This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new b570d7ef66 Fixed: Apply the SVG content check to all upload file types
in SecuredUpload (OFBIZ-13724)
b570d7ef66 is described below
commit b570d7ef6687c7ed80fdd392a2f4cb4eb9fec00b
Author: Mridul Pathak <[email protected]>
AuthorDate: Sat Oct 24 12:50:14 2026 +0530
Fixed: Apply the SVG content check to all upload file types in
SecuredUpload (OFBIZ-13724)
SecuredUpload.isValidFile applied the SVG content check (isValidSvgFile)
only for the "ImageAndSvg" file type. For "All" and "AllButCompressed",
isValidTextFile is evaluated first and accepts SVG files, so the SVG check was
not reached; the same applied to SVG files inside a zip ("Compressed") and to
SVG content in a .txt file ("Text"). Any file with an SVG extension or SVG
content now has to pass isValidSvgFile, whatever the file type.
---
.../java/org/apache/ofbiz/security/SecuredUpload.java | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index a613b070b2..378b7d5469 100644
---
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -458,6 +458,14 @@ public class SecuredUpload {
return false;
}
+ // An SVG file can carry scripts, so whatever the file type it is only
accepted when it passes the SVG checks.
+ // Otherwise isValidTextFile, which only checks the characters used,
would accept it as a text file.
+ if (isSvgFile(fileToCheck) && !isValidSvgFile(fileToCheck)) {
+ Debug.logError("File : " + fileToCheck + ", is not a safe SVG
file", MODULE);
+ deleteBadFile(fileToCheck);
+ return false;
+ }
+
switch (fileType) {
case "Image":
if (isValidImageFile(fileToCheck)) {
@@ -918,6 +926,16 @@ public class SecuredUpload {
return isValidImageFile(fileName) || isValidSvgFile(fileName);
}
+ /**
+ * @param fileName
+ * @return true if the file has an SVG extension or SVG content, whether
or not it is a valid SVG file
+ * @throws IOException
+ */
+ private static boolean isSvgFile(String fileName) throws IOException {
+ return "svg".equalsIgnoreCase(FilenameUtils.getExtension(fileName))
+ || "image/svg+xml".equals(getMimeTypeFromFileName(fileName));
+ }
+
/**
* Is it an SVG file?
* @param fileName
