[jira] [Commented] (OFBIZ-13689) LOCAL_FILE uploads fail with "path is not within an allowed directory" on default configuration

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OFBIZ-13689?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127754#comment-18127754 ] 

ASF subversion and git services commented on OFBIZ-13689:
---------------------------------------------------------

Commit 5611b685dcf7c1221f04935fab835f8f5a5397c9 in ofbiz-framework's branch refs/heads/trunk from Mridul Pathak
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=5611b685dc ]

Fixed: Allow the content upload directory in the default LOCAL_FILE allow-list (OFBIZ-13689)

Uploads stored as LOCAL_FILE data resources are written under ${ofbiz.home}/runtime/uploads/ (content.upload.path.prefix), but the default content.data.local.file.allowed.paths only allowed ${ofbiz.home}/runtime/tmp/, so SecurityUtil.checkLocalFileAllowList rejected every such upload with "Access to file denied: path is not within an allowed directory" and the transaction rolled back, and LOCAL_FILE resources uploaded earlier could no longer be rendered. Add the upload directory to the default list, with a comment that it must match content.upload.path.prefix; the canonical-path checks are unchanged.


> LOCAL_FILE uploads fail with "path is not within an allowed directory" on default configuration
> -----------------------------------------------------------------------------------------------
>
>                 Key: OFBIZ-13689
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13689
>             Project: OFBiz
>          Issue Type: Bug
>          Components: content
>    Affects Versions: Upcoming Branch, 24.09.08
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Major
>
> Uploads that store LOCAL_FILE data resources (e.g. partymgr > Party Profile > Content > Upload, request {{uploadPartyContent}}) fail on a default setup with "Access to file denied: path is not within an allowed directory" and the transaction rolls back.
> {{attachUploadToDataResource}} writes LOCAL_FILE uploads under {{$\{ofbiz.home\}/<content.upload.path.prefix>/<n>/}} ({{runtime/uploads}} by default, content.properties), but {{SecurityUtil.checkLocalFileAllowList}}, now also called from {{DataServices.createFileMethod}}/{{updateFileMethod}}, only allows the default {{content.data.local.file.allowed.paths=$\{ofbiz.home\}/runtime/tmp/}} (security.properties). The same check also blocks rendering LOCAL_FILE resources uploaded earlier.
> This affects every caller of {{attachUploadToDataResource}} with LOCAL_FILE (party, communication event, content, product, category, request, work effort, agreement and invoice content uploads).
> h3. Fix
> Add {{$\{ofbiz.home\}/runtime/uploads/}} to the default {{content.data.local.file.allowed.paths}}, with a comment that the entry must match {{content.upload.path.prefix}}. The canonical-path checks in {{checkLocalFileAllowList}} stay unchanged.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)