PDFBOX-5660: skip different directory

THausherr · THausherr · commit 1033d94a58bb · 2026-01-20T20:00:42.000Z
git-svn-id: https://svn.apache.org/repos/asf/pdfbox/trunk@1931439 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java b/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java
@@ -61,7 +61,7 @@ public static void main( String[] args ) throws IOException
         }
 
         File pdfFile = new File(args[0]);
-        String directoryPath = pdfFile.getParent();
+        String directoryPath = pdfFile.getParentFile().getCanonicalPath();
         try (PDDocument document = Loader.loadPDF(pdfFile))
         {
             PDDocumentNameDictionary namesDictionary =
@@ -141,6 +141,11 @@ private static void extractFile(String filename, PDEmbeddedFile embeddedFile, St
     {
         File file = new File(directoryPath, filename);
         File parentDir = file.getParentFile();
+        if (!parentDir.getCanonicalPath().startsWith(directoryPath))
+        {
+            System.err.println("Ignoring " + filename + " (different directory)");
+            return;
+        }
         if (!parentDir.exists())
         {
             // sometimes paths contain a directory

Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@ public static void main( String[] args ) throws IOException`
`61`	`61`	`}`
`62`	`62`
`63`	`63`	`File pdfFile = new File(args[0]);`
`64`		`- String directoryPath = pdfFile.getParent();`
	`64`	`+ String directoryPath = pdfFile.getParentFile().getCanonicalPath();`
`65`	`65`	`try (PDDocument document = Loader.loadPDF(pdfFile))`
`66`	`66`	`{`
`67`	`67`	`PDDocumentNameDictionary namesDictionary =`
`@@ -141,6 +141,11 @@ private static void extractFile(String filename, PDEmbeddedFile embeddedFile, St`
`141`	`141`	`{`
`142`	`142`	`File file = new File(directoryPath, filename);`
`143`	`143`	`File parentDir = file.getParentFile();`
	`144`	`+ if (!parentDir.getCanonicalPath().startsWith(directoryPath))`
	`145`	`+ {`
	`146`	`+ System.err.println("Ignoring " + filename + " (different directory)");`
	`147`	`+ return;`
	`148`	`+ }`
`144`	`149`	`if (!parentDir.exists())`
`145`	`150`	`{`
`146`	`151`	`// sometimes paths contain a directory`