Skip to content

Sandboxed URL creation to prevent SSRF attacks #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pixeebot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Sandboxed URL creation to prevent SSRF attacks #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,5 +235,9 @@
<groupId>com.googlecode.gettext-commons</groupId>
<artifactId>gettext-maven-plugin</artifactId>
</dependency>
<dependency>

@pixeebot pixeebot Bot Aug 13, 2025

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
</dependency>
</dependencies>
</project>
8 changes: 5 additions & 3 deletions core/src/main/java/org/libreoffice/lots/WollMuxFiles.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.BufferedWriter;
import java.io.File;
import java.io.FileInputStream;
Expand Down Expand Up @@ -395,7 +397,7 @@ public static URL getDefaultContext()
*/
public static URL makeURL(String urlStr) throws MalformedURLException
{
return new URL(WollMuxFiles.getDefaultContext(), ConfigThingy.urlEncode(urlStr));
return Urls.create(WollMuxFiles.getDefaultContext(), ConfigThingy.urlEncode(urlStr), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
}

/**
Expand Down Expand Up @@ -438,7 +440,7 @@ public static void determineDefaultContext()
{
defaultContextURL = file.toURI().toURL();
}
defaultContextURL = new URL(defaultContextURL, urlVerzStr);
defaultContextURL = Urls.create(defaultContextURL, urlVerzStr, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
} catch (MalformedURLException e)
{
LOGGER.error("", e);
Expand Down Expand Up @@ -615,7 +617,7 @@ private static void dumpJVMSettings(OutputStream outStream, BufferedWriter out)
{
XStringSubstitution subst = UNO
.XStringSubstitution(UnoComponent.createComponentWithContext(UnoComponent.CSS_UTIL_PATH_SUBSTITUTION));
String jConfPath = new URL(subst.substituteVariables("$(user)/config", true)).toURI()
String jConfPath = Urls.create(subst.substituteVariables("$(user)/config", true), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).toURI()
.getPath();
File[] jConfFiles = new File(jConfPath).listFiles();
Pattern p = Pattern.compile("^javasettings_.*\\.xml$", Pattern.CASE_INSENSITIVE);
Expand Down
4 changes: 3 additions & 1 deletion core/src/main/java/org/libreoffice/lots/WollMuxSingleton.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.IOException;
import java.net.URL;
import java.util.Iterator;
Expand Down Expand Up @@ -314,7 +316,7 @@ private static void registerDatasources(ConfigThingy conf, URL context)
String parsedUrl;
try
{
URL url = new URL(context, ConfigThingy.urlEncode(urlStr));
URL url = Urls.create(context, ConfigThingy.urlEncode(urlStr), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
parsedUrl = UNO.getParsedUNOUrl(url.toExternalForm()).Complete;
} catch (Exception x)
{
Expand Down
4 changes: 3 additions & 1 deletion core/src/main/java/org/libreoffice/lots/config/ConfigThingy.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots.config;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
Expand Down Expand Up @@ -267,7 +269,7 @@ protected void childrenFromUrl(URL url, Reader read) throws IOException,
{
try
{
URL includeURL = new URL(url, urlEncode(token2.contentString()));
URL includeURL = Urls.create(url, urlEncode(token2.contentString()), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
stack.peek().childrenFromUrl(includeURL,
new InputStreamReader(includeURL.openStream(), CHARSET));
}
Expand Down
10 changes: 6 additions & 4 deletions core/src/main/java/org/libreoffice/lots/config/generator/xml/XMLGenerator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots.config.generator.xml;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.OutputStreamWriter;
Expand Down Expand Up @@ -325,7 +327,7 @@ private void createFile(final Token token) throws MalformedURLException
element.setTextContent(token.getContent());
files.peek().appendChild(element);
}
URL context = new URL("file:" + files.peek().getAttribute(FILE_NAME));
URL context = Urls.create("file:" + files.peek().getAttribute(FILE_NAME), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
String newFile = PathProcessor.processInclude(token.getContent());
Path path = Paths.get(newFile);
element = document.createElement(XMLTags.FILE.getName());
Expand All @@ -334,16 +336,16 @@ private void createFile(final Token token) throws MalformedURLException
{
if(path.toFile().exists())
{
element.setAttribute(FILE_NAME, new URL(context, "/" + newFile).getPath());
element.setAttribute(FILE_NAME, Urls.create(context, "/" + newFile, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).getPath());
}
else
{
element.setAttribute(FILE_NAME, new URL(context, newFile).getPath());
element.setAttribute(FILE_NAME, Urls.create(context, newFile, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).getPath());
}
}
else
{
element.setAttribute(FILE_NAME, new URL(context, newFile).getPath());
element.setAttribute(FILE_NAME, Urls.create(context, newFile, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).getPath());
}
config.appendChild(element);
files.push(element);
Expand Down
5 changes: 3 additions & 2 deletions core/src/main/java/org/libreoffice/lots/config/scanner/Scanner.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots.config.scanner;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.Closeable;
import java.io.IOException;
import java.io.InputStream;
Expand Down Expand Up @@ -117,8 +119,7 @@ public Token next()
{
try
{
stack.push(new Tokenizer(new URL(stack.peek().getFilename(),
PathProcessor.processInclude(token.getContent()))));
stack.push(new Tokenizer(Urls.create(stack.peek().getFilename(), PathProcessor.processInclude(token.getContent()), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS)));
} catch (final IOException e)
{
LOGGER.error("Could not open file for token {}.", token.getContent(), e);
Expand Down
4 changes: 3 additions & 1 deletion core/src/main/java/org/libreoffice/lots/db/ThingyDatasource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots.db;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
Expand Down Expand Up @@ -67,7 +69,7 @@ public ThingyDatasource(Map<String, Datasource> nameToDatasource, ConfigThingy s

try
{
URL url = new URL(context, ConfigThingy.urlEncode(urlStr));
URL url = Urls.create(context, ConfigThingy.urlEncode(urlStr), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
ConfigThingy conf = new ConfigThingy(name, url);

ConfigThingy schemaDesc = conf.get("Schema");
Expand Down
4 changes: 3 additions & 1 deletion core/src/main/java/org/libreoffice/lots/document/DocumentLoader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots.document;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
Expand Down Expand Up @@ -91,7 +93,7 @@ public ByteBuffer load(String url) throws Exception
private ByteBuffer downloadDocument(String url)
{
byte[] buf = null;
try (InputStream in = new URL(url).openStream())
try (InputStream in = Urls.create(url, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).openStream())
{
buf = IOUtils.toByteArray(in);
} catch (IOException e)
Expand Down
4 changes: 3 additions & 1 deletion core/src/main/java/org/libreoffice/lots/event/handlers/OnSaveAs.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots.event.handlers;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.File;
import java.net.MalformedURLException;
import java.net.URL;
Expand Down Expand Up @@ -131,7 +133,7 @@ private File getDefaultFile(Function func)
try
{
Object ps = UnoComponent.createComponentWithContext(UnoComponent.CSS_UTIL_PATH_SETTINGS);
URL dir = new URL(AnyConverter.toString(Utils.getProperty(ps, UnoProperty.WORK)));
URL dir = Urls.create(AnyConverter.toString(Utils.getProperty(ps, UnoProperty.WORK)), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
return new File(dir.getPath(), filename);
} catch (com.sun.star.lang.IllegalArgumentException
| MalformedURLException e)
Expand Down
4 changes: 3 additions & 1 deletion core/src/main/java/org/libreoffice/lots/func/Dateinamensanpassungen.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots.func;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.io.File;
import java.net.MalformedURLException;
import java.net.URL;
Expand Down Expand Up @@ -109,7 +111,7 @@ public static String lhmDateinamensanpassung(String fileName)
{
// gets the working directory path from LO
Object ps = UnoComponent.createComponentWithContext(UnoComponent.CSS_UTIL_PATH_SETTINGS);
URL dir = new URL(AnyConverter.toString(UnoProperty.getProperty(ps, UnoProperty.WORK)));
URL dir = Urls.create(AnyConverter.toString(UnoProperty.getProperty(ps, UnoProperty.WORK)), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
f = new File(dir.getPath(), fileName);
} catch (MalformedURLException | UnoHelperException e)
{
Expand Down
4 changes: 3 additions & 1 deletion core/src/main/java/org/libreoffice/lots/mailmerge/sidebar/MailMergeController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
*/
package org.libreoffice.lots.mailmerge.sidebar;

import io.github.pixee.security.HostValidator;
import io.github.pixee.security.Urls;
import java.awt.event.ActionListener;
import java.net.MalformedURLException;
import java.net.URISyntaxException;
Expand Down Expand Up @@ -781,7 +783,7 @@ private void openCalcFromSettings(ConfigThingy datenquelle)
String model = "";
try
{
String[] splittedURL = Paths.get(new URL(url).toURI()).toFile().getName().split("\\.");
String[] splittedURL = Paths.get(Urls.create(url, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS).toURI()).toFile().getName().split("\\.");
model = splittedURL[splittedURL.length - 2];
} catch (MalformedURLException | URISyntaxException e)
{
Expand Down
6 changes: 6 additions & 0 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
<wollmux.test.conf>${project.build.directory}/config/.lots/lots.conf</wollmux.test.conf>
<office.user.profile>${project.build.directory}/office</office.user.profile>
<maven.javadoc.failOnWarnings>false</maven.javadoc.failOnWarnings>
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
</properties>

<modules>
Expand Down Expand Up @@ -397,6 +398,11 @@
<version>0.8.5</version>
<scope>test</scope>
</dependency>
<dependency>

@pixeebot pixeebot Bot Aug 13, 2025

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

<groupId>io.github.pixee</groupId>
<artifactId>java-security-toolkit</artifactId>
<version>${versions.java-security-toolkit}</version>
</dependency>
</dependencies>
</dependencyManagement>

Expand Down