[jira] [Created] (OFBIZ-13486) isExecutable() mime-type checks for Perl/Ruby/Python never match Tika's actual output

["Mridul Pathak (Jira)" <ji...@apache.org>]

Mridul Pathak created OFBIZ-13486:
-------------------------------------

             Summary: isExecutable() mime-type checks for Perl/Ruby/Python never match Tika's actual output
                 Key: OFBIZ-13486
                 URL: https://issues.apache.org/jira/browse/OFBIZ-13486
             Project: OFBiz
          Issue Type: Bug
          Components: framework/security
    Affects Versions: 24.09.07
            Reporter: Mridul Pathak
            Assignee: Mridul Pathak


SecuredUpload.isExecutable (framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java, ~L1132-1136) compares Tika's detected mime type against "application/text/x-perl", "application/text/x-ruby", "application/text/x-python". Tika (verified against this project's tika-core:3.3.1) actually returns "text/x-perl", "text/x-ruby", "text/x-python" -- no application/ prefix exists for these types, so these three comparisons have been dead code since introduction.
 
Present since the check's first commit (f741bb2277, 2020-11-30, part of the original OFBIZ-12080 security hardening for file uploads). Confirmed via JUnit repro: a Perl-shebang temp file is detected by Tika as text/x-perl, but isExecutable() returns false (expected true).
 
Impact is partly mitigated by the extension allow-list, which already blocks .pl/.py/.rb/.sh. But a script renamed to an allowed extension (e.g. shell.txt) bypasses this content-based check entirely.
 
Fix: drop the erroneous application/ prefix from the three comparisons.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)