From a24a0ec5c2a3d1cdef767797a68492b50c1c4a54 Mon Sep 17 00:00:00 2001 From: Tilman Hausherr Date: Sun, 22 Mar 2026 07:16:48 +0000 Subject: [PATCH] PDFBOX-6180: improve directory boundary check, as suggested by Kaixuan Li; closes #427 git-svn-id: https://svn.apache.org/repos/asf/pdfbox/branches/2.0@1932445 13f79535-47bb-0310-9956-ffa450edef68 --- .../apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java b/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java index 864099c3f38..18cf42d3b3b 100644 --- a/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java +++ b/examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java @@ -145,7 +145,9 @@ private static void extractFile(String filename, PDEmbeddedFile embeddedFile, St { File file = new File(directoryPath, filename); File parentDir = file.getParentFile(); - if (!parentDir.getCanonicalPath().startsWith(directoryPath)) + String parentCanonical = parentDir.getCanonicalPath(); + if (!parentCanonical.equals(directoryPath) && + !parentCanonical.startsWith(directoryPath + File.separator)) { System.err.println("Ignoring " + filename + " (different directory)"); return;