Reject path traversal filenames during HMEF attachment extraction

[jmestwa-coder]

Summary

Reject attachment filenames that would escape the selected extraction directory during HMEF/TNEF attachment extraction.

Previously, attachment filenames from TNEF metadata were written directly using:

new File(dir, filename)

This allowed traversal-style filenames such as ../escaped.txt to resolve outside the intended extraction directory.

Changes

• normalize and validate resolved attachment output paths before writing files
• reject attachment filenames that resolve outside the chosen extraction directory
• add regression coverage for traversal-style attachment names

Test

Added a regression test that:

• creates an in-memory malicious TNEF attachment using a traversal filename
• verifies extraction throws IOException
• verifies no file is created outside the extraction directory

[pjfanning]

Can you have a look at

poi/poi/src/main/java/org/apache/poi/util/IOUtils.java

Line 622 in 145ca46

* There is a check to prevent path traversal attacks. Only path traversal

and adjust that to have a shared method to do this check? Code reuse is important.

[jmestwa-coder]

Thanks for the suggestion. Updated the patch to reuse IOUtils.newFile(...) for the extraction path validation.

[pjfanning]

lgtm