[BATIK-1338] Block loading jar inside svg

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.16
• Assignee: Simon Steiner
• Reporter: Simon Steiner
• Created: 28/Sep/22 10:57
• Updated: 01/Nov/22 09:19
• Resolved: 28/Sep/22 10:59

Description

We should block loading jars by default to avoid running untrusted code:

<script type="application/java-archive" xlink:href="file.jar"/>

CVE-2022-41704

Issue Links

• relates to: FOP-3104 A FOP 2.7.1 hotfix release with only updated batik dependencies to 1.16