(ofbiz-framework) branch release24.09 updated: Improved: Extend URL_RESOURCE validation to writeDataResourceText, completing the work of af8ee514a2

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new ba67970edd Improved: Extend URL_RESOURCE validation to writeDataResourceText, completing the work of af8ee514a2
ba67970edd is described below

commit ba67970edd107c9854a9e8c345190b13bd0c237f
Author: Krishnauprit18 <kr...@gmail.com>
AuthorDate: Thu Mar 26 14:24:20 2026 +0530

    Improved: Extend URL_RESOURCE validation to writeDataResourceText, completing the work of af8ee514a2
    
    (cherry picked from commit 87adcf47c9d7a5c7b344f0ff135a01d2a1da1931)
---
 .../src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
index cc105dd30e..6eb632362b 100644
--- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
+++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
@@ -1152,6 +1152,7 @@ public class DataResourceWorker implements org.apache.ofbiz.widget.content.DataR
             URL url = FlexibleLocation.resolveLocation(dataResource.getString("objectInfo"));
 
             if (url.getHost() != null) { // is absolute
+                checkUrlResourceAllowed(url);
                 int c;
                 try (InputStream in = url.openStream(); StringWriter sw = new StringWriter()) {
                     while ((c = in.read()) != -1) {