pjfanning opened a new pull request, #102: URL: https://github.com/apache/poi-xmlbeans/pull/102
## Problem `FileResourceLoader.getResourceAsStream` builds `new File(_directory, resourceName)` and opens it with no containment check: ```java return Files.newInputStream(new File(_directory, resourceName).toPath()); ``` The `resourceName` for a compiled schema component is `getBasePackage() + handle + ".xsb"`, and the `handle` is read verbatim from the `.xsb` index with no validation (`SchemaTypePool.readHandlePool` → `reader.readString()`). A handle such as `../../../../../../etc/passwd` in an **untrusted compiled type system loaded from a directory** (e.g. via `XmlBeans.resourceLoaderForPath(File[])`) therefore resolves outside `_directory` when the component is dereferenced (`SchemaTypeSystemImpl.resolveHandle` → `new XsbReader(...)` → `XsbReader.java:60`). This is an arbitrary read of any `.xsb`-suffixed file on disk, and on Windows a UNC handle triggers SMB egress. ## Fix Reject any resolved path whose canonical form is not inside the resource directory. Legitimate handles are single filename segments (`NameUtil.upperCamelCase` output, lowercased, with an optional numeric disambiguator), so they always stay inside the directory and are unaffected. Zip/jar-backed loading already uses `ZipFile.getEntry` — a name lookup that cannot touch the filesystem — so only the directory-backed path needed changing. ## Testing - `./gradlew compileJava` clean - `./gradlew test --tests compile.scomp.checkin.CompilationTests` passes (exercises schema compile + load) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
