[ofbiz-framework] branch trunk updated: Improved: Reflected XSS in content component (OFBIZ-11840)

[jl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 6e5a614  Improved: Reflected XSS in content component (OFBIZ-11840)
6e5a614 is described below

commit 6e5a614b692f00a7f98cd208cbf0a7e4e136fefb
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Sat Jul 18 12:00:29 2020 +0200

    Improved: Reflected XSS in content component (OFBIZ-11840)
    
    Fixes a Reflected XSS vulnerability in content component
    
    Harshit Shukla reported it to the OFBiz security team:
    https://demo-stable.ofbiz.apache.org/content/control/stream?contentId="><svg/onload=alert(0)>
    
    It's a post-auth vulnerability so we did not ask for a CVE.
    
    Thanks: Harshit Shukla harshit.shukz@gmail.com
---
 .../src/main/java/org/apache/ofbiz/content/data/DataEvents.java    | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataEvents.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataEvents.java
index 8278b02..9d6b80c 100644
--- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataEvents.java
+++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataEvents.java
@@ -82,6 +82,13 @@ public class DataEvents {
         // get the permission service required for streaming data; default is always the genericContentPermission
         String permissionService = EntityUtilProperties.getPropertyValue("content", "stream.permission.service", "genericContentPermission", delegator);
 
+        // This is counterintuitive but it works, for OFBIZ-11840
+        // It could be improved by checking for possible events associated with svg
+        // As listed at https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
+        if (contentId.contains("<svg")) {
+            return "success";
+        }
+
         // get the content record
         GenericValue content;
         try {