(ofbiz-framework) 03/06: Fixed: Integrate SecurityUtil to validate file paths in CommonEvents for enhanced security

[jacopoc]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git

commit e023f5250e778cdabdc838525e563f86ad15626d
Author: Jacopo Cappellato <jacopo.cappell...@gmail.com>
AuthorDate: Wed Apr 8 11:01:52 2026 +0200

    Fixed: Integrate SecurityUtil to validate file paths in CommonEvents for 
enhanced security
    
    (cherry picked from commit 93b08e85d3e156de86893b619132a1fa8891430e)
---
 .../common/src/main/java/org/apache/ofbiz/common/CommonEvents.java   | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git 
a/framework/common/src/main/java/org/apache/ofbiz/common/CommonEvents.java 
b/framework/common/src/main/java/org/apache/ofbiz/common/CommonEvents.java
index c4aac4b7c4..1be79c5f85 100644
--- a/framework/common/src/main/java/org/apache/ofbiz/common/CommonEvents.java
+++ b/framework/common/src/main/java/org/apache/ofbiz/common/CommonEvents.java
@@ -46,6 +46,7 @@ import org.apache.commons.lang.StringUtils;
 import org.apache.ofbiz.base.lang.JSON;
 import org.apache.ofbiz.base.location.FlexibleLocation;
 import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.GeneralException;
 import org.apache.ofbiz.base.util.UtilGenerics;
 import org.apache.ofbiz.base.util.UtilHttp;
 import org.apache.ofbiz.base.util.UtilProperties;
@@ -57,6 +58,7 @@ import org.apache.ofbiz.entity.GenericValue;
 import org.apache.ofbiz.entity.util.EntityUtilProperties;
 import org.apache.ofbiz.webapp.control.JWTManager;
 import org.apache.ofbiz.webapp.control.LoginWorker;
+import org.apache.ofbiz.security.SecurityUtil;
 import org.apache.ofbiz.widget.model.ModelWidget;
 import org.apache.ofbiz.widget.model.ScriptLinkHelper;
 import org.apache.ofbiz.widget.model.ThemeFactory;
@@ -414,6 +416,7 @@ public class CommonEvents {
                     if (!platformSpecificPath.contains(File.separator) && 
"\\".equals(File.separator)) {
                         platformSpecificPath = 
platformSpecificPath.replace("/", "\\");
                     }
+                    SecurityUtil.checkOfbizFileAllowList(new 
File(platformSpecificPath));
                     // get line number
                     int lineNumber = 1;
                     if (UtilValidate.isNotEmpty(fragment)) {
@@ -446,7 +449,7 @@ public class CommonEvents {
                         Debug.logInfo(line, MODULE);
                     }
                     return "success";
-                } catch (IOException e) {
+                } catch (GeneralException | IOException e) {
                     Debug.logError(e, MODULE);
                 }
             }