Author: msahyoun
Date: Tue Aug 25 20:02:09 2026
New Revision: 1937450
Log:
PDFBOX-5660: validate CMap name
Modified:
pdfbox/branches/3.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Modified:
pdfbox/branches/3.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
==============================================================================
---
pdfbox/branches/3.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Tue Aug 25 19:34:01 2026 (r1937449)
+++
pdfbox/branches/3.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Tue Aug 25 20:02:09 2026 (r1937450)
@@ -475,6 +475,13 @@ public class CMapParser
*/
private RandomAccessRead getExternalCMap(String name) throws IOException
{
+ // Validate name to point to the (predefined) resources in the
classpath.
+ if (name.isEmpty() || name.indexOf('/') > -1 || name.indexOf('\\') > -1
+ || name.charAt(0) == '.')
+ {
+ throw new IOException("Error: Invalid CMap name " + name);
+ }
+
InputStream is = getClass().getResourceAsStream(name);
if (is == null)
{
