[BATIK-1333] Block external resource before calling fop

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.15
• Assignee: Simon Steiner
• Reporter: Simon Steiner
• Created: 22/Aug/22 09:22
• Updated: 22/Sep/22 12:09
• Resolved: 22/Aug/22 09:24

Description

We should block external resource before fop is called

PDFTranscoder transcoder = new PDFTranscoder();
TranscoderInput xIn = new TranscoderInput(new FileInputStream("test.svg"));
TranscoderOutput xOut = new TranscoderOutput(new ByteArrayOutputStream());
transcoder.addTranscodingHint(PDFTranscoder.KEY_AUTO_FONTS, false);
transcoder.addTranscodingHint(ImageTranscoder.KEY_ALLOW_EXTERNAL_RESOURCES, false);
transcoder.transcode(xIn, xOut);

CVE-2022-38648