Author: tilman
Date: Thu Aug 20 09:58:32 2026
New Revision: 1937257
Log:
PDFBOX-2941: avoid / confirm URI
Modified:
pdfbox/branches/2.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane/PagePane.java
Modified:
pdfbox/branches/2.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane/PagePane.java
==============================================================================
---
pdfbox/branches/2.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane/PagePane.java
Thu Aug 20 09:58:28 2026 (r1937256)
+++
pdfbox/branches/2.0/debugger/src/main/java/org/apache/pdfbox/debugger/pagepane/PagePane.java
Thu Aug 20 09:58:32 2026 (r1937257)
@@ -39,6 +39,7 @@ import java.util.Set;
import java.util.concurrent.ExecutionException;
import javax.swing.BoxLayout;
import javax.swing.JLabel;
+import javax.swing.JOptionPane;
import javax.swing.JPanel;
import javax.swing.SwingWorker;
import javax.swing.event.AncestorEvent;
@@ -411,7 +412,25 @@ public class PagePane implements ActionL
{
try
{
- Desktop.getDesktop().browse(new URI(currentURI));
+ URI uri = new URI(currentURI);
+ if (!isBrowsableScheme(uri))
+ {
+ // The URI comes from the document and must not reach the
OS URI dispatcher:
+ // file:, smb: or custom protocol handlers can leak
credentials or run code
+ JOptionPane.showMessageDialog(panel,
+ "Link not opened, only http, https and mailto
links are allowed:\n\n" +
+ currentURI,
+ "Link blocked", JOptionPane.WARNING_MESSAGE);
+ return;
+ }
+ // ask the user before opening, the link target is document
controlled
+ int answer = JOptionPane.showConfirmDialog(panel,
+ "Open this link in your browser?\n\n" + currentURI,
+ "Open link", JOptionPane.YES_NO_OPTION,
JOptionPane.WARNING_MESSAGE);
+ if (answer == JOptionPane.YES_OPTION)
+ {
+ Desktop.getDesktop().browse(uri);
+ }
}
catch (URISyntaxException ex)
{
@@ -424,6 +443,25 @@ public class PagePane implements ActionL
}
}
+ /**
+ * Tells whether a document supplied URI is safe to hand to the operating
system, i.e. uses
+ * one of the allowed schemes http, https or mailto. Anything else (file:,
smb:, jar: or
+ * custom protocol handlers) must not be dispatched.
+ *
+ * @param uri the URI to check, may be null
+ * @return true if the URI scheme is allowed
+ */
+ static boolean isBrowsableScheme(URI uri)
+ {
+ if (uri == null)
+ {
+ return false;
+ }
+ String scheme = uri.getScheme();
+ return "http".equalsIgnoreCase(scheme) ||
"https".equalsIgnoreCase(scheme) ||
+ "mailto".equalsIgnoreCase(scheme);
+ }
+
@Override
public void mousePressed(MouseEvent e)
{
