Author: tilman Date: Thu Aug 20 10:17:16 2026 New Revision: 1937264 Log: PDFBOX-2941: add test
Added: pdfbox/trunk/debugger/src/test/ pdfbox/trunk/debugger/src/test/java/ pdfbox/trunk/debugger/src/test/java/org/ pdfbox/trunk/debugger/src/test/java/org/apache/ pdfbox/trunk/debugger/src/test/java/org/apache/pdfbox/ pdfbox/trunk/debugger/src/test/java/org/apache/pdfbox/debugger/ pdfbox/trunk/debugger/src/test/java/org/apache/pdfbox/debugger/pagepane/ pdfbox/trunk/debugger/src/test/java/org/apache/pdfbox/debugger/pagepane/PagePaneTest.java (contents, props changed) Added: pdfbox/trunk/debugger/src/test/java/org/apache/pdfbox/debugger/pagepane/PagePaneTest.java ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ pdfbox/trunk/debugger/src/test/java/org/apache/pdfbox/debugger/pagepane/PagePaneTest.java Thu Aug 20 10:17:16 2026 (r1937264) @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.pdfbox.debugger.pagepane; + +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertTrue; + +import java.net.URI; + +import org.junit.jupiter.api.Test; + +/** + * Test the scheme allowlist used before document supplied link URIs are handed to + * Desktop.browse(). + */ +class PagePaneTest +{ + @Test + void testBrowsableSchemes() throws Exception + { + assertTrue(PagePane.isBrowsableScheme(new URI("http://example.com";))); + assertTrue(PagePane.isBrowsableScheme(new URI("https://example.com/page?q=1";))); + assertTrue(PagePane.isBrowsableScheme(new URI("mailto:[email protected]";))); + assertTrue(PagePane.isBrowsableScheme(new URI("MAILTO:[email protected]"))); + + // UNC / SMB style links used for NTLM hash leaks + assertFalse(PagePane.isBrowsableScheme(new URI("file:////attacker.example/share/x"))); + assertFalse(PagePane.isBrowsableScheme(new URI("file:///etc/passwd"))); + assertFalse(PagePane.isBrowsableScheme(new URI("smb://attacker.example/x"))); + // arbitrary registered protocol handlers + assertFalse(PagePane.isBrowsableScheme(new URI("search-ms:query"))); + assertFalse(PagePane.isBrowsableScheme(new URI("ms-msdt:/id%20PCWDiagnostic"))); + assertFalse(PagePane.isBrowsableScheme(new URI("jar:file:/tmp/a.jar!/x"))); + // no scheme at all + assertFalse(PagePane.isBrowsableScheme(new URI("relative/path"))); + assertFalse(PagePane.isBrowsableScheme(null)); + } +}
