mrdevel2002-ui opened a new pull request, #3313: URL: https://github.com/apache/tika/pull/3313
A per-request `pdf-parser` parse-context block reaches `PDFParserConfig.setImageGraphicsEngineFactoryClass`, which does `Class.forName(className).getDeclaredConstructor().newInstance()`, so a caller picks a class on the server's classpath and gets it loaded and constructed: a `FetchEmitTuple` parseContext is always untrusted wire input (`restricted=true`), and tika-server's multipart `config` part is too once `allowPerRequestConfig` is on. The gate in `ParseContextDeserializer` cannot see it, because every `Parser` is `SelfConfiguring`, so a top-level `pdf-parser` key is treated as inert per-request config and its subtree is never scanned; `pdf-parser` happens to be the one self-configuring config with a reflective setter and no `RuntimeConfig` to screen it, while `tesseract-ocr-parser`, `tess4j-parser`, `dwg-read-parser`, `strings-parser` and the magika/siegfried detectors all guard their operator-only fields that way. Patch adds the missing `PDFParserConfig.RuntimeConfig` and re solves untrusted JSON through it before the real config, so operator-authored config (config file, presets, the `parsers` block) is `trusted()` and keeps working unchanged. AI tooling was used to help prepare this change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
