You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@ofbiz.apache.org by 雷咩咩 <67...@qq.com.INVALID> on 2024/09/04 23:54:38 UTC
回复：Re: 回复：URL Issue
I found one stable steps to reproduce this issue in official trunk demo site.
go to https://demo-trunk.ofbiz.apache.org/catalog/control/login, login with admin. the url will be like https://demo-trunk.ofbiz.apache.org/content/control/main?externalLoginKey=EL9a0d332c-0a33-47a2-8dfd-5fa39aa8ffdd
go to menu content, then click any of the items, such as WebStorePos
Expected:
can browse
Actual:
url is https://demo-trunk.ofbiz.apache.org/content/control/EditWebSite;jsessionid=167CC5B83474F1F8F5C7204282259AE3.jvm1?webSiteId=WebStorePos
error
HTTP Status 500 – Internal Server ErrorType Exception Report
Message For security reason this URL is not accepted
Description The server encountered an unexpected condition that prevented it from fulfilling the request.
Exception
java.lang.RuntimeException: For security reason this URL is not accepted
org.apache.ofbiz.webapp.control.ControlFilter.doFilter(ControlFilter.java:172)
javax.servlet.http.HttpFilter.doFilter(HttpFilter.java:53)
org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71)
Note The full stack trace of the root cause is available in the server logs.
Apache Tomcat/9.0.91
原始邮件
发件人："Jacques Le Roux"< jacques.le.roux@les7arts.com >;
发件时间：2024/8/31 22:58
收件人："user"< user@ofbiz.apache.org >;
主题：Re: 回复：URL Issue
That's interesting. Because locally I initially did not find any on mine, but finally found one (and only one among 9 logs):
127.0.0.1 - - [28/Aug/2024:20:59:40 +0200] "GET /common/js/jquery/plugins/jsTree/themes/default/d.png HTTP/2.0" 200 7635
"https://localhost:8443/common/js/jquery/plugins/jsTree/themes/default/style.css" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101
Firefox/56.0"
127.0.0.1 - - [28/Aug/2024:21:00:10 +0200] "GET
/example/control/FindExample%3FexternalLoginKey=EL8b0c355f-d7a6-4a59-9b34-bb0fa6bd0d05&sortField=description&noConditionFind=N;jsessionid=7C492ACEDE914E38A49E17F9151F02B2.jvm1
HTTP/2.0" 500 1169 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0"
127.0.0.1 - - [28/Aug/2024:21:00:11 +0200] "GET /favicon.ico HTTP/2.0" 404 682 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101
Firefox/56.0"
127.0.0.1 - - [28/Aug/2024:21:00:11 +0200] "GET /favicon.ico HTTP/2.0" 404 682 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101
Firefox/56.0"
127.0.0.1 - - [28/Aug/2024:21:00:12 +0200] "GET /favicon.ico HTTP/2.0" 404 682 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101
Firefox/56.0"
As others, it's a HTTP 500, rejected for security reason, actually unrelated to jsessionid. The log stops there. So could be a side effect. The
session should no longer exists after. It's the end of the day. Closing OFBiz, not sure how, maybe just putting the computer off.
Still a mystery, an annoying one it's not good to see the jsessionid in log :/
Jacques
Le 31/08/2024 à 15:56, Omar Abdullwahhab a écrit :
> I didn't understand well,
> But it's a local development machine.
> Not hosted in web or cloud servers.
>
> On Sat, Aug 31, 2024, 4:21 PM Jacques Le Roux
> wrote:
>
>> Thanks Omar,
>>
>> Is that local or on a server?
>>
>> Jacques
>>
>> Le 31/08/2024 à 14:17, Omar Abdullwahhab a écrit :
>>> HI Jacques ,
>>> Here are a few lines of the logs containing jsessionid
>>>
>>> 127.0.0.1 - - [26/Aug/2024:20:51:14 +0300] "GET
>>> /accounting/control/ListCompanies HTTP/2.0" 200 5147 "
>>> https://localhost:8443/accounting/control/globalGLSettings" "Mozilla/5.0
>>> (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0"
>>> 127.0.0.1 - - [26/Aug/2024:20:51:18 +0300] "GET
>>> /rainbowstone/RAINBOWSTONE_SAPHIR.less HTTP/2.0" 200 1560 "
>>>
>> https://localhost:8443/ordermgr/control/main?externalLoginKey=ELd87879e0-9c8b-45e4-8c51-efc0d40748f4
>> "
>>> "Mozilla/5.0 (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0"
>>> 127.0.0.1 - - [26/Aug/2024:20:51:19 +0300] "GET
>>>
>> /ordermgr/control/main?externalLoginKey=ELd87879e0-9c8b-45e4-8c51-efc0d40748f4
>>> HTTP/2.0" 200 4571 "
>> https://localhost:8443/accounting/control/ListCompanies"
>>> "Mozilla/5.0 (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0"
>>> 127.0.0.1 - - [26/Aug/2024:20:51:24 +0300] "GET
>>>
>> /facility/control/main?externalLoginKey=ELf5b96d38-f415-4bdf-94d4-7666a2445a03
>>> HTTP/2.0" 200 4327 "
>>>
>> https://localhost:8443/ordermgr/control/main?externalLoginKey=ELd87879e0-9c8b-45e4-8c51-efc0d40748f4
>> "
>>> "Mozilla/5.0 (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0"
>>> 127.0.0.1 - - [26/Aug/2024:20:51:29 +0300] "POST
>>>
>> /facility/control/EditFacility;jsessionid=132931D4CDCAC10AC958ED9DD3F6511A.jvm1
>>> HTTP/2.0" 500 2038 "
>>>
>> https://localhost:8443/facility/control/main?externalLoginKey=ELf5b96d38-f415-4bdf-94d4-7666a2445a03
>> "
>>> "Mozilla/5.0 (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0"
>>> 127.0.0.1 - - [26/Aug/2024:20:51:36 +0300] "POST
>>>
>> /facility/control/EditFacility;jsessionid=132931D4CDCAC10AC958ED9DD3F6511A.jvm1
>>> HTTP/2.0" 500 2038 "
>>>
>> https://localhost:8443/facility/control/main?externalLoginKey=ELf5b96d38-f415-4bdf-94d4-7666a2445a03
>> "
>>> "Mozilla/5.0 (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0"
>>> 127.0.0.1 - - [26/Aug/2024:20:51:42 +0300] "GET
>>> /rainbowstone/RAINBOWSTONE_SAPHIR.less HTTP/2.0" 200 1560 "
>>> https://localhost:8443/facility/control/FindFacility" "Mozilla/5.0 (X11;
>>> Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0"
>>> 127.0.0.1 - - [26/Aug/2024:20:51:42 +0300] "GET
>>> /facility/control/FindFacility HTTP/2.0" 200 4274 "
>>>
>> https://localhost:8443/facility/control/main?externalLoginKey=ELf5b96d38-f415-4bdf-94d4-7666a2445a03
>> "
>>> "Mozilla/5.0 (X11; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0"
>>>
>>> Regards
>>>
>>> On Sat, Aug 31, 2024 at 2:30 PM Jacques Le Roux <
>>> jacques.le.roux@les7arts.com> wrote:
>>>
>>>> Hi Omar,
>>>>
>>>> Since Java 7 :
>>>>
>> https://docs.oracle.com/javaee/7/api/javax/servlet/annotation/WebListener.html
>>>> In OFBiz, ControlEventListener implements HttpSessionListener
>>>>
>>>> Did you check locally or on a server your access_logs if you find a
>>>> jsessionid there (trunk)?
>>>>
>>>> Jacques
>>>>
>>>> Le 31/08/2024 à 13:07, Omar Abdullwahhab a écrit :
>>>>> Hi Jacques, Johan,
>>>>>
>>>>> According to my investigation to this class (
>>>>> WebAppServletContextListener.java
>>>>> <
>> https://github.com/apache/ofbiz-framework/blame/31eb051326bcec29f4c932a6d829e0d7c9979a16/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/WebAppServletContextListener.java#L41
>>>>> )
>>>>>
>>>>> It seems to be that this listener is never registered , so that it has
>> no
>>>>> effect.
>>>>> Note that its annotated with
>>>>> @WebListener
>>>>>
>>>>> So confirm that I am correct, or wrong.
>>>>>
>>>>> Regards
>>>>>
>>>>> On Fri, Aug 30, 2024 at 6:30 PM Jacques Le Roux <
>>>>> jacques.le.roux@les7arts.com> wrote:
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> Actually it's not related to embedded Tomcat in OFBiz.
>>>>>>
>>>>>> Since we 2017 in WebAppServletContextListener.java we use this line
>>>>>>
>>>>>>
>>>>>>
>> <<servletContext.setSessionTrackingModes(EnumSet.of(SessionTrackingMode.COOKIE));>>
>>>>>>
>> https://github.com/apache/ofbiz-framework/blame/31eb051326bcec29f4c932a6d829e0d7c9979a16/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/WebAppServletContextListener.java#L41
>>>>>> If you test locally or maybe in another server than demo one, you will
>>>> not
>>>>>> find in access_logs files any line similar to the one below. At least
>> I
>>>> did
>>>>>> not, and that's logical since we use cookies for that.
>>>>>>
>>>>>> I'm not sure what's the reason yet. If you could confirm that it's not
>>>>>> reproductible but in demo server that would help to restrain the
>>>>>> possibilities
>>>>>>
>>>>>> TIA
>>>>>>
>>>>>> Jacques
>>>>>>
>>>>>> Le 29/08/2024 à 10:17, Jacques Le Roux a écrit :
>>>>>>> Hi,
>>>>>>>
>>>>>>> Finally it's not that clear.
>>>>>>>
>>>>>>> As can be found in trunk demo access_logs, such URLs exist at least
>>>>>> since June 17 2024.
>>>>>>> access_log.2024-06-17:28:66.249.75.98 - - [17/Jun/2024:00:11:51
>>>>>> +0000] "GET
>>>>>>
>> /partymgr/control/main%3FexternalLoginKey=ELf5183769-2759-476b-946c-2a70afe3c42d&sortField=partyId;jsessionid=EBB57C6C3C345E70501827509E05744C.jvm1
>>>>>>> HTTP/1.1" 500 1165 "-" "Mozilla/5.0 (Linux; Android 6.0.1;
>> Nexus 5X
>>>>>> Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko)
>>>> Chrome/125.0.6422.175
>>>>>>> Mobile Safari/537.36 (compatible; Googlebot/2.1; +
>>>>>> http://www.google.com/bot.html)"
>>>>>>> As you can see they are rejected (HTTP 500) since then too. Actually
>> I
>>>>>> guess they exist for a very long time. Have yet no idea why and how
>>>> these
>>>>>>> URLs are generated.
>>>>>>>
>>>>>>> The rejection is "new" and due to a security fix done in May 20 2024
>>>>>> with (OFBIZ-13092) "Prevent special encoded characters sequences in
>>>> URLs"
>>>>>>> So we need to clearly define steps to manually generate these URLs.
>>>>>> Then, if it's OK, we could allow URLs containing ";jsessionid=" to
>>>> bypass
>>>>>> the
>>>>>>> security filter.
>>>>>>>
>>>>>>> I copy this email to the dev ML because of its importance
>>>>>>>
>>>>>>> Jacques
>>>>>>>
>>>>>>>
>>>>>>> Le 28/08/2024 à 15:27, Jacques Le Roux a écrit :
>>>>>>>> Thanks Guys,
>>>>>>>>
>>>>>>>> I could not reproduce yet, but I think we have already enough clues
>> to
>>>>>> fix that.
>>>>>>>> Also I can find a lot of in trunk demo log. That will be helpful
>> too.
>>>>>>>> Jacques
>>>>>>>>
>>>>>>>> Le 27/08/2024 à 16:20, 雷咩咩 a écrit :
>>>>>>>>> i can reproduce by login with admin, randomly click severl places,
>>>>>> then when click logout, see such error:
>>>>>>>>> HTTP Status 500 – Internal Server Error
>>>>>>>>> Type Exception Report
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Message For security reason this URL is not accepted
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Description The server encountered an unexpected condition that
>>>>>> prevented it from fulfilling the request.
>>>>>>>>> Exception
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> java.lang.RuntimeException: For security reason this URL is not
>>>>>> accepted
>>>>>>
>> org.apache.ofbiz.webapp.control.ControlFilter.doFilter(ControlFilter.java:144)
>> org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71)
>>>>>>>>> Note The full stack trace of the root cause is available in the
>>>> server
>>>>>> logs.
>>>>>>>>> Apache Tomcat/9.0.91
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Regards,
>>>>>>>>> Yang
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> ------------------ 原始邮件 ------------------
>>>>>>>>> 发件人: "user" <johanhpcronje@gmail.com>;
>>>>>>>>> 发送时间: 2024年8月27日(星期二) 晚上9:12
>>>>>>>>> 收件人: "user"<user@ofbiz.apache.org>;
>>>>>>>>>
>>>>>>>>> 主题: URL Issue
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Hi,
>>>>>>>>>
>>>>>>>>> Not sure if anyone would be able to assist me, I have found an
>> issue
>>>>>> which
>>>>>>>>> can also be replicated within the demo.
>>>>>>>>> This issue normally occurs as you navigate to a module after login.
>>>> It
>>>>>> is
>>>>>>>>> not easily replicable, once you refresh it works and does not occur
>>>>>> again.
>>>>>>>>> Replicated the issue in multiple modules.
>>>>>>>>> It usually adds ;jsessionid=######################.jvm1 to all the
>>>>>> URLs and
>>>>>>>>> this causes a navigation issue.
>>>>>>>>> Once you submit a form or try to click the logout link, an Internal
>>>> 500
>>>>>>>>> Internal Server Error is being returned
>>>>>>>>> As an example:
>>>>>>>>> https://demo-stable.ofbiz.apache.org/partymgr/control/main
>>>>>>>>>
>>>>>>>>> I have screenshots available, however I am not able to attach to
>> this
>>>>>> mail.
>>>>>>>>> Please let me know if you need me to upload it somewhere.
>>>>>>>>>
>>>>>>>>> Kind Regards,
>>>>>>>>> Johan Cronjé
>>>