fix(link): harden UCanAccess's linked-database resolution

UCanAccess registers a custom LinkResolver in DBReference that opens
any linked table path verbatim, bypassing jackcess's own DEFAULT
resolver hardening for GHSA-qp68-cg9v-qh8p entirely. Since linked
paths are read from the (possibly untrusted) Access database file
being opened, this let a malicious database force the JVM to reach an
arbitrary UNC/network path as soon as a linked table was touched.

Deny automatic resolution of network/UNC linked paths by default,
with an explicit opt-in via the new allowRemoteLinks connection
property for applications that trust their linked network paths. An
explicit reMap entry for a link is treated as trusted application
configuration and bypasses the guard without probing the raw path.
Local linked paths are unaffected.

Author: spannm

README.md

@@ -113,6 +113,23 @@ try (Connection conn = DriverManager.getConnection(url)) {
 
 <p style="height: 20px;">&nbsp;</p>
 
+## 🔗 Linked Tables & Untrusted Databases
+
+If the `.accdb`/`.mdb` file you open contains linked tables, UCanAccess automatically opens the linked database files
+so those tables can be read. Local linked paths are resolved as before, but a linked table pointing to a
+**network/UNC path** (e.g. `\\server\share\linked.accdb`) is rejected by default with an `AccessDeniedException` —
+such a path is taken verbatim from the database file, so a database from an untrusted source could otherwise make
+your JVM reach out to an arbitrary host as soon as the linked table is touched.
+
+If you trust the linked network paths in a given database, opt back in explicitly via the `allowRemoteLinks`
+connection property:
+
+```java
+String url = "jdbc:ucanaccess://C:/path/to/your/database.accdb;allowRemoteLinks=true";
+```
+
+<p style="height: 20px;">&nbsp;</p>
+
 ## ❤️ Why this Fork?
 
 The original project (developed by Marco Amadei and Gord Thompson) was the gold standard for Access connectivity but went quiet in 2020, leaving `net.sf.ucanaccess:ucanaccess` unmaintained at version 5.0.1.

src/main/java/net/ucanaccess/converters/Metadata.java

@@ -42,6 +42,18 @@ public enum Property {
         user(String.class, null, 500),
         password(String.class, null, 500),
 
+        /**
+         * Whether linked tables that point to a network/UNC path (e.g. {@code \\server\share\db.accdb}) may be
+         * resolved automatically.
+         * <p>
+         * <strong>Security note:</strong> the path of a linked table is taken verbatim from the Access database
+         * file being opened. If that file is not fully trusted, an attacker-controlled link could otherwise make
+         * the JVM open an arbitrary network/UNC path as soon as the linked table is accessed (e.g. to reach an
+         * internal host or trigger an outbound credential-relay attempt). Automatic resolution of such paths is
+         * therefore denied by default; enable this property only when linked network paths are known to be
+         * trusted. Local (non-UNC) linked paths are not affected by this property.
+         */
+        allowRemoteLinks(Boolean.class, false, 10),
         columnOrder(ColumnOrder.class, ColumnOrder.DATA, 10),
         concatNulls(Boolean.class, false, 10),
         encrypt(Boolean.class, false, 10),

src/main/java/net/ucanaccess/jdbc/DBReference.java

@@ -8,6 +8,7 @@
 import io.github.spannm.jackcess.Table;
 import io.github.spannm.jackcess.Table.ColumnOrder;
 import net.ucanaccess.converters.LoadJet;
+import net.ucanaccess.converters.Metadata;
 import net.ucanaccess.exception.UcanaccessSQLException;
 
 import java.io.File;
@@ -17,6 +18,7 @@
 import java.lang.System.Logger.Level;
 import java.nio.channels.FileLock;
 import java.nio.charset.Charset;
+import java.nio.file.AccessDeniedException;
 import java.sql.Connection;
 import java.sql.DriverManager;
 import java.sql.ResultSet;
@@ -79,6 +81,12 @@ public class DBReference {
     private boolean                                 concatNulls;
     private boolean                                 mirrorRecreated;
     private Charset                                 charset;
+    /**
+     * Whether the {@link io.github.spannm.jackcess.util.LinkResolver} registered below may automatically resolve
+     * linked tables that point to a network/UNC path. {@code false} by default; see
+     * {@link net.ucanaccess.converters.Metadata.Property#allowRemoteLinks}.
+     */
+    private boolean                                 allowRemoteLinks;
 
     public DBReference(File fl, FileFormat ff, IJackcessOpenerInterface _jko, final String _pwd, Charset _charset)
         throws IOException {
@@ -102,10 +110,25 @@ public DBReference(File fl, FileFormat ff, IJackcessOpenerInterface _jko, final
                 if (linkeeFileName == null) {
                     throw new IOException("Cannot resolve db link");
                 }
-                File linkeeFile = new File(linkeeFileName);
                 Map<String, String> emr = externalResourcesMapping;
-                if (!linkeeFile.exists() && emr != null && emr.containsKey(linkeeFileName.toLowerCase())) {
-                    linkeeFile = new File(emr.get(linkeeFileName.toLowerCase()));
+                String remapped = emr == null ? null : emr.get(linkeeFileName.toLowerCase());
+                // an explicit remapping via the "reMap" connection property is trusted application configuration
+                // and therefore bypasses the network-path guard below; the raw (untrusted) path stored in the
+                // database file itself is not probed or opened in that case
+                if (remapped == null && !allowRemoteLinks && isNetworkPath(linkeeFileName)) {
+                    throw new AccessDeniedException(linkeeFileName, null,
+                        "Linked database points to a network/UNC path; automatic resolution of such paths is "
+                            + "disabled by default because the linked path is taken verbatim from the (possibly "
+                            + "untrusted) Access database file. Set the '" + Metadata.Property.allowRemoteLinks
+                            + "' connection property to true only if linked network paths are trusted.");
+                }
+                // for a network path with an explicit remapping, use the remapped (trusted) path directly without
+                // probing the raw network path first
+                File linkeeFile = remapped != null && isNetworkPath(linkeeFileName)
+                    ? new File(remapped)
+                    : new File(linkeeFileName);
+                if (!linkeeFile.exists() && remapped != null) {
+                    linkeeFile = new File(remapped);
                 }
                 if (!linkeeFile.exists()) {
                     logger.log(Level.WARNING, "External file {0} does not exist", linkeeFile.getAbsolutePath());
@@ -121,6 +144,21 @@ public DBReference(File fl, FileFormat ff, IJackcessOpenerInterface _jko, final
         }
     }
 
+    /**
+     * Determines whether the given linked database path is a network/UNC path, e.g. {@code \\server\share\db.accdb},
+     * {@code //server/share/db.accdb} or a device-style UNC path such as {@code \\?\UNC\server\share\db.accdb}.
+     * <p>
+     * Such paths are excluded from automatic resolution by default since they let an untrusted Access database
+     * file trigger an outbound network connection (see {@link #allowRemoteLinks}).
+     *
+     * @param  _fileName the linked database path as stored in the Access database file
+     * @return           {@code true} if the path is a network/UNC path, {@code false} otherwise
+     */
+    static boolean isNetworkPath(String _fileName) {
+        String normalized = _fileName.replace('/', '\\');
+        return normalized.startsWith("\\\\");
+    }
+
     public Database open(File _dbfl, String _pwd) throws IOException {
         Database ret = jko.open(_dbfl, _pwd, charset);
         if (columnOrderDisplay) {
@@ -572,6 +610,18 @@ public void setExternalResourcesMapping(Map<String, String> _externalResourcesMa
         externalResourcesMapping = _externalResourcesMapping;
     }
 
+    /**
+     * Enables or disables automatic resolution of linked tables that point to a network/UNC path.
+     * <p>
+     * Disabled by default; see the security note on {@link net.ucanaccess.converters.Metadata.Property#allowRemoteLinks}
+     * for why this matters when opening database files from an untrusted source.
+     *
+     * @param _allowRemoteLinks {@code true} to allow automatic resolution of network/UNC linked paths
+     */
+    public void setAllowRemoteLinks(boolean _allowRemoteLinks) {
+        allowRemoteLinks = _allowRemoteLinks;
+    }
+
     public File getToKeepHsql() {
         return toKeepHsql;
     }

src/main/java/net/ucanaccess/jdbc/UcanaccessDriver.java

@@ -149,6 +149,9 @@ public Connection connect(String _url, Properties _props) throws SQLException {
                     if (props.containsKey(preventReloading)) {
                         dbRef.setPreventReloading(Boolean.parseBoolean(props.get(preventReloading)));
                     }
+                    if (props.containsKey(allowRemoteLinks)) {
+                        dbRef.setAllowRemoteLinks(Boolean.parseBoolean(props.get(allowRemoteLinks)));
+                    }
                     if (props.containsKey(reMap)) {
                         Map<String, String> map = Arrays.stream(props.get(reMap).split("&")).map(s -> s.split("\\|")).filter(arr -> arr.length == 2)
                             .collect(Collectors.toMap(k1 -> k1[0], v1 -> v1[1], (v1, v2) -> v1, LinkedHashMap::new));

src/test/java/net/ucanaccess/jdbc/DBReferenceTest.java

@@ -0,0 +1,35 @@
+package net.ucanaccess.jdbc;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+class DBReferenceTest {
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+        "\\\\server\\share\\linked.accdb",
+        "//server/share/linked.accdb",
+        "\\\\?\\UNC\\server\\share\\linked.accdb",
+        "\\\\.\\linked.accdb",
+        "\\/server/share/linked.accdb"
+    })
+    void testIsNetworkPathDetectsUncAndNetworkPaths(String _linkedDbName) {
+        assertTrue(DBReference.isNetworkPath(_linkedDbName));
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+        "linked.accdb",
+        "../outside.accdb",
+        "..\\outside.accdb",
+        "c:\\db\\linked.accdb",
+        "/home/user/db/linked.accdb"
+    })
+    void testIsNetworkPathAllowsLocalPaths(String _linkedDbName) {
+        assertFalse(DBReference.isNetworkPath(_linkedDbName));
+    }
+
+}