[PR] Fixed: unrestricted file destination in DataServices createFile/updateFile [ofbiz-framework]

["ashishvijaywargiya (via GitHub)" <gi...@apache.org>]

ashishvijaywargiya opened a new pull request, #1747:
URL: https://github.com/apache/ofbiz-framework/pull/1747

   createFileMethod and updateFileMethod build a target File from the caller-supplied objectInfo for LOCAL_FILE and OFBIZ_FILE resource types and write to it directly. Unlike the CONTEXT_FILE branch in the same methods, and unlike the read path in DataResourceWorker for the same resource types, neither branch confirmed the resolved path stayed within the directories configured in security.properties, so a target outside those directories was accepted and written.
   
   Added the same SecurityUtil.checkLocalFileAllowList/ checkOfbizFileAllowList calls the read path already makes, in both methods, matching the existing CONTEXT_FILE handling. Added regression tests that fail against the original code and pass against the fix.
   
   Thank you Krishna Uprit for your help.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fixed: unrestricted file destination in DataServices createFile/updateFile [ofbiz-framework]

["ashishvijaywargiya (via GitHub)" <gi...@apache.org>]

ashishvijaywargiya merged PR #1747:
URL: https://github.com/apache/ofbiz-framework/pull/1747


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org