You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@ofbiz.apache.org by "Jacques Le Roux (Jira)" <ji...@apache.org> on 2023/04/08 08:45:00 UTC

[jira] [Created] (OFBIZ-12794) Disallow string concatenation in uploaded files

Jacques Le Roux created OFBIZ-12794:
---------------------------------------

             Summary: Disallow string concatenation in uploaded files
                 Key: OFBIZ-12794
                 URL: https://issues.apache.org/jira/browse/OFBIZ-12794
             Project: OFBiz
          Issue Type: Bug
          Components: framework/security
    Affects Versions: 22.01.01
            Reporter: Jacques Le Roux
            Assignee: Jacques Le Roux
             Fix For: 22.01.01


An external security reporter brought to our attention that a signed up user could upload a webshell using string concatenation. Of course there is no reason for a signed up user to upload a webshell. And anyway we don't create CVEs for signed up users trying our security.

Nevertheless we have decided to fix this possibility while allowing to bypass it using a new security property. The later can be usefull when a file must contain a string concatenation, images files, seen as encoded texts, come to mind.





--
This message was sent by Atlassian Jira
(v8.20.10#820010)