This is an automated email from the ASF dual-hosted git repository. jleroux pushed a commit to branch release24.09 in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit a728fa5042c83607eb6acb42a2ff17ebf6d5950f Author: Jacques Le Roux <[email protected]> AuthorDate: Thu Nov 28 08:44:41 2024 +0100 Improved: Prevent URL parameters manipulation (OFBIZ-13147) Add ROT13, and improves few short deniedWebShellTokens by surrounding them by spaces. It's to avoid collisions while loading image files --- framework/security/config/security.properties | 5 ++++- .../src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/framework/security/config/security.properties b/framework/security/config/security.properties index ed04b0091b..d3bd2a8c9c 100644 --- a/framework/security/config/security.properties +++ b/framework/security/config/security.properties @@ -274,12 +274,15 @@ csvformat=CSVFormat.DEFAULT #-- #-- If you are sure you are safe for a token you can remove it, etc. #-- If you add a token beware that it does not content ",". It's the separator. +#-- +#-- If you cross issues while loading an image file because of a token found there, you may try to surround the string by spaces, as " tr " below. +#-- Actually most of the tokens should but it's now a bit late for me. I mean to test all of them... deniedWebShellTokens=java.,beans,freemarker,<script,javascript,<body,body ,<form,<jsp:,<c:out,taglib,<prefix,<%@ page,<?php,exec(,alert(,\ %eval,@eval,eval(,runtime,import,passthru,shell_exec,assert,str_rot13,system,decode,include,page ,\ chmod,mkdir,fopen,fclose,new file,upload,getfilename,download,getoutputstring,readfile,iframe,object,embed,onload,build,\ python,perl ,/perl,ruby ,/ruby,process,function,class,InputStream,to_server,wget ,static,assign,webappPath,\ ifconfig,route,crontab,netstat,uname ,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost,thread,require,gzdeflate,\ - execute,println,calc,touch,curl,base64,tcp,4444,base32,xxd,bash + execute,println,calc,touch,curl,base64, tcp ,4444,base32, tr , xxd ,bash #-- SHA-1 versions of tokens containing (as String) at least one deniedWebShellTokens diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java index 7018058726..160e5a04f5 100644 --- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java @@ -172,7 +172,7 @@ public class ControlFilter extends HttpFilter { String queryString = req.getQueryString(); if (queryString != null) { queryString = URLDecoder.decode(queryString, "UTF-8"); - if (UtilValidate.isUrlInString(queryString) + if (UtilValidate.isUrl(queryString) || !SecuredUpload.isValidText(queryString.toLowerCase(), SecuredUpload.getallowedTokens(), true) && isSolrTest()) { Debug.logError("For security reason this URL is not accepted", MODULE);
