Author: msahyoun
Date: Tue Aug 25 20:02:42 2026
New Revision: 1937452
Log:
PDFBOX-5660: validate CMap name
Modified:
pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Modified:
pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
==============================================================================
--- pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Tue Aug 25 20:02:27 2026 (r1937451)
+++ pdfbox/trunk/fontbox/src/main/java/org/apache/fontbox/cmap/CMapParser.java
Tue Aug 25 20:02:42 2026 (r1937452)
@@ -475,6 +475,13 @@ public class CMapParser
*/
private RandomAccessRead getExternalCMap(String name) throws IOException
{
+ // Validate name to point to the (predefined) resources in the
classpath.
+ if (name.isEmpty() || name.indexOf('/') > -1 || name.indexOf('\\') > -1
+ || name.charAt(0) == '.')
+ {
+ throw new IOException("Error: Invalid CMap name " + name);
+ }
+
InputStream is = getClass().getResourceAsStream(name);
if (is == null)
{
