You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by ja...@apache.org on 2026/04/08 11:02:34 UTC
(ofbiz-framework) 03/06: Fixed: Integrate SecurityUtil to validate file paths in CommonEvents for enhanced security
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 93b08e85d3e156de86893b619132a1fa8891430e
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Wed Apr 8 11:01:52 2026 +0200
Fixed: Integrate SecurityUtil to validate file paths in CommonEvents for enhanced security
---
.../common/src/main/java/org/apache/ofbiz/common/CommonEvents.java | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/framework/common/src/main/java/org/apache/ofbiz/common/CommonEvents.java b/framework/common/src/main/java/org/apache/ofbiz/common/CommonEvents.java
index f8e8dead55..7c52297caa 100644
--- a/framework/common/src/main/java/org/apache/ofbiz/common/CommonEvents.java
+++ b/framework/common/src/main/java/org/apache/ofbiz/common/CommonEvents.java
@@ -46,6 +46,7 @@ import org.apache.commons.lang.StringUtils;
import org.apache.ofbiz.base.lang.JSON;
import org.apache.ofbiz.base.location.FlexibleLocation;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.GeneralException;
import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.UtilProperties;
@@ -57,6 +58,7 @@ import org.apache.ofbiz.entity.GenericValue;
import org.apache.ofbiz.entity.util.EntityUtilProperties;
import org.apache.ofbiz.webapp.control.JWTManager;
import org.apache.ofbiz.webapp.control.LoginWorker;
+import org.apache.ofbiz.security.SecurityUtil;
import org.apache.ofbiz.widget.model.ModelWidget;
import org.apache.ofbiz.widget.model.ScriptLinkHelper;
import org.apache.ofbiz.widget.model.ThemeFactory;
@@ -414,6 +416,7 @@ public class CommonEvents {
if (!platformSpecificPath.contains(File.separator) && "\\".equals(File.separator)) {
platformSpecificPath = platformSpecificPath.replace("/", "\\");
}
+ SecurityUtil.checkOfbizFileAllowList(new File(platformSpecificPath));
// get line number
int lineNumber = 1;
if (UtilValidate.isNotEmpty(fragment)) {
@@ -446,7 +449,7 @@ public class CommonEvents {
Debug.logInfo(line, MODULE);
}
return "success";
- } catch (IOException e) {
+ } catch (GeneralException | IOException e) {
Debug.logError(e, MODULE);
}
}