Skip to content
This repository has been archived by the owner on Nov 9, 2020. It is now read-only.

Commit

Permalink
🐛 OOXML: Fix regression introduced in 271f1e6
Browse files Browse the repository at this point in the history
If a part exists without a linked relation, the deletePart method
throws an exception: `throw new IllegalArgumentException("partName");`

This is not the expected behaviour here: malformed files, or partly
sanitized files match this pattern.

Instead, we check if the relationship exists and is in the package.
  • Loading branch information
punkeel committed Apr 19, 2017
1 parent dea64ff commit 1df88a9
Showing 1 changed file with 18 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -176,11 +176,28 @@ void sanitize(IBleachSession session, OPCPackage pkg, PackagePart part) throws I
ContentType type = part.getContentTypeDetails();
if (isForbiddenType(type) || isStrangeContentType(type)) {
LOGGER.debug(SUSPICIOUS_OOXML_FORMAT, contentType, part.getPartName(), part.getSize());
pkg.deletePart(part.getPartName());
deletePart(pkg, part.getPartName());
session.recordThreat("Dynamic content", SEVERITY.HIGH);
}
}

/**
* Delete the part with the specified name and its associated relationships part if one exists.
* <p>
* Unlike {@link OPCPackage#deletePart(PackagePartName)}, this checks if the relationship exists
* before trying to remove it, instead of throwing an exception.
*
* @param partName Name of the part to delete
*/
private void deletePart(OPCPackage pkg, PackagePartName partName) {
pkg.removePart(partName);

PackagePartName relationshipPartName = PackagingURIHelper.getRelationshipPartName(partName);
if (relationshipPartName != null && pkg.containPart(relationshipPartName)) {
pkg.removePart(relationshipPartName);
}
}

boolean isForbiddenType(ContentType type) {
String full_type = type.toString(false);

Expand Down

0 comments on commit 1df88a9

Please sign in to comment.