(ofbiz-framework) branch trunk updated: Fixed: Validate last view name input in RequestHandler to enhance security and prevent user manipulation

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new d387aea387 Fixed: Validate last view name input in RequestHandler to enhance security and prevent user manipulation
d387aea387 is described below

commit d387aea38738e13679aeacc51f707e92894e3bd1
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Tue Apr 7 12:08:00 2026 +0200

    Fixed: Validate last view name input in RequestHandler to enhance security and prevent user manipulation
---
 .../main/java/org/apache/ofbiz/webapp/control/RequestHandler.java  | 6 ++++--
 .../org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java  | 7 ++-----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
index c73bcb75d6..6d54d7f0a5 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
@@ -1177,8 +1177,10 @@ public final class RequestHandler {
         // add in the attributes as well so everything needed for the rendering context will be in place if/when we get back to this view
         paramMap.putAll(UtilHttp.getAttributeMap(req));
         UtilMisc.makeMapSerializable(paramMap);
-        // Used by lookups to keep the real view (request)
-        req.getSession().setAttribute("_LAST_VIEW_NAME_", paramMap.getOrDefault("_LAST_VIEW_NAME_", view));
+        // Used by lookups to keep the real view (request); accept the request parameter only if it is a safe view name (alphanumeric/dash/underscore)
+        String lastViewNameParam = (String) paramMap.get("_LAST_VIEW_NAME_");
+        String lastViewName = (lastViewNameParam != null && lastViewNameParam.matches("[\\w\\-]+")) ? lastViewNameParam : view;
+        req.getSession().setAttribute("_LAST_VIEW_NAME_", lastViewName);
         req.getSession().setAttribute("_LAST_VIEW_PARAMS_", paramMap);
 
         if ("SAVED".equals(saveName)) {
diff --git a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
index 9235fb29fd..6697df3d4e 100644
--- a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
+++ b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
@@ -1495,11 +1495,8 @@ public final class MacroFormRenderer implements FormStringRenderer {
         if (showDescription == null) {
             showDescription = "Y".equals(visualTheme.getModelTheme().getLookupShowDescription());
         }
-        // lastViewName, used by lookup to remember the real last view name
-        String lastViewName = request.getParameter("_LAST_VIEW_NAME_"); // Try to get it from parameters firstly
-        if (UtilValidate.isEmpty(lastViewName)) { // get from session
-            lastViewName = (String) request.getSession().getAttribute("_LAST_VIEW_NAME_");
-        }
+        // lastViewName, used by lookup to remember the real last view name; read only from session (set by RequestHandler) to prevent user input
+        String lastViewName = (String) request.getSession().getAttribute("_LAST_VIEW_NAME_");
         if (UtilValidate.isEmpty(lastViewName)) {
             lastViewName = "";
         }