pjfanning commented on PR #1452: URL: https://github.com/apache/poi/pull/1452#issuecomment-6349999157
Thanks - confirmed. `SVGImageRenderer` parses the picture with an empty document URL, so Batik's `DefaultExternalResourceSecurity` same-host check passed `file:` (and relative) references, and the renderer read files from the rendering machine's disk. Returning `EmbededExternalResourceSecurity` from `SVGUserAgent` limits loading to `data:` URLs; same-document `#id` references still work. Follow-up points: 1. **One blocked reference aborts the whole slide.** Batik reports a refused resource as `BridgeException`, which is a `RuntimeException` (`SVGImageElementBridge.checkLoadExternalResource` -> `ERR_URI_UNSECURE`; broken links go through `UserAgentAdapter.getBrokenLinkDocument`, which also throws). `DrawPictureShape.draw` and `DrawPaint` only catch `IOException`, so the exception escapes the whole slide render instead of skipping the one picture. That already happened for `http:` references and broken links, but this change widens it to `file:` and relative references that used to render. Suggest catching `BridgeException` in `SVGImageRenderer.loadImage` and rethrowing it as an `IOException`, so the picture is logged and skipped like any other unreadable image. The test would then expect `IOException`. 2. **Stale comment.** The `TOOO: tell the batik guys to use secure parsing feature` comment in the `SVGImageRenderer` constructor can go: Batik 1.19's `SAXDocumentFactory` already disables external general/parameter entities and external DTD loading. 3. **Scripts (no action needed, for the record).** Scripts in SVG pictures don't run. `GVTBuilder.build` doesn't load scripts even with `setDynamic(true)` (only Batik's `UpdateManager` does, and POI never creates one), and Rhino is only an optional dependency of `batik-script`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
