This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release18.12 by this push:
new 70c4a8a Improved: Reflected XSS in content component (OFBIZ-11840)
70c4a8a is described below
commit 70c4a8aea7fee564de2c13677043cf21ef6c9698
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Sat Jul 18 12:00:29 2020 +0200
Improved: Reflected XSS in content component (OFBIZ-11840)
Fixes a Reflected XSS vulnerability in content component
Harshit Shukla reported it to the OFBiz security team:
https://demo-stable.ofbiz.apache.org/content/control/stream?contentId=";><svg/onload=alert(0)>
It's a post-auth vulnerability so we did not ask for a CVE.
Thanks: Harshit Shukla harshit.sh...@gmail.com
---
.../src/main/java/org/apache/ofbiz/content/data/DataEvents.java | 7 +++++++
1 file changed, 7 insertions(+)
diff --git
a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataEvents.java
b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataEvents.java
index 5750463..1c81434 100644
---
a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataEvents.java
+++
b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataEvents.java
@@ -82,6 +82,13 @@ public class DataEvents {
// get the permission service required for streaming data; default is
always the genericContentPermission
String permissionService =
EntityUtilProperties.getPropertyValue("content", "stream.permission.service",
"genericContentPermission", delegator);
+ // This is counterintuitive but it works, for OFBIZ-11840
+ // It could be improved by checking for possible events associated
with svg
+ // As listed at
https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
+ if (contentId.contains("<svg")) {
+ return "success";
+ }
+
// get the content record
GenericValue content;
try {
