This is an automated email from the ASF dual-hosted git repository. jacopoc pushed a commit to branch release24.09 in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 64acfed4d8bb7d46e4143986ddc1dbbe0f5135e4 Author: Jacopo Cappellato <[email protected]> AuthorDate: Wed Apr 8 10:48:52 2026 +0200 Fixed: Implement file path validation using SecurityUtil in CoreEvents to enhance security (cherry picked from commit d06b61393fd5023ef6f8610e013b2b6f299d14f8) --- .../src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java index 05475ea699..be4ebfcc43 100644 --- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/CoreEvents.java @@ -37,6 +37,7 @@ import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; import org.apache.ofbiz.base.util.Debug; +import org.apache.ofbiz.base.util.GeneralException; import org.apache.ofbiz.base.util.UtilGenerics; import org.apache.ofbiz.base.util.UtilHttp; import org.apache.ofbiz.base.util.UtilProperties; @@ -47,6 +48,7 @@ import org.apache.ofbiz.entity.GenericEntityException; import org.apache.ofbiz.entity.GenericValue; import org.apache.ofbiz.entity.util.EntityQuery; import org.apache.ofbiz.security.Security; +import org.apache.ofbiz.security.SecurityUtil; import org.apache.ofbiz.service.GenericServiceException; import org.apache.ofbiz.service.LocalDispatcher; import org.apache.ofbiz.service.ModelService; @@ -489,6 +491,12 @@ public class CoreEvents { // load the file File file = new File(filePath); + try { + SecurityUtil.checkOfbizFileAllowList(file); + } catch (GeneralException e) { + Debug.logError(e.getMessage(), MODULE); + return "error"; + } if (file.exists()) { Long longLen = file.length(); int length = longLen.intValue();
