[ofbiz-framework] branch release22.01 updated: Fixed: Secure the uploads (OFBIZ-12080)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release22.01
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release22.01 by this push:
     new b476d67  Fixed: Secure the uploads (OFBIZ-12080)
b476d67 is described below

commit b476d67befba418098255aa22fc7e016990e321b
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Fri Feb 18 15:45:07 2022 +0100

    Fixed: Secure the uploads (OFBIZ-12080)
    
    Prevents billions laugh attacks
---
 .../src/main/java/org/apache/ofbiz/security/SecuredUpload.java       | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 6a86c75..793e68a 100644
--- 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -654,8 +654,9 @@ public class SecuredUpload {
             }
         }
         String content = new String(bytesFromFile);
-        if (content.toLowerCase().contains("xlink:href=\"http")) {
-            Debug.logError("Linked images inside SVG are not allowed for 
security reason", MODULE);
+        if (content.toLowerCase().contains("xlink:href=\"http")
+                || content.toLowerCase().contains("<!ENTITY ")) { // Billions 
laugh attack
+            Debug.logError("Linked images inside or Entity in SVG are not 
allowed for security reason", MODULE);
             return false;
         }
         ArrayList<String> allowed = new ArrayList<>();