[jira] [Commented] (OFBIZ-12602) XML Import fails due to security check

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-12602?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104820#comment-18104820 ] 

ASF subversion and git services commented on OFBIZ-12602:
---------------------------------------------------------

Commit 27e17366ab1c9ca2e8afc568e177b5ee424b4fcc in ofbiz-framework's branch refs/heads/release24.09 from Mridul Pathak
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=27e17366ab ]

Fixed: ControlFilter's FreeMarker-interpolation guard was unreachable due to fail-open security check (OFBIZ-13492) (#1642)

Backported from trunk (#1641). LoginWorker.hasBasePermission() returned true whenever the request-scoped "security" attribute was unresolved, which was effectively always the case since ControlFilter runs before ContextFilter (the attribute's source) in nearly every webapp's filter-mapping order. This made the SSTI/Freemarker-interpolation guard added for OFBIZ-12594/OFBIZ-12602 unreachable across the framework, for any request. hasBasePermission() now falls back to the Security instance cached on the ServletContext when the request attribute is null, since ContextFilter only ever copies that same object into the request scope each call.

> XML Import fails due to security check
> --------------------------------------
>
>                 Key: OFBIZ-12602
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-12602
>             Project: OFBiz
>          Issue Type: Bug
>          Components: framework/webtools
>    Affects Versions: 17.12.09, 18.12.05, Upcoming Branch
>            Reporter: Ingo Wolfmayr
>            Assignee: Jacques Le Roux
>            Priority: Minor
>             Fix For: 18.12.06, 22.01.01
>
>         Attachments: OFBIZ-12602.patch
>
>
> When importing an entity like
>  
> {code:java}
> <SystemProperty systemResourceId="catalog" 
> systemPropertyId="image.server.path" systemPropertyValue="${sys:getProperty("ofbiz.home")}/themes/common-theme/webapp/images/${tenantId}" description="Image upload path on the server." lastUpdatedStamp="2022-04-14 12:00:12.597" lastUpdatedTxStamp="2022-04-14 12:00:12.596" createdStamp="2022-04-14 12:00:12.597" createdTxStamp="2022-04-14 12:00:12.596"/>{code}
>  
> I get the following info message.
> {code:java}
> HTTP Status 403 – Forbidden
> Type Status Report
> Message Not saved for security reason, strings '${', '<#', '#{', '[=' or '[#' not accepted in fields!
> Description The server understood the request but refuses to authorize it.
> {code}
> I do have the same problem when I try to update the value via entity mainainance. Importing an XML file works.
> Would it make sense to bypass the check if the user has the appropriate permissions?
>  
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)