You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2024/05/20 09:03:45 UTC
(ofbiz-framework) branch trunk updated (3aba9e9dc7 -> bc856f46f8)
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a change to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from 3aba9e9dc7 Fixed: Duplicate main menu button after plugin creation (OFBIZ-13080) (#794)
new 11986593b6 Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
new 7e7b7c4266 Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
new 2d2e197b49 Fixed: The non ASCII language in UiLabels.xml are not correctly handled during plugin creation (OFBIZ-13095)
new bc856f46f8 Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
framework/resources/templates/UiLabels.xml | 10 ++--------
framework/security/config/security.properties | 2 +-
.../apache/ofbiz/webapp/control/ControlFilter.java | 22 +++++++++-------------
.../apache/ofbiz/webapp/control/LoginWorker.java | 9 ---------
4 files changed, 12 insertions(+), 31 deletions(-)
(ofbiz-framework) 02/04: Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 7e7b7c4266d85fdcf2ad9216349424abd7138615
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Sat May 18 18:11:50 2024 +0200
Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
Better avoid special encoded characters sequences
Improves deniedWebShellTokens in security.properties
---
.../src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
index b1f3dfd976..8ef02fad5c 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
@@ -166,8 +166,7 @@ public class ControlFilter extends HttpFilter {
String uRIFiltered = new URI(initialURI)
.normalize().toString()
.replaceAll(";", "")
- .replaceAll("(?i)%2e", "") // . encoded
- ;
+ .replaceAll("(?i)%2e", "");
if (!initialURI.equals(uRIFiltered)) {
Debug.logError("For security reason this URL is not accepted", MODULE);
throw new RuntimeException("For security reason this URL is not accepted");
(ofbiz-framework) 04/04: Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit bc856f46f87435e986f98c75460a57c182e7e5d4
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Mon May 20 10:36:13 2024 +0200
Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
Removes no longer needed check in LoginWorker class. It's now handled before by
ControlFilter class.
Fixes imported indentation from 18.12 in ControlFilter.java
---
.../org/apache/ofbiz/webapp/control/ControlFilter.java | 14 +++++++-------
.../java/org/apache/ofbiz/webapp/control/LoginWorker.java | 9 ---------
2 files changed, 7 insertions(+), 16 deletions(-)
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
index 8ef02fad5c..30dc49ef7e 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
@@ -163,13 +163,13 @@ public class ControlFilter extends HttpFilter {
String initialURI = req.getRequestURI();
if (initialURI != null) { // Allow tests with Mockito. ControlFilterTests send null
try {
- String uRIFiltered = new URI(initialURI)
- .normalize().toString()
- .replaceAll(";", "")
- .replaceAll("(?i)%2e", "");
- if (!initialURI.equals(uRIFiltered)) {
- Debug.logError("For security reason this URL is not accepted", MODULE);
- throw new RuntimeException("For security reason this URL is not accepted");
+ String uRIFiltered = new URI(initialURI)
+ .normalize().toString()
+ .replaceAll(";", "")
+ .replaceAll("(?i)%2e", "");
+ if (!initialURI.equals(uRIFiltered)) {
+ Debug.logError("For security reason this URL is not accepted", MODULE);
+ throw new RuntimeException("For security reason this URL is not accepted");
}
} catch (URISyntaxException e) {
throw new RuntimeException(e);
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java
index 7cee010415..cd10879cf6 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/LoginWorker.java
@@ -21,8 +21,6 @@ package org.apache.ofbiz.webapp.control;
import static org.apache.ofbiz.base.util.UtilGenerics.checkMap;
import java.math.BigInteger;
-import java.net.URI;
-import java.net.URISyntaxException;
import java.security.cert.X509Certificate;
import java.sql.Timestamp;
import java.util.ArrayList;
@@ -1374,13 +1372,6 @@ public final class LoginWorker {
if (UtilValidate.isEmpty(contextPath)) {
contextPath = "/";
}
-
- try {
- contextPath = new URI(contextPath).normalize().toString();
- } catch (URISyntaxException e) {
- throw new RuntimeException(e);
- }
-
ComponentConfig.WebappInfo info = ComponentConfig.getWebAppInfo(serverId, contextPath);
if (info != null) {
return hasApplicationPermission(info, security, userLogin);
(ofbiz-framework) 03/04: Fixed: The non ASCII language in UiLabels.xml are not correctly handled during plugin creation (OFBIZ-13095)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 2d2e197b499939569d38d6979355efd85693e4ce
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Sun May 19 10:40:58 2024 +0200
Fixed: The non ASCII language in UiLabels.xml are not correctly handled during plugin creation (OFBIZ-13095)
You get this error:
2024-05-19 09:52:41,314 |jsse-nio-8443-exec-3 |UtilProperties |W| XML file for
locale could not be loaded.
org.xml.sax.SAXParseException: Invalid byte 3 of 3-byte UTF-8 sequence.
When removing ZH labels it works. We should keep only English languages or
amend the createPlugin Gradle task. In this commit I remove all non English
labels and put a comment as documentation about that for developers
in framework/resources/templates/UiLabels.xml
---
framework/resources/templates/UiLabels.xml | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/framework/resources/templates/UiLabels.xml b/framework/resources/templates/UiLabels.xml
index b34d2142c7..c6b869a2e0 100644
--- a/framework/resources/templates/UiLabels.xml
+++ b/framework/resources/templates/UiLabels.xml
@@ -18,25 +18,19 @@ specific language governing permissions and limitations
under the License.
-->
+<!-- Keep only English language here because of OFBIZ-13095 -->
+
<resource xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://ofbiz.apache.org/dtds/ofbiz-properties.xsd">
<property key="@component-resource-name@Application">
<value xml:lang="en">@component-resource-name@ Application</value>
- <value xml:lang="zh">@component-resource-name@应用程序</value>
- <value xml:lang="zh-TW">@component-resource-name@應用程式</value>
</property>
<property key="@component-resource-name@CompanyName">
<value xml:lang="en">OFBiz: @component-resource-name@</value>
- <value xml:lang="zh-TW">OFBiz: @component-resource-name@</value>
</property>
<property key="@component-resource-name@CompanySubtitle">
<value xml:lang="en">Part of the Apache OFBiz Family of Open Source Software</value>
- <value xml:lang="it">Un modulo della famiglia di software open source Apache OFBiz</value>
- <value xml:lang="zh">开源软件OFBiz的组成部分</value>
- <value xml:lang="zh-TW">開源軟體OFBiz的組成部分</value>
</property>
<property key="@component-resource-name@ViewPermissionError">
<value xml:lang="en">You are not allowed to view this page.</value>
- <value xml:lang="zh">不允许你浏览这个页面。</value>
- <value xml:lang="zh-TW">不允許您檢視這個頁面.</value>
</property>
</resource>
(ofbiz-framework) 01/04: Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 11986593b668661d748789154a6052ef4e1ab1c6
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Wed May 15 17:16:29 2024 +0200
Improved: Prevent special encoded characters sequences in URLs (OFBIZ-13092)
Better avoid special encoded characters sequences
Improves deniedWebShellTokens in security.properties
---
framework/security/config/security.properties | 2 +-
.../apache/ofbiz/webapp/control/ControlFilter.java | 23 ++++++++++------------
2 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/framework/security/config/security.properties b/framework/security/config/security.properties
index a5fb32f108..41bc226920 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -278,7 +278,7 @@ deniedWebShellTokens=java.,beans,freemarker,<script,javascript,<body,body ,<form
chmod,mkdir,fopen,fclose,new file,upload,getfilename,download,getoutputstring,readfile,iframe,object,embed,onload,build,\
python,perl ,/perl,ruby ,/ruby,process,function,class,InputStream,to_server,wget ,static,assign,webappPath,\
ifconfig,route,crontab,netstat,uname ,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost,thread,require,gzdeflate,\
- execute,println,calc
+ execute,println,calc,calculate,touch
allowStringConcatenationInUploadedFiles=false
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
index 3110773989..b1f3dfd976 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
@@ -159,27 +159,24 @@ public class ControlFilter extends HttpFilter {
return;
}
}
-
// Reject wrong URLs
- if (req.getRequestURL() != null) { // Allow tests with Mockito. ControlFilterTests send null
+ String initialURI = req.getRequestURI();
+ if (initialURI != null) { // Allow tests with Mockito. ControlFilterTests send null
try {
- String url = new URI(req.getRequestURL().toString()).normalize().toString();
- if (!req.getRequestURL().toString().equals(url)) {
- throw new RuntimeException();
+ String uRIFiltered = new URI(initialURI)
+ .normalize().toString()
+ .replaceAll(";", "")
+ .replaceAll("(?i)%2e", "") // . encoded
+ ;
+ if (!initialURI.equals(uRIFiltered)) {
+ Debug.logError("For security reason this URL is not accepted", MODULE);
+ throw new RuntimeException("For security reason this URL is not accepted");
}
} catch (URISyntaxException e) {
throw new RuntimeException(e);
}
}
-
- // normalize to remove ".." special name usage to bypass webapp filter
- try {
- uri = new URI(uri).normalize().toString();
- } catch (URISyntaxException e) {
- throw new RuntimeException(e);
- }
-
// Check if the requested URI is allowed.
if (allowedPaths.stream().anyMatch(uri::startsWith)) {
try {