[ofbiz-framework] branch trunk updated: Fixed: Secure the uploads (OFBIZ-12080)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 72405ab  Fixed: Secure the uploads (OFBIZ-12080)
72405ab is described below

commit 72405ab98148bde8d8e966022ba8d4cae38fb31c
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Fri Feb 25 12:06:44 2022 +0100

    Fixed: Secure the uploads (OFBIZ-12080)
    
    Checks that the content of SecuredUpload::isValidText is not null,
    else returns false
    
    Suspenders and belt type of fix.
---
 .../security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 029db47..de07002 100644
--- 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -104,7 +104,7 @@ public class SecuredUpload {
     private static final Integer MAXLINELENGTH = 
UtilProperties.getPropertyAsInteger("security", "maxLineLength", 10000);
 
     public static boolean isValidText(String content, List<String> allowed) 
throws IOException {
-        return DENIEDWEBSHELLTOKENS.stream().allMatch(token -> 
isValid(content, token, allowed));
+        return content != null ? DENIEDWEBSHELLTOKENS.stream().allMatch(token 
-> isValid(content, token, allowed)) : false;
     }
 
     public static boolean isValidFileName(String fileToCheck, Delegator 
delegator) throws IOException {