[jira] [Commented] (OFBIZ-12594) Prevent Freemarker interpolation in fields

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-12594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104816#comment-18104816 ] 

ASF subversion and git services commented on OFBIZ-12594:
---------------------------------------------------------

Commit a7c6cc258404340cd3cfef22bbe67acfea7bbcaa in ofbiz-framework's branch refs/heads/trunk from Mridul Pathak
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=a7c6cc2584 ]

Fixed: ControlFilter's FreeMarker-interpolation guard was unreachable due to fail-open security check (OFBIZ-13492) (#1641)

LoginWorker.hasBasePermission() returned true whenever the request-scoped "security" attribute was unresolved, which was effectively always the case since ControlFilter runs before ContextFilter (the attribute's source) in nearly every webapp's filter-mapping order. This made the SSTI/Freemarker-interpolation guard added for OFBIZ-12594/OFBIZ-12602 unreachable across the framework, for any request. hasBasePermission() now falls back to the Security instance cached on the ServletContext when the request attribute is null, since ContextFilter only ever copies that same object into the request scope each call.

> Prevent Freemarker interpolation in fields
> ------------------------------------------
>
>                 Key: OFBIZ-12594
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-12594
>             Project: OFBiz
>          Issue Type: Sub-task
>          Components: ALL APPLICATIONS, ALL PLUGINS
>    Affects Versions: 18.12.06, 22.01.01
>            Reporter: Jacques Le Roux
>            Assignee: Jacques Le Roux
>            Priority: Major
>             Fix For: 18.12.06, 22.01.01
>
>
> OFBIZ-12587 is a definitive solution to prevent any kind of Freemarker exploits. But it's hard to realise because OFBiz exposes objects, like attributes from the Servlet scopes. So in the meantime preventing Freemarker interpolation in fields is a pragmatic solution.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)