[jira] [Commented] (OFBIZ-13147) Prevent URL parameters manipulation

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-13147?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17902733#comment-17902733 ] 

ASF subversion and git services commented on OFBIZ-13147:
---------------------------------------------------------

Commit 8385c8e75550c779bb30c93f1075499d524578be in ofbiz-framework's branch refs/heads/release18.12 from Jacques Le Roux
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=8385c8e755 ]

Improved: Prevent URL parameters manipulation (OFBIZ-13147)

Add ROT13, and improves few short deniedWebShellTokens by surrounding them by
spaces. It's to avoid collisions while loading image files

We don't need hashed deniedWebShellTokens, only hashed allowedTokens, get back
to simple text.

Simplifies SecuredUpload:
 No need for Base64 handling, using deniedWebShellTokens is enough.
 Improves performance, remove duplicated calls inside loops or stream().allMatch
 Improves comments.

Adds 6 new deniedWebShellTokens in security.properties

This follows Leïla comment. It simplifies the SecuredUpload::isValidEncodedText
content and renames it isNotValidEncodedText

Also 3 new deniedWebShellTokens are added, some more to come

Conflicts handled by hand in ControlFilter.java and SecuredUpload.java


> Prevent URL parameters manipulation
> -----------------------------------
>
>                 Key: OFBIZ-13147
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13147
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: ALL APPLICATIONS, ALL PLUGINS
>    Affects Versions: 18.12.16
>            Reporter: Jacques Le Roux
>            Assignee: Jacques Le Roux
>            Priority: Major
>             Fix For: 18.12.18
>
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)