[ofbiz-framework] branch release18.12 updated: Fixed: Secure the uploads (OFBIZ-12080)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release18.12 by this push:
     new fd71686  Fixed: Secure the uploads (OFBIZ-12080)
fd71686 is described below

commit fd71686e6a65b60d4a612a70238b0b755c0236b8
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Thu Mar 3 17:22:50 2022 +0100

    Fixed: Secure the uploads (OFBIZ-12080)
    
    Removes non satisfying last line (because images may contain those strings) 
in
    security.properties and SecurityUtilTest.java
    
    In SecuredUpload, renames deniedFileExtensions and deniedWebShellTokens to
    respectively getDeniedFileExtensions and getDeniedWebShellTokens
---
 framework/security/config/security.properties                     | 2 --
 .../src/main/java/org/apache/ofbiz/security/SecuredUpload.java    | 8 ++++----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/framework/security/config/security.properties 
b/framework/security/config/security.properties
index 9af00cc..93dd00b 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -233,8 +233,6 @@ 
deniedWebShellTokens=java.,beans,freemarker,<script,javascript,<body,<form,<jsp:
                      chmod,mkdir,fopen,fclose,new 
file,upload,getfilename,download,getoutputstring,readfile,iframe,object,embed,onload,build,\
                      python,perl ,/perl,ruby 
,/ruby,process,function,class,InputStream,to_server,wget ,static,\
                      ifconfig,route,crontab,netstat,uname 
,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost,\
-                     ",","+",',','+'
-#-- Last line is a non satisfying (because images may contain those strings) 
temporary solution before looking at Freemarker::WhitelistMemberAccessPolicy
 
 #-- Max line length for uploaded files, by default 10000
 maxLineLength=
diff --git 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index ce4419c..b1225dc 100644
--- 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -99,8 +99,8 @@ public class SecuredUpload {
     // Supported file formats are *safe* PNG, GIF, TIFF, JPEG, PDF, Audio, 
Video, Text, and ZIP
 
     private static final String MODULE = SecuredUpload.class.getName();
-    private static final List<String> DENIEDFILEEXTENSIONS = 
deniedFileExtensions();
-    private static final List<String> DENIEDWEBSHELLTOKENS = 
deniedWebShellTokens();
+    private static final List<String> DENIEDFILEEXTENSIONS = 
getDeniedFileExtensions();
+    private static final List<String> DENIEDWEBSHELLTOKENS = 
getDeniedWebShellTokens();
     private static final Integer MAXLINELENGTH = 
UtilProperties.getPropertyAsInteger("security", "maxLineLength", 10000);
 
     public static boolean isValidText(String content, List<String> allowed) 
throws IOException {
@@ -688,12 +688,12 @@ public class SecuredUpload {
         }
     }
 
-    private static List<String> deniedFileExtensions() {
+    private static List<String> getDeniedFileExtensions() {
         String deniedExtensions = UtilProperties.getPropertyValue("security", 
"deniedFileExtensions");
         return UtilValidate.isNotEmpty(deniedExtensions) ? 
StringUtil.split(deniedExtensions, ",") : new ArrayList<>();
     }
 
-    private static List<String> deniedWebShellTokens() {
+    private static List<String> getDeniedWebShellTokens() {
         String deniedTokens = UtilProperties.getPropertyValue("security", 
"deniedWebShellTokens");
         return UtilValidate.isNotEmpty(deniedTokens) ? 
StringUtil.split(deniedTokens, ",") : new ArrayList<>();
     }