap.infonotary.com/dc=identity-ca,dc=infonotary,dc=com
*/
- private static X509CRL downloadCRLFromLDAP(String ldapURL) throws
CertificateException,
- NamingException, CRLException,
- CertificateVerificationException
+ private static X509CRL downloadCRLFromLDAP(String ldapURL) throws
GeneralSecurityException,
+ NamingException, CertificateVerificationException,
URISyntaxException, IOException
{
@SuppressWarnings({"squid:S1149"})
Hashtable<String, String> env = new Hashtable<>();
+ SigUtils.checkAccess(new URI(ldapURL));
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, ldapURL);
Modified:
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java
==============================================================================
---
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java
Wed Aug 19 10:27:15 2026 (r1937224)
+++
pdfbox/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java
Wed Aug 19 10:27:20 2026 (r1937225)
@@ -23,7 +23,6 @@ import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URI;
import java.net.URISyntaxException;
-import java.net.URL;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
@@ -461,8 +460,9 @@ public class OcspHelper
throws IOException, OCSPException, URISyntaxException
{
OCSPReq request = generateOCSPRequest();
- URL url = new URI(urlString).toURL();
- HttpURLConnection httpConnection = (HttpURLConnection)
url.openConnection();
+ URI uri = new URI(urlString);
+ SigUtils.checkAccess(uri);
+ HttpURLConnection httpConnection = (HttpURLConnection)
uri.toURL().openConnection();
try
{
httpConnection.setRequestProperty("Content-Type",
"application/ocsp-request");
