You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2025/01/14 16:21:05 UTC
(ofbiz-framework) branch trunk updated: Improved: Path traversal leading to RCE (OFBIZ-13092)
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 5f8bb71aae Improved: Path traversal leading to RCE (OFBIZ-13092)
5f8bb71aae is described below
commit 5f8bb71aae9b65f031478784374bab4326e57f1f
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Tue Jan 14 17:17:49 2025 +0100
Improved: Path traversal leading to RCE (OFBIZ-13092)
No functional changes, just better formatting and renaming
I did that after last commit, while reviewing all was OK in trunk and 24.09.
I'll backport to 24.09 in order to ease future backporting
---
.../main/java/org/apache/ofbiz/webapp/control/ControlFilter.java | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
index ca8d2cca69..a8e3301ed7 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
@@ -174,20 +174,19 @@ public class ControlFilter extends HttpFilter {
queryString = URLDecoder.decode(queryString, "UTF-8");
if (UtilValidate.isUrlInString(queryString)
|| !SecuredUpload.isValidText(queryString.toLowerCase(), SecuredUpload.getallowedTokens(), true)
- && isSolrTest()) {
+ && isSolrTest()) {
Debug.logError("For security reason this URL is not accepted", MODULE);
throw new RuntimeException("For security reason this URL is not accepted");
}
}
- String initialURI = req.getRequestURI();
- if (initialURI != null) { // Allow tests with Mockito. ControlFilterTests send null
+ if (uriWithContext != null) { // Allow tests with Mockito. ControlFilterTests send null
try {
- String uRIFiltered = new URI(initialURI)
+ String uRIFiltered = new URI(uriWithContext)
.normalize().toString()
.replaceAll(";", "")
.replaceAll("(?i)%2e", "");
- if (!initialURI.equals(uRIFiltered)) {
+ if (!uriWithContext.equals(uRIFiltered)) {
Debug.logError("For security reason this URL is not accepted", MODULE);
throw new RuntimeException("For security reason this URL is not accepted");
}