From de43038fd957fbb770c06aa6af9c9a5d3d28b5d6 Mon Sep 17 00:00:00 2001 From: "pixeebotstirling[bot]" <221352955+pixeebotstirling[bot]@users.noreply.github.com> Date: Thu, 17 Jul 2025 17:15:39 +0100 Subject: [PATCH 1/7] =?UTF-8?q?=E2=9C=A8=20(Snyk)=20Fixed=20finding:=20"ja?= =?UTF-8?q?va/PT"=20(#3971)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Pixee Fix ID:** [baa2e86a-2e2f-4c8e-99e0-bc99ce846b94](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/baa2e86a-2e2f-4c8e-99e0-bc99ce846b94)
Confidence: HIGH Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. [View Details in Pixee.](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/baa2e86a-2e2f-4c8e-99e0-bc99ce846b94)
--- ✨✨✨ ## Remediation This change fixes "java/PT" (id = java/PT) identified by Snyk. ## Details Path Traversal is a security vulnerability that enables attackers to gain unauthorized access to files and directories stored outside the web root folder. To address this, a fix was made by adding java.nio.file.Paths import for path validation, ensuring that paths are properly sanitized and validated. Co-authored-by: pixeebotstirling[bot] <221352955+pixeebotstirling[bot]@users.noreply.github.com> --- .../SPDF/controller/api/misc/PrintFileController.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/PrintFileController.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/PrintFileController.java index 79140c571..e572432df 100644 --- a/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/PrintFileController.java +++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/PrintFileController.java @@ -7,6 +7,7 @@ import java.awt.print.Printable; import java.awt.print.PrinterException; import java.awt.print.PrinterJob; import java.io.IOException; +import java.nio.file.Paths; import java.util.Arrays; import javax.imageio.ImageIO; @@ -45,6 +46,10 @@ public class PrintFileController { public ResponseEntity printFile(@ModelAttribute PrintFileRequest request) throws IOException { MultipartFile file = request.getFileInput(); + String originalFilename = file.getOriginalFilename(); + if (originalFilename != null && (originalFilename.contains("..") || Paths.get(originalFilename).isAbsolute())) { + throw new IOException("Invalid file path detected: " + originalFilename); + } String printerName = request.getPrinterName(); String contentType = file.getContentType(); try { From 526071059e640caee654fb7958ac525be864ecb9 Mon Sep 17 00:00:00 2001 From: "pixeebotstirling[bot]" <221352955+pixeebotstirling[bot]@users.noreply.github.com> Date: Thu, 17 Jul 2025 17:16:09 +0100 Subject: [PATCH 2/7] =?UTF-8?q?=E2=9C=A8=20(Snyk)=20Fixed=20finding:=20"ja?= =?UTF-8?q?va/PT"=20(#3972)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Pixee Fix ID:** [8be62d8f-950d-4780-bc08-a8c04d176806](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/8be62d8f-950d-4780-bc08-a8c04d176806)
Confidence: HIGH Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. [View Details in Pixee.](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/8be62d8f-950d-4780-bc08-a8c04d176806)
--- ✨✨✨ ## Remediation This change fixes "java/PT" (id = java/PT) identified by Snyk. ## Details Path Traversal vulnerabilities allow attackers to manipulate paths to access files and directories that are outside of the intended scope. The fix involves adding an import for java.io.File to handle file paths more securely. Co-authored-by: pixeebotstirling[bot] <221352955+pixeebotstirling[bot]@users.noreply.github.com> --- .../controller/api/converters/ConvertImgPDFController.java | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertImgPDFController.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertImgPDFController.java index 2466a0007..82dcc2bc5 100644 --- a/app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertImgPDFController.java +++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/converters/ConvertImgPDFController.java @@ -1,6 +1,7 @@ package stirling.software.SPDF.controller.api.converters; import java.io.ByteArrayOutputStream; +import java.io.File; import java.io.FileOutputStream; import java.io.IOException; import java.net.URLConnection; @@ -87,7 +88,7 @@ public class ConvertImgPDFController { // returns bytes for image boolean singleImage = "single".equals(singleOrMultiple); String filename = - Filenames.toSimpleFileName(file.getOriginalFilename()) + Filenames.toSimpleFileName(new File(file.getOriginalFilename()).getName()) .replaceFirst("[.][^.]+$", ""); result = @@ -231,7 +232,7 @@ public class ConvertImgPDFController { PdfUtils.imageToPdf(file, fitOption, autoRotate, colorType, pdfDocumentFactory); return WebResponseUtils.bytesToWebResponse( bytes, - file[0].getOriginalFilename().replaceFirst("[.][^.]+$", "") + "_converted.pdf"); + new File(file[0].getOriginalFilename()).getName().replaceFirst("[.][^.]+$", "") + "_converted.pdf"); } private String getMediaType(String imageFormat) { From 76d150289e97d8be471a30af6d500fc80bb31cd1 Mon Sep 17 00:00:00 2001 From: "pixeebotstirling[bot]" <221352955+pixeebotstirling[bot]@users.noreply.github.com> Date: Thu, 17 Jul 2025 17:16:50 +0100 Subject: [PATCH 3/7] =?UTF-8?q?=E2=9C=A8=20(Snyk)=20Fixed=20finding:=20"ja?= =?UTF-8?q?va/Ssrf"=20(#3973)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Pixee Fix ID:** [54568072-e1ef-4428-9da3-46b9197f6dcd](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/54568072-e1ef-4428-9da3-46b9197f6dcd)
Confidence: HIGH Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. [View Details in Pixee.](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/54568072-e1ef-4428-9da3-46b9197f6dcd)
--- ✨✨✨ ## Remediation This change fixes "java/Ssrf" (id = java/Ssrf) identified by Snyk. ## Details Server-Side Request Forgery (SSRF) can allow attackers to make unauthorized requests from the server, potentially accessing sensitive internal systems. The fix involved adding a validation check to ensure that the 'operation' parameter matches a safe regex pattern, thereby preventing such vulnerabilities. Co-authored-by: pixeebotstirling[bot] <221352955+pixeebotstirling[bot]@users.noreply.github.com> --- .../SPDF/controller/api/pipeline/PipelineProcessor.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java index 5c1fd5f4a..9d919c12a 100644 --- a/app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java +++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java @@ -108,7 +108,9 @@ public class PipelineProcessor { if (inputFileTypes == null) { inputFileTypes = new ArrayList(Arrays.asList("ALL")); } - // List outputFileTypes = apiDocService.getExtensionTypes(true, operation); + if (!operation.matches("^[a-zA-Z0-9_-]+$")) { + throw new IllegalArgumentException("Invalid operation value received."); + } String url = getBaseUrl() + operation; List newOutputFiles = new ArrayList<>(); if (!isMultiInputOperation) { From ed894f021b25df46d48ff91b78e169a8e2199506 Mon Sep 17 00:00:00 2001 From: "pixeebotstirling[bot]" <221352955+pixeebotstirling[bot]@users.noreply.github.com> Date: Thu, 17 Jul 2025 17:17:11 +0100 Subject: [PATCH 4/7] =?UTF-8?q?=E2=9C=A8=20(Snyk)=20Fixed=20finding:=20"ja?= =?UTF-8?q?va/PT"=20(#3974)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Pixee Fix ID:** [dab7f6f1-da39-4654-a537-2de8eee936db](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/dab7f6f1-da39-4654-a537-2de8eee936db)
Confidence: HIGH Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. [View Details in Pixee.](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/dab7f6f1-da39-4654-a537-2de8eee936db)
--- ✨✨✨ ## Remediation This change fixes "java/PT" (id = java/PT) identified by Snyk. ## Details Path Traversal is a security vulnerability that allows attackers to access files and directories stored outside the web root folder. The impact can include unauthorized access to sensitive files. The fix involved adding validation checks on filenames to ensure they do not contain suspicious patterns like '..' or '/' which are indicative of path traversal attempts. Co-authored-by: pixeebotstirling[bot] <221352955+pixeebotstirling[bot]@users.noreply.github.com> --- .../SPDF/controller/api/misc/StampController.java | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java index bdf27c519..a784b0f39 100644 --- a/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java +++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java @@ -42,6 +42,7 @@ import stirling.software.common.service.CustomPDFDocumentFactory; import stirling.software.common.util.TempFile; import stirling.software.common.util.TempFileManager; import stirling.software.common.util.WebResponseUtils; +import java.lang.IllegalArgumentException; @RestController @RequestMapping("/api/v1/misc") @@ -62,9 +63,18 @@ public class StampController { public ResponseEntity addStamp(@ModelAttribute AddStampRequest request) throws IOException, Exception { MultipartFile pdfFile = request.getFileInput(); + String pdfFileName = pdfFile.getOriginalFilename(); + if (pdfFileName.contains("..") || pdfFileName.startsWith("/")) { + throw new IllegalArgumentException("Invalid PDF file path"); + } + String stampType = request.getStampType(); String stampText = request.getStampText(); MultipartFile stampImage = request.getStampImage(); + String stampImageName = stampImage.getOriginalFilename(); + if (stampImageName.contains("..") || stampImageName.startsWith("/")) { + throw new IllegalArgumentException("Invalid stamp image file path"); + } String alphabet = request.getAlphabet(); float fontSize = request.getFontSize(); float rotation = request.getRotation(); From d15a27540682b9e9718a24aef1f2429c122a9df4 Mon Sep 17 00:00:00 2001 From: "pixeebotstirling[bot]" <221352955+pixeebotstirling[bot]@users.noreply.github.com> Date: Thu, 17 Jul 2025 17:17:55 +0100 Subject: [PATCH 5/7] =?UTF-8?q?=E2=9C=A8=20(Snyk)=20Fixed=20finding:=20"ja?= =?UTF-8?q?va/PT"=20(#3975)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Pixee Fix ID:** [203062ab-1b9b-42b8-be64-1358106dccab](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/203062ab-1b9b-42b8-be64-1358106dccab)
Confidence: HIGH Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. [View Details in Pixee.](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/203062ab-1b9b-42b8-be64-1358106dccab)
--- ✨✨✨ ## Remediation This change fixes "java/PT" (id = java/PT) identified by Snyk. ## Details Path Traversal is a security vulnerability that allows attackers to gain unauthorized access to files and directories outside the permitted access path by manipulating file paths. The fix involves adding validation to detect potential directory traversal attempts by normalizing the file path and checking if it begins with '..', thereby preventing malicious manipulation. Co-authored-by: pixeebotstirling[bot] <221352955+pixeebotstirling[bot]@users.noreply.github.com> --- .../SPDF/controller/api/pipeline/PipelineProcessor.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java index 9d919c12a..d79105c26 100644 --- a/app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java +++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java @@ -329,6 +329,10 @@ public class PipelineProcessor { } List outputFiles = new ArrayList<>(); for (File file : files) { + Path normalizedPath = Paths.get(file.getName()).normalize(); + if (normalizedPath.startsWith("..")) { + throw new SecurityException("Potential path traversal attempt in file name: " + file.getName()); + } Path path = Paths.get(file.getAbsolutePath()); // debug statement log.info("Reading file: " + path); From d79d179d80a8b39264f91928a06ff2b6b6b0855a Mon Sep 17 00:00:00 2001 From: "pixeebotstirling[bot]" <221352955+pixeebotstirling[bot]@users.noreply.github.com> Date: Thu, 17 Jul 2025 17:18:27 +0100 Subject: [PATCH 6/7] =?UTF-8?q?=E2=9C=A8=20(Snyk)=20Fixed=20finding:=20"ja?= =?UTF-8?q?va/PT"=20(#3976)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Pixee Fix ID:** [fb5fe72b-5b22-4654-a733-20930cb4f96a](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/fb5fe72b-5b22-4654-a733-20930cb4f96a)
Confidence: HIGH Fix confidence is a rating derived from an internal benchmark and includes High, Medium, and Low confidence fixes. It comprises three weighted scores reflecting the safety, effectiveness and cleanliness of Pixee's code changes within a fix. [View Details in Pixee.](https://stirlingpdf.getpixee.com/analysis/3c9d2b94-57c2-4525-9776-c5cd149902c4/fix/fb5fe72b-5b22-4654-a733-20930cb4f96a)
--- ✨✨✨ ## Remediation This change fixes "java/PT" (id = java/PT) identified by Snyk. ## Details Path traversal is a security vulnerability that occurs when an attacker is able to access directories and files stored outside the intended directory. It bypasses security mechanisms by manipulating variables that reference files with `../` sequences. The fix involved adding validation for `pdfFile` and `watermarkImage` to check for directory traversal sequences, thereby preventing SecurityException occurrences. Co-authored-by: pixeebotstirling[bot] <221352955+pixeebotstirling[bot]@users.noreply.github.com> --- .../controller/api/security/WatermarkController.java | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java index 47a53a4f9..fd5a9b288 100644 --- a/app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java +++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/security/WatermarkController.java @@ -74,9 +74,19 @@ public class WatermarkController { public ResponseEntity addWatermark(@ModelAttribute AddWatermarkRequest request) throws IOException, Exception { MultipartFile pdfFile = request.getFileInput(); + String pdfFileName = pdfFile.getOriginalFilename(); + if (pdfFileName != null && (pdfFileName.contains("..") || pdfFileName.startsWith("/"))) { + throw new SecurityException("Invalid file path in pdfFile"); + } String watermarkType = request.getWatermarkType(); String watermarkText = request.getWatermarkText(); MultipartFile watermarkImage = request.getWatermarkImage(); + if (watermarkImage != null) { + String watermarkImageFileName = watermarkImage.getOriginalFilename(); + if (watermarkImageFileName != null && (watermarkImageFileName.contains("..") || watermarkImageFileName.startsWith("/"))) { + throw new SecurityException("Invalid file path in watermarkImage"); + } + } String alphabet = request.getAlphabet(); float fontSize = request.getFontSize(); float rotation = request.getRotation(); From 64d8ef4a39ae58a87b56e16ae4abd4514cbb4a24 Mon Sep 17 00:00:00 2001 From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com> Date: Fri, 18 Jul 2025 18:25:50 +0100 Subject: [PATCH 7/7] Update CODEOWNERS (#3981) Co-authored-by: Connor Yoh --- .github/CODEOWNERS | 2 +- .github/config/repo_devs.json | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 85e115bff..8d4e98e5a 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,2 +1,2 @@ # All PRs to V1 must be approved by Frooodle -* @Frooodle @reecebrowne @Ludy87 @DarioGii @ConnorYoh +* @Frooodle @reecebrowne @Ludy87 @DarioGii @ConnorYoh @EthanHealy01 diff --git a/.github/config/repo_devs.json b/.github/config/repo_devs.json index 6f8b9f90c..86d43fd98 100644 --- a/.github/config/repo_devs.json +++ b/.github/config/repo_devs.json @@ -7,6 +7,7 @@ "sbplat", "reecebrowne", "DarioGii", - "ConnorYoh" + "ConnorYoh", + "EthanHealy01" ] }