Skip to content

Commit

Permalink
pdf2ruby: fix potential code injection in name objects
Browse files Browse the repository at this point in the history
  • Loading branch information
Guillaume Delugré committed Oct 1, 2017
1 parent b105e24 commit 1ef83a8
Showing 1 changed file with 6 additions and 17 deletions.
23 changes: 6 additions & 17 deletions bin/pdf2ruby
Original file line number Diff line number Diff line change
Expand Up @@ -96,10 +96,8 @@ def objectToRuby(obj, inclevel = 0, internalname = nil, do_convert = false)
case obj
when Origami::Null
"Null.new"
when Origami::Boolean, Origami::Number
obj.value.to_s
when Origami::String
obj.inspect
when Origami::Boolean, Origami::Number, Origami::Name, Origami::String
literalToRuby(obj)
when Origami::Dictionary
customclass = nil
if obj.class != Origami::Dictionary
Expand All @@ -111,8 +109,6 @@ def objectToRuby(obj, inclevel = 0, internalname = nil, do_convert = false)
arrayToRuby(obj, inclevel, internalname)
when Origami::Stream
streamToRuby(obj, internalname) unless obj.is_a?(ObjectStream) or obj.is_a?(XRefStream)
when Origami::Name
nameToRuby(obj)
when Origami::Reference
referenceToRuby(obj, internalname)
else
Expand Down Expand Up @@ -144,15 +140,8 @@ def referenceToRuby(ref, internalname)
end
end

def nameToRuby(name)
code = ':'
valid = (name.value.to_s =~ /[+.:-]/).nil?

code << '"' unless valid
code << name.value.to_s
code << '"' unless valid

code
def literalToRuby(obj)
obj.value.inspect
end

def arrayToRuby(arr, inclevel, internalname)
Expand Down Expand Up @@ -180,7 +169,7 @@ def dictionaryToRuby(dict, inclevel, internalname, customtype = nil)
else
code << "{\n"
dict.each_pair do |key, val|
rubyname = nameToRuby(key)
rubyname = literalToRuby(key)
subintname = "#{internalname}[#{rubyname}]"

if val.is_a?(Origami::Reference) and @var_hash[val] and @var_hash[val][0,3] == "obj"
Expand Down Expand Up @@ -212,7 +201,7 @@ def dictionaryToHashMap(dict, inclevel, internalname)
i = 0
code = "\n"
dict.each_pair do |key, val|
rubyname = nameToRuby(key)
rubyname = literalToRuby(key)
subintname = "#{internalname}[#{rubyname}]"

if val.is_a?(Origami::Reference) and @var_hash[val] and @var_hash[val][0,3] == "obj"
Expand Down

0 comments on commit 1ef83a8

Please sign in to comment.