(ofbiz-framework) branch trunk updated: Fixed: Apply the SVG content check to all upload file types in SecuredUpload (OFBIZ-13724)

[mr...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new b570d7ef66 Fixed: Apply the SVG content check to all upload file types in SecuredUpload (OFBIZ-13724)
b570d7ef66 is described below

commit b570d7ef6687c7ed80fdd392a2f4cb4eb9fec00b
Author: Mridul Pathak <mr...@gmail.com>
AuthorDate: Sat Oct 24 12:50:14 2026 +0530

    Fixed: Apply the SVG content check to all upload file types in SecuredUpload (OFBIZ-13724)
    
    SecuredUpload.isValidFile applied the SVG content check (isValidSvgFile) only for the "ImageAndSvg" file type. For "All" and "AllButCompressed", isValidTextFile is evaluated first and accepts SVG files, so the SVG check was not reached; the same applied to SVG files inside a zip ("Compressed") and to SVG content in a .txt file ("Text"). Any file with an SVG extension or SVG content now has to pass isValidSvgFile, whatever the file type.
---
 .../java/org/apache/ofbiz/security/SecuredUpload.java  | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index a613b070b2..378b7d5469 100644
--- a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -458,6 +458,14 @@ public class SecuredUpload {
             return false;
         }
 
+        // An SVG file can carry scripts, so whatever the file type it is only accepted when it passes the SVG checks.
+        // Otherwise isValidTextFile, which only checks the characters used, would accept it as a text file.
+        if (isSvgFile(fileToCheck) && !isValidSvgFile(fileToCheck)) {
+            Debug.logError("File : " + fileToCheck + ", is not a safe SVG file", MODULE);
+            deleteBadFile(fileToCheck);
+            return false;
+        }
+
         switch (fileType) {
         case "Image":
             if (isValidImageFile(fileToCheck)) {
@@ -918,6 +926,16 @@ public class SecuredUpload {
         return isValidImageFile(fileName) || isValidSvgFile(fileName);
     }
 
+    /**
+     * @param fileName
+     * @return true if the file has an SVG extension or SVG content, whether or not it is a valid SVG file
+     * @throws IOException
+     */
+    private static boolean isSvgFile(String fileName) throws IOException {
+        return "svg".equalsIgnoreCase(FilenameUtils.getExtension(fileName))
+                || "image/svg+xml".equals(getMimeTypeFromFileName(fileName));
+    }
+
     /**
      * Is it an SVG file?
      * @param fileName