Details
-
New Feature
-
Status: Open
-
Critical
-
Resolution: Unresolved
-
None
-
None
-
None
Description
Batik 1.13+ has a flag blockExternalResources to allow blocking of external resources in the xlink:href of SVGs (see https://issues.apache.org/jira/browse/BATIK-1276).
However, there doesn't seem to be any way to set this flag within FOP which leaves the original SSRF security vulnerability open.
We would like to request that a new feature is added to FOP such that it's possible to set the Batik blockExternalResources flag via config.
Thank you.