This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 6614e2a424 Fixed: [codeQL] Resolving specific Java issues
(OFBIZ-12925)
6614e2a424 is described below
commit 6614e2a4241d251ecff3c7f2b26a1dab1a474f21
Author: Jacques Le Roux <[email protected]>
AuthorDate: Mon Feb 24 11:24:25 2025 +0100
Fixed: [codeQL] Resolving specific Java issues (OFBIZ-12925)
Fixes the case when reading a local XML file.
---
framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
index a76fbe22b1..5da1aa3627 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
@@ -397,7 +397,8 @@ public final class UtilXml {
public static Document readXmlDocument(URL url, boolean validate, boolean
withPosition)
throws SAXException, ParserConfigurationException,
java.io.IOException {
- if (!HOSTHEADERSALLOWED.contains(url.getHost())) {
+ // url.getHost().isEmpty() when reading an XML file
+ if (!HOSTHEADERSALLOWED.contains(url.getHost()) &&
!url.getHost().isEmpty()) {
Debug.logWarning("Domain " + url.getHost() + " not accepted to
prevent host header injection."
+ " You need to set host-headers-allowed property in
security.properties file.", MODULE);
throw new IOException("Domain " + url.getHost() + " not accepted
to prevent host header injection."
