[jira] [Updated] (OFBIZ-13632) Return the validated canonical file from SecurityUtil.checkOfbizFileAllowList and use it for the file access

["Mridul Pathak (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-13632?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mridul Pathak updated OFBIZ-13632:
----------------------------------
    Summary: Return the validated canonical file from SecurityUtil.checkOfbizFileAllowList and use it for the file access  (was: Return the validated canonical file from SecurityUtil.checkOfbizFileAllowList and enforce the ofbiz.home containment for an empty allow-list)

> Return the validated canonical file from SecurityUtil.checkOfbizFileAllowList and use it for the file access
> ------------------------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13632
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13632
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework/security
>    Affects Versions: Upcoming Branch, 24.09.07
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Minor
>
> {{SecurityUtil.checkOfbizFileAllowList}} and {{DataResourceWorker.checkContextFileBoundary}} validate a file path and then return nothing, so callers go on to open the original path instead of the file that was validated. In {{DataResourceWorker}}, some branches also call {{exists()}} before the check. Related to open CodeQL alerts.
> h3. Proposal
> * Make both helpers return the validated canonical file, and use it for the file access in {{CoreEvents.streamFile}}, {{CommonEvents.openSourceFile}} and {{DataResourceWorker}}.
> * Remove an unreachable branch for an empty allow-list from {{checkOfbizFileAllowList}}: an empty or missing setting already means the default list, because {{UtilProperties.getPropertyValue}} returns the default for an empty value.
> * Correct the comment in {{security.properties}}, which says an empty value allows any path within ofbiz.home.
> * In {{DataResourceWorker}}, check the file before calling {{exists()}}.
> No behavior change is intended for valid paths.
> h3. Release branch
> release24.09 has the same helpers, callers and comment. A backport is planned.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)