Author: msahyoun
Date: Tue Aug 25 20:02:27 2026
New Revision: 1937451
Log:
PDFBOX-5660: validate CMap name
Modified:
pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Modified:
pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
==============================================================================
---
pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Tue Aug 25 20:02:09 2026 (r1937450)
+++
pdfbox/branches/2.0/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Tue Aug 25 20:02:27 2026 (r1937451)
@@ -502,6 +502,13 @@ public class CMapParser
*/
protected InputStream getExternalCMap(String name) throws IOException
{
+ // Validate name to point to the (predefined) resources in the
classpath.
+ if (name.isEmpty() || name.indexOf('/') > -1 || name.indexOf('\\') > -1
+ || name.charAt(0) == '.')
+ {
+ throw new IOException("Error: Invalid CMap name " + name);
+ }
+
InputStream resourceAsStream = getClass().getResourceAsStream(name);
if (resourceAsStream == null)
{
