Author: tilman
Date: Wed Aug 19 10:27:26 2026
New Revision: 1937226
Log:
PDFBOX-5660: add allowlist
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/AddValidationInformation.java
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationCollector.java
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
==============================================================================
---
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
Wed Aug 19 10:27:20 2026 (r1937225)
+++
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/SigUtils.java
Wed Aug 19 10:27:26 2026 (r1937226)
@@ -19,10 +19,13 @@ package org.apache.pdfbox.examples.signa
import java.io.IOException;
import java.io.InputStream;
import java.net.HttpURLConnection;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.net.URL;
import java.security.cert.CertificateException;
import java.security.cert.CertificateParsingException;
import java.security.cert.X509Certificate;
+import java.util.Arrays;
import java.util.Collection;
import java.util.Date;
import java.util.HashSet;
@@ -70,6 +73,26 @@ public class SigUtils
{
private static final Log LOG = LogFactory.getLog(SigUtils.class);
+ // Certificates / CRLs / LDAP needed for our unit tests; add yours
+ // or create your own logic in checkAccess()
+ private static final Set<String> allowUrlSet = new
HashSet<String>(Arrays.asList(
+ "http://www.pki.admin.ch/aia/RegularCA01.crt";,
+ "http://www.pki.admin.ch/aia/RootCAII.crt";,
+ "http://www.pki.admin.ch/aia/RootCAIV.crt";,
+ "http://www.pki.admin.ch/crl/RegularCA01.crl";,
+ "http://www.pki.admin.ch/crl/RootCAII.crl";,
+ "http://www.pki.admin.ch/aia/RegulatedCA02.crt";,
+ "http://www.pki.admin.ch/aia/ocsp";,
+ "http://www.pki.admin.ch/crl/RegulatedCA02.crl";,
+ "http://repository.certum.pl/ctnca2.cer";,
+ "http://repository.certum.pl/ctnca.cer";,
+ "http://subca.repository.certum.pl/ctsca2021.cer";,
+ "http://crl.geotrust.com/crls/adobeca1.crl";,
+ "http://crl.adobe.com/cds.crl";,
+ "http://subca.crl.certum.pl/ctsca2021.crl";,
+ "http://subca.ocsp-certum.com";,
+ "http://crl.certum.pl/ctnca2.crl";));
+
private SigUtils()
{
}
@@ -383,6 +406,22 @@ public class SigUtils
}
}
}
+
+ /**
+ * A simple but very restrictive access control logic.
+ * <p>
+ * Create your own but use a zero-trust mindset.
+ *
+ * @param uri
+ * @throws IOException
+ */
+ public static void checkAccess(URI uri) throws IOException
+ {
+ if (!allowUrlSet.contains(uri.toString()))
+ {
+ throw new IOException("URL '" + uri + "' not in allowUrlSet");
+ }
+ }
/**
* Like {@link URL#openStream()} but will follow redirection from http to
https.
@@ -390,15 +429,19 @@ public class SigUtils
* @param urlString http URL string
* @return
* @throws IOException
+ * @throws URISyntaxException
*/
- public static InputStream openURL(String urlString) throws IOException
+ public static InputStream openURL(String urlString) throws IOException,
URISyntaxException
{
- URL url = new URL(urlString);
- if (!url.getProtocol().startsWith("http"))
+ URI uri = new URI(urlString);
+ if (!uri.getScheme().startsWith("http"))
{
- throw new IOException(url.getProtocol() + " protocol not
supported");
+ throw new IOException(uri.getScheme() + " schema not supported");
}
- HttpURLConnection con = (HttpURLConnection) url.openConnection();
+
+ checkAccess(uri);
+
+ HttpURLConnection con = (HttpURLConnection)
uri.toURL().openConnection();
int responseCode = con.getResponseCode();
LOG.info(responseCode + " " + con.getResponseMessage());
if (responseCode == HttpURLConnection.HTTP_MOVED_TEMP ||
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
==============================================================================
---
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Wed Aug 19 10:27:20 2026 (r1937225)
+++
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CRLVerifier.java
Wed Aug 19 10:27:26 2026 (r1937226)
@@ -22,9 +22,9 @@ package org.apache.pdfbox.examples.signa
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.security.GeneralSecurityException;
-import java.security.cert.CRLException;
-import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509CRL;
import java.security.cert.X509CRLEntry;
@@ -232,7 +232,7 @@ public final class CRLVerifier
* Downloads CRL from given URL. Supports http, https and ldap based URLs.
*/
private static X509CRL downloadCRL(String crlURL) throws IOException,
- CertificateVerificationException, NamingException,
GeneralSecurityException
+ CertificateVerificationException, NamingException,
GeneralSecurityException, URISyntaxException
{
if (crlURL.startsWith("http://";) || crlURL.startsWith("https://";))
{
@@ -254,12 +254,12 @@ public final class CRLVerifier
* Downloads a CRL from given LDAP url, e.g.
* ldap://ldap.infonotary.com/dc=identity-ca,dc=infonotary,dc=com
*/
- private static X509CRL downloadCRLFromLDAP(String ldapURL) throws
CertificateException,
- NamingException, CRLException,
- CertificateVerificationException
+ private static X509CRL downloadCRLFromLDAP(String ldapURL) throws
GeneralSecurityException,
+ NamingException, CertificateVerificationException,
URISyntaxException, IOException
{
@SuppressWarnings({"squid:S1149"})
Hashtable<String, String> env = new Hashtable<String, String>();
+ SigUtils.checkAccess(new URI(ldapURL));
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, ldapURL);
@@ -289,8 +289,10 @@ public final class CRLVerifier
* @return
* @throws java.io.IOException
* @throws java.security.GeneralSecurityException
+ * @throws java.net.URISyntaxException
*/
- public static X509CRL downloadCRLFromWeb(String crlURL) throws
IOException, GeneralSecurityException
+ public static X509CRL downloadCRLFromWeb(String crlURL)
+ throws IOException, GeneralSecurityException, URISyntaxException
{
InputStream crlStream = SigUtils.openURL(crlURL);
try
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
==============================================================================
---
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
Wed Aug 19 10:27:20 2026 (r1937225)
+++
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/CertificateVerifier.java
Wed Aug 19 10:27:26 2026 (r1937226)
@@ -21,6 +21,7 @@ package org.apache.pdfbox.examples.signa
import java.io.IOException;
import java.io.InputStream;
+import java.net.URISyntaxException;
import java.security.GeneralSecurityException;
import java.security.PublicKey;
import java.security.cert.CertPathBuilder;
@@ -200,7 +201,7 @@ public final class CertificateVerifier
Set<X509Certificate> additionalCerts,
Date signDate)
throws IOException, CertificateVerificationException,
OCSPException,
- RevokedCertificateException, GeneralSecurityException
+ RevokedCertificateException, GeneralSecurityException,
URISyntaxException
{
if (isSelfSigned(cert))
{
@@ -225,7 +226,7 @@ public final class CertificateVerifier
private static void checkRevocationsWithIssuer(X509Certificate cert,
X509Certificate issuerCert,
Set<X509Certificate> additionalCerts, Date signDate)
throws CertificateVerificationException, IOException,
RevokedCertificateException,
- GeneralSecurityException, OCSPException
+ GeneralSecurityException, OCSPException, URISyntaxException
{
// Try checking the certificate through OCSP (faster than CRL)
String ocspURL = extractOCSPURL(cert);
@@ -305,8 +306,10 @@ public final class CertificateVerifier
* @param ext an X509 object that can have extensions.
*
* @return a certificate set, never null.
+ * @throws java.net.URISyntaxException
*/
public static Set<X509Certificate> downloadExtraCertificates(X509Extension
ext)
+ throws URISyntaxException
{
// https://tools.ietf.org/html/rfc2459#section-4.2.2.1
// https://tools.ietf.org/html/rfc3280#section-4.2.2.1
@@ -480,7 +483,7 @@ public final class CertificateVerifier
* @throws CertificateVerificationException
*/
private static void verifyOCSP(OcspHelper ocspHelper, Set<X509Certificate>
additionalCerts)
- throws RevokedCertificateException, IOException, OCSPException,
CertificateVerificationException
+ throws RevokedCertificateException, IOException, OCSPException,
CertificateVerificationException, URISyntaxException
{
Date now = Calendar.getInstance().getTime();
OCSPResp ocspResponse;
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java
==============================================================================
---
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java
Wed Aug 19 10:27:20 2026 (r1937225)
+++
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/cert/OcspHelper.java
Wed Aug 19 10:27:26 2026 (r1937226)
@@ -21,7 +21,8 @@ import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
-import java.net.URL;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
@@ -129,8 +130,10 @@ public class OcspHelper
* @throws IOException
* @throws OCSPException
* @throws RevokedCertificateException
+ * @throws URISyntaxException
*/
- public OCSPResp getResponseOcsp() throws IOException, OCSPException,
RevokedCertificateException
+ public OCSPResp getResponseOcsp()
+ throws IOException, OCSPException, RevokedCertificateException,
URISyntaxException
{
OCSPResp ocspResponse = performRequest(ocspUrl);
verifyOcspResponse(ocspResponse);
@@ -452,12 +455,15 @@ public class OcspHelper
* @return the OCSPResp, that has been fetched from the ocspUrl
* @throws IOException
* @throws OCSPException
+ * @throws URISyntaxException
*/
- private OCSPResp performRequest(String urlString) throws IOException,
OCSPException
+ private OCSPResp performRequest(String urlString)
+ throws IOException, OCSPException, URISyntaxException
{
OCSPReq request = generateOCSPRequest();
- URL url = new URL(urlString);
- HttpURLConnection httpConnection = (HttpURLConnection)
url.openConnection();
+ URI uri = new URI(urlString);
+ SigUtils.checkAccess(uri);
+ HttpURLConnection httpConnection = (HttpURLConnection)
uri.toURL().openConnection();
try
{
httpConnection.setRequestProperty("Content-Type",
"application/ocsp-request");
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/AddValidationInformation.java
==============================================================================
---
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/AddValidationInformation.java
Wed Aug 19 10:27:20 2026 (r1937225)
+++
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/AddValidationInformation.java
Wed Aug 19 10:27:26 2026 (r1937226)
@@ -24,6 +24,7 @@ import java.io.FileOutputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.lang.reflect.InvocationTargetException;
+import java.net.URISyntaxException;
import java.security.GeneralSecurityException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
@@ -373,6 +374,10 @@ public class AddValidationInformation
{
throw new IOException(e);
}
+ catch (URISyntaxException e)
+ {
+ throw new IOException(e);
+ }
}
/**
@@ -408,6 +413,11 @@ public class AddValidationInformation
LOG.warn("Failed fetching CRL", e);
throw new IOException(e);
}
+ catch (URISyntaxException e)
+ {
+ LOG.warn("Failed fetching CRL", e);
+ throw new IOException(e);
+ }
}
/**
@@ -418,9 +428,10 @@ public class AddValidationInformation
* @throws OCSPException
* @throws CertificateProccessingException
* @throws RevokedCertificateException
+ * @throws URISyntaxException
*/
private void addOcspData(CertSignatureInformation certInfo) throws
IOException, OCSPException,
- CertificateProccessingException, RevokedCertificateException
+ CertificateProccessingException, RevokedCertificateException,
URISyntaxException
{
X509Certificate certificate = certInfo.getCertificate();
if (ocspChecked.contains(certificate))
@@ -436,7 +447,7 @@ public class AddValidationInformation
private void addOcspData(X509Certificate certificate, X509Certificate
issuerCertificate, String ocspURL)
throws IOException, OCSPException, CertificateProccessingException,
- RevokedCertificateException
+ RevokedCertificateException, URISyntaxException
{
OcspHelper ocspHelper = new OcspHelper(
certificate,
@@ -498,10 +509,11 @@ public class AddValidationInformation
* @throws RevokedCertificateException
* @throws GeneralSecurityException
* @throws CertificateVerificationException
+ * @throws URISyntaxException
*/
private void addCrlRevocationInfo(CertSignatureInformation certInfo)
throws IOException, RevokedCertificateException,
GeneralSecurityException,
- CertificateVerificationException
+ CertificateVerificationException, URISyntaxException
{
X509CRL crl = CRLVerifier.downloadCRLFromWeb(certInfo.getCrlUrl());
Modified:
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationCollector.java
==============================================================================
---
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationCollector.java
Wed Aug 19 10:27:20 2026 (r1937225)
+++
pdfbox/branches/2.0/examples/src/main/java/org/apache/pdfbox/examples/signature/validation/CertInformationCollector.java
Wed Aug 19 10:27:26 2026 (r1937226)
@@ -21,6 +21,7 @@ import java.io.ByteArrayInputStream;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
+import java.net.URISyntaxException;
import java.security.GeneralSecurityException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
@@ -313,6 +314,10 @@ public class CertInformationCollector
{
LOG.error("Error getting alternative issuer certificate from " +
certInfo.issuerUrl, e);
}
+ catch (URISyntaxException e)
+ {
+ LOG.error("Error getting alternative issuer certificate from " +
certInfo.issuerUrl, e);
+ }
}
/**
