117 lines
5.2 KiB
Diff
117 lines
5.2 KiB
Diff
From bc6078ca949039e2076cd08b4cb169c84c1179b1 Mon Sep 17 00:00:00 2001
|
|
From: Simon Steiner <ssteiner@apache.org>
|
|
Date: Mon, 9 Dec 2019 12:24:18 +0000
|
|
Subject: [PATCH] BATIK-1276: Allow blocking of external resources
|
|
|
|
git-svn-id: https://svn.apache.org/repos/asf/xmlgraphics/batik/trunk@1871084 13f79535-47bb-0310-9956-ffa450edef68
|
|
---
|
|
.../apache/batik/apps/rasterizer/Main.java | 17 +++++++++++++++++
|
|
.../batik/apps/rasterizer/SVGConverter.java | 6 ++++++
|
|
.../transcoder/SVGAbstractTranscoder.java | 19 +++++++++++++++++++
|
|
3 files changed, 42 insertions(+)
|
|
|
|
diff --git a/batik-svgrasterizer/src/main/java/org/apache/batik/apps/rasterizer/Main.java b/batik-svgrasterizer/src/main/java/org/apache/batik/apps/rasterizer/Main.java
|
|
index c70b4dd691..a4248b527d 100644
|
|
--- a/batik-svgrasterizer/src/main/java/org/apache/batik/apps/rasterizer/Main.java
|
|
+++ b/batik-svgrasterizer/src/main/java/org/apache/batik/apps/rasterizer/Main.java
|
|
@@ -501,6 +501,12 @@ public Color parseARGB(String argbVal){
|
|
public static String CL_OPTION_CONSTRAIN_SCRIPT_ORIGIN_DESCRIPTION
|
|
= Messages.get("Main.cl.option.constrain.script.origin.description", "No description");
|
|
|
|
+ public static String CL_OPTION_BLOCK_EXTERNAL_RESOURCES
|
|
+ = Messages.get("Main.cl.option.block.external.resources", "-blockExternalResources");
|
|
+
|
|
+ public static String CL_OPTION_BLOCK_EXTERNAL_RESOURCES_DESCRIPTION
|
|
+ = Messages.get("Main.cl.option.block.external.resources.description", "No description");
|
|
+
|
|
/**
|
|
* Option to turn off secure execution of scripts
|
|
*/
|
|
@@ -829,6 +835,17 @@ public String getOptionDescription(){
|
|
return CL_OPTION_SECURITY_OFF_DESCRIPTION;
|
|
}
|
|
});
|
|
+
|
|
+ optionMap.put(CL_OPTION_BLOCK_EXTERNAL_RESOURCES,
|
|
+ new NoValueOptionHandler(){
|
|
+ public void handleOption(SVGConverter c){
|
|
+ c.allowExternalResources = false;
|
|
+ }
|
|
+
|
|
+ public String getOptionDescription(){
|
|
+ return CL_OPTION_BLOCK_EXTERNAL_RESOURCES_DESCRIPTION;
|
|
+ }
|
|
+ });
|
|
}
|
|
|
|
/**
|
|
diff --git a/batik-svgrasterizer/src/main/java/org/apache/batik/apps/rasterizer/SVGConverter.java b/batik-svgrasterizer/src/main/java/org/apache/batik/apps/rasterizer/SVGConverter.java
|
|
index 324c3abcfe..9ec2135458 100644
|
|
--- a/batik-svgrasterizer/src/main/java/org/apache/batik/apps/rasterizer/SVGConverter.java
|
|
+++ b/batik-svgrasterizer/src/main/java/org/apache/batik/apps/rasterizer/SVGConverter.java
|
|
@@ -253,6 +253,8 @@ Licensed to the Apache Software Foundation (ASF) under one or more
|
|
the document which references them. */
|
|
protected boolean constrainScriptOrigin = true;
|
|
|
|
+ protected boolean allowExternalResources = true;
|
|
+
|
|
/** Controls whether scripts should be run securely or not */
|
|
protected boolean securityOff = false;
|
|
|
|
@@ -925,6 +927,10 @@ protected Map computeTranscodingHints(){
|
|
map.put(ImageTranscoder.KEY_CONSTRAIN_SCRIPT_ORIGIN, Boolean.FALSE);
|
|
}
|
|
|
|
+ if (!allowExternalResources) {
|
|
+ map.put(ImageTranscoder.KEY_ALLOW_EXTERNAL_RESOURCES, Boolean.FALSE);
|
|
+ }
|
|
+
|
|
return map;
|
|
}
|
|
|
|
diff --git a/batik-transcoder/src/main/java/org/apache/batik/transcoder/SVGAbstractTranscoder.java b/batik-transcoder/src/main/java/org/apache/batik/transcoder/SVGAbstractTranscoder.java
|
|
index 65d983bfae..8d6ffe3b1f 100644
|
|
--- a/batik-transcoder/src/main/java/org/apache/batik/transcoder/SVGAbstractTranscoder.java
|
|
+++ b/batik-transcoder/src/main/java/org/apache/batik/transcoder/SVGAbstractTranscoder.java
|
|
@@ -33,8 +33,10 @@ Licensed to the Apache Software Foundation (ASF) under one or more
|
|
import org.apache.batik.bridge.BridgeContext;
|
|
import org.apache.batik.bridge.BridgeException;
|
|
import org.apache.batik.bridge.DefaultScriptSecurity;
|
|
+import org.apache.batik.bridge.ExternalResourceSecurity;
|
|
import org.apache.batik.bridge.GVTBuilder;
|
|
import org.apache.batik.bridge.NoLoadScriptSecurity;
|
|
+import org.apache.batik.bridge.NoLoadExternalResourceSecurity;
|
|
import org.apache.batik.bridge.RelaxedScriptSecurity;
|
|
import org.apache.batik.bridge.SVGUtilities;
|
|
import org.apache.batik.bridge.ScriptSecurity;
|
|
@@ -877,6 +879,9 @@ protected void setImageSize(float docWidth, float docHeight) {
|
|
= new BooleanKey();
|
|
|
|
|
|
+ public static final TranscodingHints.Key KEY_ALLOW_EXTERNAL_RESOURCES
|
|
+ = new BooleanKey();
|
|
+
|
|
/**
|
|
* A user agent implementation for <code>PrintTranscoder</code>.
|
|
*/
|
|
@@ -1109,5 +1114,19 @@ protected void computeAllowedScripts(){
|
|
}
|
|
}
|
|
|
|
+ public ExternalResourceSecurity getExternalResourceSecurity(ParsedURL resourceURL, ParsedURL docURL) {
|
|
+ if (isAllowExternalResources()) {
|
|
+ return super.getExternalResourceSecurity(resourceURL, docURL);
|
|
+ }
|
|
+ return new NoLoadExternalResourceSecurity();
|
|
+ }
|
|
+
|
|
+ public boolean isAllowExternalResources() {
|
|
+ Boolean b = (Boolean)SVGAbstractTranscoder.this.hints.get(KEY_ALLOW_EXTERNAL_RESOURCES);
|
|
+ if (b != null) {
|
|
+ return b;
|
|
+ }
|
|
+ return true;
|
|
+ }
|
|
}
|
|
}
|