By default, Aspose.Words for Java can load remote resources such as images, CSS styles, or external HTML documents when importing documents or inserting images using the DocumentBuilder. This behavior allows you to process your documents in full detail but can be a reason of some security risks if the library is a part of a web application.<\/p>\n
In this article, we take a look at common security issues that can arise when loading external resources and provide recommendations on how to avoid such problems.<\/p>\n\n\n
There are a number of typical security problems when loading external resources.<\/p>\n
On Windows-based hosts, documents containing references to resources that use UNC paths such as \u2018\\example.com\\a\\b<\/em>\u2019 will be processed by default. In a domain environment, this will cause the host to send its domain credentials in a hashed format to the specified server.<\/p>\n If an attacker is able to convince a user or server to process a document with such a resource link pointing to a host they control, the attacker will receive the user or service account credentials in NTLM hash format. Such data then can be reused in a classic pass-the-hash attack, allowing the attacker to gain access to any resource as the victim user or service account.<\/p>\n If the account in question uses a weak or guessable password, the attacker could additionally perform a password cracking attack to recover the account password for further malicious use.<\/p>\n Similar to the previous case, processing a document with a reference to a local image file will result in that file being included in the final document. This can lead to sensitive information disclosure.<\/p>\n An attacker could upload a document that either referenced or included extremely large images \u2013 the so-called “decompression bombs”. When processing these images, the library will consume huge amounts of memory and CPU time.<\/p>\n An attacker could create a series of documents containing embedded links to common combinations of internal IP address and port, then submit them to a web service using the Aspose.Words library to process the documents.<\/p>\n Based on the length of time the service uses to process the document, the attacker could determine if a given IP\/Port combination is filtered by a firewall:<\/p>\n To solve the problems described above and to improve the security of web applications, you can control or disable loading of external resources using IResourceLoadingCallback<\/a>.<\/p>\n The following code example shows how to disable external images loading:<\/p>\n Java<\/strong>\n The following code example shows how to disable remote resources:<\/p>\n Java<\/strong>\nLocal Image Disclosure Via Linked Images<\/h3>\n
Denial of Service<\/h3>\n
Server-Side Request Forgery Via Linked Content<\/h3>\n
\n
Solutions of Security Issues<\/h2>\n
public<\/span> void<\/span> loadDocument<\/span>(<\/span>String<\/span> documentFilename<\/span>)<\/span> throws<\/span> Exception<\/span>\n{<\/span>\n\tLoadOptions<\/span> disableExternalImagesOptions<\/span> =<\/span> new<\/span> LoadOptions<\/span>();<\/span>\n\tdisableExternalImagesOptions<\/span>.<\/span>setResourceLoadingCallback<\/span>(<\/span>new<\/span> DisableExternalImagesHandler<\/span>());<\/span>\n\n\tDocument<\/span> doc<\/span> =<\/span> new<\/span> Document<\/span>(<\/span>documentFilename<\/span>,<\/span> disableExternalImagesOptions<\/span>);<\/span>\n}<\/span>\n\npublic<\/span> static<\/span> class<\/span> DisableExternalImagesHandler<\/span> implements<\/span> IResourceLoadingCallback<\/span>\n{<\/span>\n\tpublic<\/span> \/*ResourceLoadingAction*\/<\/span>int<\/span> resourceLoading<\/span>(<\/span>ResourceLoadingArgs<\/span> args<\/span>)<\/span>\n\t{<\/span>\n\t\t\/\/ Skip external images loading.\n<\/span><\/span>\t\treturn<\/span> (<\/span>args<\/span>.<\/span>getResourceType<\/span>()<\/span> ==<\/span> ResourceType<\/span>.<\/span>IMAGE<\/span>)<\/span>\n\t\t\t?<\/span> ResourceLoadingAction<\/span>.<\/span>SKIP<\/span>\n\t\t\t:<\/span> ResourceLoadingAction<\/span>.<\/span>DEFAULT<\/span>;<\/span>\n\t}<\/span>\n}<\/span>\n<\/code><\/pre><\/div><\/p>\npublic<\/span> void<\/span> loadDocument2<\/span>(<\/span>String<\/span> documentFilename<\/span>)<\/span> throws<\/span> Exception<\/span>\n{<\/span>\n\tLoadOptions<\/span> disableRemoteResourcesOptions<\/span> =<\/span> new<\/span> LoadOptions<\/span>();<\/span>\n\tdisableRemoteResourcesOptions<\/span>.<\/span>setResourceLoadingCallback<\/span>(<\/span>new<\/span> DisableRemoteResourcesHandler<\/span>());<\/span>\n\t\n\tDocument<\/span> doc<\/span> =<\/span> new<\/span> Document<\/span>(<\/span>documentFilename<\/span>,<\/span> disableRemoteResourcesOptions<\/span>);<\/span>\n}<\/span>\t\n\nprivate<\/span> static<\/span> class<\/span> DisableRemoteResourcesHandler<\/span> implements<\/span> IResourceLoadingCallback<\/span>\n{<\/span>\n\tpublic<\/span> \/*ResourceLoadingAction*\/<\/span>int<\/span> resourceLoading<\/span>(<\/span>ResourceLoadingArgs<\/span> args<\/span>)<\/span> throws<\/span> Exception<\/span>\n\t{<\/span>\n\t\treturn<\/span> isLocalResource<\/span>(<\/span>args<\/span>.<\/span>getOriginalUri<\/span>())<\/span>\n\t\t\t?<\/span> ResourceLoadingAction<\/span>.<\/span>DEFAULT<\/span>\n\t\t\t:<\/span> ResourceLoadingAction<\/span>.<\/span>SKIP<\/span>;<\/span>\n\t}<\/span>\n\n\t\/\/ Simplified code.\n<\/span><\/span>\tprivate<\/span> static<\/span> boolean<\/span> isLocalResource<\/span>(<\/span>String<\/span> fileName<\/span>)<\/span> throws<\/span> Exception<\/span>\n\t{<\/span>\n\t\tString<\/span> protocol<\/span> =<\/span> null<\/span>;<\/span>\n\t\n\t\tURI<\/span> uri<\/span> =<\/span> new<\/span> URI<\/span>(<\/span>fileName<\/span>);<\/span>\n\t\tif<\/span> (<\/span>uri<\/span>.<\/span>isAbsolute<\/span>())<\/span>\n\t\t{<\/span>\n\t\t\tprotocol<\/span> =<\/span> uri<\/span>.<\/span>getScheme<\/span>();<\/span>\n\t\t}<\/span>\n\t\telse<\/span>\n\t\t{<\/span>\n\t\t\tURL<\/span> url<\/span> =<\/span> new<\/span> URL<\/span>(<\/span>fileName<\/span>);<\/span>\n\t\t\tprotocol<\/span> =<\/span> url<\/span>.<\/span>getProtocol<\/span>();<\/span>\n\t\t}<\/span>\n\t\n\t\treturn<\/span> "file"<\/span>.<\/span>equalsIgnoreCase<\/span>(<\/span>protocol<\/span>);<\/span>\n\t}<\/span>\n}<\/span>\n<\/code><\/pre><\/div><\/p>\n\n\n