Ticket #24793: 24793.patch
| File 24793.patch, 13.5 KB (added by , 4 days ago) |
|---|
-
build.xml
1118 1118 <exclude name="com/drew/metadata/wav/**"/> 1119 1119 <exclude name="com/drew/metadata/webp/**"/> 1120 1120 <exclude name="com/drew/tools/**"/> 1121 <exclude name="com/kitfox/svg/app/ant/**"/>1122 <exclude name="com/kitfox/svg/app/*Dialog*"/>1123 <exclude name="com/kitfox/svg/app/*Frame*"/>1124 <exclude name="com/kitfox/svg/app/*Player*"/>1125 <exclude name="com/kitfox/svg/app/*Viewer*"/>1126 1121 <exclude name="org/apache/commons/compress/PasswordRequiredException*"/> 1127 1122 <exclude name="org/apache/commons/compress/archivers/**"/> 1128 1123 <exclude name="org/apache/commons/compress/changes/**"/> -
ivy.xml
31 31 <dependency conf="api->default" org="org.tukaani" name="xz" rev="1.11"/> 32 32 <dependency conf="api->default" org="com.adobe.xmp" name="xmpcore" rev="6.1.11"/> 33 33 <dependency conf="api->default" org="com.drewnoakes" name="metadata-extractor" rev="2.19.0" transitive="false"/> 34 <dependency conf="api->default" org="com.formdev" name="svgSalamander" rev="1.1.4"/> 34 <dependency conf="api->default" org="com.github.weisj" name="jsvg" rev="1.7.0"/> 35 <dependency conf="api->default" org="org.jetbrains" name="annotations" rev="24.1.0"/> 35 36 <dependency conf="api->default" org="ch.poole" name="OpeningHoursParser" rev="0.29.0"/> 36 37 <!-- Don't forget to update org.openstreetmap.josm.tools.Tag2Link#PREF_SOURCE --> 37 38 <dependency conf="api->default" org="org.webjars.npm" name="tag2link" rev="2026.6.26"/> -
pom.xml
123 123 <scope>compile</scope> 124 124 </dependency> 125 125 <dependency> 126 <groupId>com. formdev</groupId>127 <artifactId> svgSalamander</artifactId>126 <groupId>com.github.weisj</groupId> 127 <artifactId>jsvg</artifactId> 128 128 <scope>compile</scope> 129 129 </dependency> 130 130 <dependency> 131 <groupId>org.jetbrains</groupId> 132 <artifactId>annotations</artifactId> 133 <version>24.1.0</version> 134 <scope>provided</scope> 135 </dependency> 136 <dependency> 131 137 <groupId>ch.poole</groupId> 132 138 <artifactId>OpeningHoursParser</artifactId> 133 139 <scope>compile</scope> … … 661 667 </excludes> 662 668 </filter> 663 669 <filter> 664 <artifact>com.formdev:svgSalamander</artifact>665 <excludes>666 <exclude>com/kitfox/svg/app/ant/**</exclude>667 <exclude>com/kitfox/svg/app/*Dialog*</exclude>668 <exclude>com/kitfox/svg/app/*Frame*</exclude>669 <exclude>com/kitfox/svg/app/*Player*</exclude>670 <exclude>com/kitfox/svg/app/*Viewer*</exclude>671 </excludes>672 </filter>673 <filter>674 670 <artifact>org.apache.commons:commons-compress</artifact> 675 671 <excludes> 676 672 <exclude>org/apache/commons/compress/PasswordRequiredException*</exclude> -
src/org/openstreetmap/josm/tools/ImageProvider.java
79 79 import org.xml.sax.XMLReader; 80 80 import org.xml.sax.helpers.DefaultHandler; 81 81 82 import com.kitfox.svg.SVGDiagram; 83 import com.kitfox.svg.SVGException; 84 import com.kitfox.svg.SVGUniverse; 82 import com.github.weisj.jsvg.SVGDocument; 83 import com.github.weisj.jsvg.geometry.size.FloatSize; 84 import com.github.weisj.jsvg.parser.DocumentLimits; 85 import com.github.weisj.jsvg.parser.LoaderContext; 86 import com.github.weisj.jsvg.parser.SVGLoader; 85 87 86 88 /** 87 89 * Helper class to support the application with images. … … 252 254 ARCHIVE 253 255 } 254 256 257 private static final SVGLoader svgloader = new SVGLoader(); 258 255 259 /** 256 260 * Property set on {@code BufferedImage} returned by {@link #makeImageTransparent}. 257 261 * @since 7132 … … 295 299 /** <code>true</code> if multi-resolution image is requested */ 296 300 protected boolean multiResolution = true; 297 301 298 private static SVGUniverse svgUniverse;299 300 302 /** 301 303 * The icon cache 302 304 */ … … 967 969 */ 968 970 private static ImageResource getIfAvailableHttp(String url, ImageType type) { 969 971 try (CachedFile cf = new CachedFile(url).setDestDir( 970 new File(Config.getDirs().getCacheDirectory(true), "images").getPath()) ;971 InputStream is = cf.getInputStream()) {972 new File(Config.getDirs().getCacheDirectory(true), "images").getPath())) { 973 URL localurl = Utils.fileToURL(cf.getFile()); 972 974 switch (type) { 973 975 case SVG: 974 SVGDiagram svg; 975 synchronized (getSvgUniverse()) { 976 URI uri = getSvgUniverse().loadSVG(is, Utils.fileToURL(cf.getFile()).toString()); 977 svg = getSvgUniverse().getDiagram(uri); 978 } 976 Logging.debug("Load SVG "+url); 977 SVGDocument svg = svgloader.load(localurl, getSVGContext()); 979 978 return svg == null ? null : new ImageResource(svg); 980 979 case OTHER: 981 980 BufferedImage img = null; 982 981 try { 983 img = read( Utils.fileToURL(cf.getFile()), false, false);982 img = read(localurl, false, false); 984 983 } catch (IOException | UnsatisfiedLinkError e) { 985 984 Logging.log(Logging.LEVEL_WARN, "Exception while reading HTTP image:", e); 986 985 } … … 1017 1016 } 1018 1017 String mediatype = m.group(1); 1019 1018 if ("image/svg+xml".equals(mediatype)) { 1020 String s = new String(bytes, StandardCharsets.UTF_8);1021 1019 // see #19097: check if s starts with PNG magic 1022 if ( s.length() > 4 && "PNG".equals(s.substring(1, 4))) {1020 if (bytes.length > 4 && bytes[1] == 'P' && bytes[2] == 'N' && bytes[3] == 'G') { 1023 1021 Logging.warn("url contains PNG file " + url); 1024 1022 return null; 1025 1023 } 1026 SVGDiagram svg; 1027 synchronized (getSvgUniverse()) { 1028 URI uri = getSvgUniverse().loadSVG(new StringReader(s), Utils.encodeUrl(s)); 1029 svg = getSvgUniverse().getDiagram(uri); 1030 } 1024 InputStream is = new ByteArrayInputStream(bytes); 1025 Logging.debug("Load SVG "+url); 1026 SVGDocument svg = svgloader.load(is, (URI) null, getSVGContext()); 1031 1027 if (svg == null) { 1032 Logging.warn("Unable to process svg: "+ s);1028 Logging.warn("Unable to process svg: "+bytes); 1033 1029 return null; 1034 1030 } 1035 1031 return new ImageResource(svg); … … 1112 1108 try (InputStream is = zipFile.getInputStream(entry)) { 1113 1109 switch (type) { 1114 1110 case SVG: 1115 SVGDiagram svg; 1116 synchronized (getSvgUniverse()) { 1117 URI uri = getSvgUniverse().loadSVG(is, entryName, true); 1118 svg = getSvgUniverse().getDiagram(uri); 1119 } 1111 Logging.debug("Load SVG "+archive+" "+entryName); 1112 SVGDocument svg = svgloader.load(is, (URI) null, getSVGContext()); 1120 1113 return svg == null ? null : new ImageResource(svg); 1121 1114 case OTHER: 1122 1115 while (size > 0) { … … 1151 1144 Objects.requireNonNull(type, "ImageType must not be null"); 1152 1145 switch (type) { 1153 1146 case SVG: 1154 SVGDiagram svg = null; 1155 synchronized (getSvgUniverse()) { 1147 SVGDocument svg = null; 1148 try { 1149 Logging.debug("Load SVG "+path); 1150 svg = svgloader.load(path, getSVGContext()); 1151 } catch (Exception e) { 1152 Logging.error("Cannot open {0}: {1}", path, e.getMessage()); 1153 Logging.trace(e); 1154 } 1155 1156 if (svg == null && "jar".equals(path.getProtocol())) { 1156 1157 try { 1157 URI uri = null; 1158 try { 1159 uri = getSvgUniverse().loadSVG(path); 1160 } catch (InvalidPathException e) { 1161 Logging.error("Cannot open {0}: {1}", path, e.getMessage()); 1162 Logging.trace(e); 1163 } 1164 if (uri == null && "jar".equals(path.getProtocol())) { 1165 URL betterPath = Utils.betterJarUrl(path); 1166 if (betterPath != null) { 1167 uri = getSvgUniverse().loadSVG(betterPath); 1158 URL betterPath = Utils.betterJarUrl(path); 1159 if (betterPath != null) { 1160 try { 1161 Logging.debug("Load SVG "+betterPath); 1162 svg = svgloader.load(betterPath, getSVGContext()); 1163 } catch (Exception e) { 1164 Logging.log(Logging.LEVEL_WARN, "Unable to read SVG from fallback jar URL", e); 1168 1165 } 1169 1166 } 1170 svg = getSvgUniverse().getDiagram(uri); 1171 } catch (SecurityException | IOException e) { 1167 } catch (IOException e) { 1172 1168 Logging.log(Logging.LEVEL_WARN, "Unable to read SVG", e); 1173 1169 } 1174 1170 } … … 1471 1467 * @param resizeMode how to size/resize the image 1472 1468 * @return an image from the given SVG data at the desired dimension. 1473 1469 */ 1474 static BufferedImage createImageFromSvg(SVGD iagramsvg, Dimension dim, ImageResizeMode resizeMode) {1470 static BufferedImage createImageFromSvg(SVGDocument svg, Dimension dim, ImageResizeMode resizeMode) { 1475 1471 if (Logging.isTraceEnabled()) { 1476 Logging.trace("createImageFromSvg: {0} {1}", svg.getXMLBase(), dim);1472 Logging.trace("createImageFromSvg: {0}", dim); 1477 1473 } 1478 final float sourceWidth = svg.getWidth(); 1479 final float sourceHeight = svg.getHeight(); 1474 FloatSize size = svg.size(); 1475 final float sourceWidth = size.width; 1476 final float sourceHeight = size.height; 1480 1477 if (sourceWidth <= 0 || sourceHeight <= 0) { 1481 Logging.error("createImageFromSvg: {0} {1} sourceWidth={2} sourceHeight={3}", svg.getXMLBase(), dim, sourceWidth, sourceHeight);1478 Logging.error("createImageFromSvg: {0} sourceWidth={1} sourceHeight={2}", dim, sourceWidth, sourceHeight); 1482 1479 return null; 1483 1480 } 1484 1481 return resizeMode.createBufferedImage(dim, new Dimension((int) sourceWidth, (int) sourceHeight), g -> { 1485 try { 1486 synchronized (getSvgUniverse()) { 1487 svg.render(g); 1488 } 1489 } catch (SVGException ex) { 1490 Logging.log(Logging.LEVEL_ERROR, "Unable to load svg:", ex); 1491 } 1482 svg.render(null, g); 1492 1483 }, null); 1493 1484 } 1494 1485 1495 private static synchronized SVGUniverse getSvgUniverse() {1496 if (svgUniverse == null) {1497 svgUniverse = new SVGUniverse();1498 // CVE-2017-5617: Allow only data scheme (see #14319)1499 svgUniverse.setImageDataInlineOnly(true);1500 }1501 return svgUniverse;1502 }1503 1504 1486 /** 1505 1487 * Returns a <code>BufferedImage</code> as the result of decoding 1506 1488 * a supplied <code>File</code> with an <code>ImageReader</code> … … 1954 1936 return new ImageIcon(new BufferedImage(size.getAdjustedWidth(), size.getAdjustedHeight(), BufferedImage.TYPE_INT_ARGB)); 1955 1937 } 1956 1938 1939 private static LoaderContext getSVGContext() { 1940 return LoaderContext.builder().documentLimits(new DocumentLimits(DocumentLimits.DEFAULT_MAX_NESTING_DEPTH, 1941 DocumentLimits.DEFAULT_MAX_USE_NESTING_DEPTH, DocumentLimits.DEFAULT_MAX_PATH_COUNT+3000)).build(); 1942 } 1943 1957 1944 @Override 1958 1945 public String toString() { 1959 1946 return ("ImageProvider [" -
src/org/openstreetmap/josm/tools/ImageResource.java
17 17 18 18 import org.openstreetmap.josm.tools.ImageProvider.ImageSizes; 19 19 20 import com. kitfox.svg.SVGDiagram;20 import com.github.weisj.jsvg.SVGDocument; 21 21 22 22 /** 23 23 * Holds data for one particular image. … … 36 36 /** 37 37 * SVG diagram information in case of SVG vector image. 38 38 */ 39 private SVGD iagramsvg;39 private SVGDocument svg; 40 40 /** 41 41 * Use this dimension to request original file dimension. 42 42 */ … … 67 67 * Constructs a new {@code ImageResource} from SVG data. 68 68 * @param svg SVG data 69 69 */ 70 public ImageResource(SVGD iagramsvg) {70 public ImageResource(SVGDocument svg) { 71 71 CheckParameterUtil.ensureParameterNotNull(svg); 72 72 this.svg = svg; 73 73 }
