Security Findings from Veracode

[schristiansen-hqy]

The company that I am working for is using this library (and it works great, thanks!). The company uses Veracode to scan our app for security issues, and the veracode scan drills down into each of the libraries used. The following issues were discovered for this Pdf-Viewer library:

1. PdfRendererCore.kt: 50 (Medium)
   Attack Vector: java.nio.file.Paths.get
   Number of Modules Affected: 1
   Description: This call to java.nio.file.Paths.get() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to get() contains tainted data from the variable filePath. The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
2. PdfRendererCore.kt: 65 (Medium)
   Attack Vector: java.io.File.!operator_javanewinit
   Number of Modules Affected: 1
   Description: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to !operator_javanewinit() contains tainted data from the variable this.sanitizeFilePath(). The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
3. PdfRendererCore.kt: 86 (Medium)
   Attack Vector: java.io.File.!operator_javanewinit
   Number of Modules Affected: 1
   Description: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The second argument to !operator_javanewinit() contains tainted data from the variable valueOf(). The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
4. PdfDownloader.kt: 99 (Medium)
   Attack Vector: java.io.File.!operator_javanewinit
   Number of Modules Affected: 1
   Description: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The second argument to !operator_javanewinit() contains tainted data from the variable $cachedFileName. The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
5. CacheManager.kt: 44 (Medium)
   Attack Vector: java.io.File.!operator_javanewinit
   Number of Modules Affected: 1
   Description: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The second argument to !operator_javanewinit() contains tainted data from the variable valueOf(). The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
6. CacheManager.kt: 51 (Medium)
   Attack Vector: java.io.File.!operator_javanewinit
   Number of Modules Affected: 1
   Description: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The second argument to !operator_javanewinit() contains tainted data from the variable valueOf(). The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
7. PdfViewerActivity.kt: 479 (Medium)
   Attack Vector: java.io.File.!operator_javanewinit
   Number of Modules Affected: 1
   Description: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to !operator_javanewinit() contains tainted data from the variable filePath. The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
8. PdfViewerActivity.kt: 491 (Medium)
   Attack Vector: java.io.File.!operator_javanewinit
   Number of Modules Affected: 1
   Description: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to !operator_javanewinit() contains tainted data from the variable filePath. The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.
9. PdfRendererView.kt: 95 (Medium)
   Attack Vector: java.io.File.!operator_javanewinit
   Number of Modules Affected: 1
   Description: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to !operator_javanewinit() contains tainted data from the variable absolutePath. The tainted data originated from an earlier call to AndroidVirtualController.vc_taintobj.
   Remediation: Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.

Since these are all medium severity and they pose low risk in our use cases, we are confident in continuing to use this library. We do want to inform the library owner of the risks, so that they can be addressed.

[github-actions]

Thank you for creating your first issue. We appreciate your help in making this project better. We will look into it, and get back to you soon. Need help or want to discuss this issue? Join our Discord community here to ask questions and discuss this issue live!