This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release18.12 by this push:
new cb5c385 Improved: Create a deny list to reject webshell tokens
(OFBIZ-12324)
cb5c385 is described below
commit cb5c385286e16009649fa0d052c68b28dfff0313
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Fri Feb 18 13:50:50 2022 +0100
Improved: Create a deny list to reject webshell tokens (OFBIZ-12324)
Prevents CSV injection (MS Excel or Open Office)
---
framework/security/config/security.properties | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/framework/security/config/security.properties
b/framework/security/config/security.properties
index 5fda3be..eb53037 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -220,7 +220,7 @@
deniedWebShellTokens=freemarker,<script,javascript,<body,<form,<jsp:,<c:out,tagl
%eval,@eval,eval(,runtime,import,passthru,shell_exec,assert,str_rot13,system,decode,include,page
,\
chmod,mkdir,fopen,fclose,new
file,upload,getfilename,download,getoutputstring,readfile,\
python,perl ,/perl,ruby
,/ruby,process,function,class,InputStream,to_server,\
-
ifconfig,route,crontab,netstat,uname,hostname,iptables,whoami
+
ifconfig,route,crontab,netstat,uname,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|
#-- Max line length for uploaded files, by default 10000
