naruto-lgtm opened a new pull request, #1452: URL: https://github.com/apache/poi/pull/1452
Repro: put an SVG picture in a .pptx whose markup contains `<image xlink:href="file:///path/to/secret.png" width="100" height="100"/>` or `<use xlink:href="file:///path/to/other.svg#id"/>`, then render the slide with `XSLFSlide.draw` or `PPTX2PNG`. The file is read from the local disk of the machine doing the rendering and drawn into the output, so a presentation converted to thumbnails on a server shows that server's images and SVG files in the result. `http:` references are already refused. Cause: `SVGUserAgent` inherits `UserAgentAdapter.getExternalResourceSecurity`, which returns Batik's `DefaultExternalResourceSecurity` (a same-host check). `SVGImageRenderer` loads the picture with an empty document URI, so the document host is null, and a `file:` URL's host is null too, so the check passes. Fix: `SVGUserAgent` returns `EmbededExternalResourceSecurity`, which allows only `data:` URLs. An SVG picture is self-contained in the package and has no location of its own to resolve against. Same-document references (`#id`) and `data:` images still render. The new `TestSVGImageRenderer` fails before the change; the xslf and sl tests still pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
