This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new f7f0d7cc13 Improved: Prevent possible post-auth RCE from
webtools/control/ProgramExport (OFBIZ-12055)
f7f0d7cc13 is described below
commit f7f0d7cc1375888026f0c9d21658ff34f2d46492
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Thu Apr 11 10:41:17 2024 +0200
Improved: Prevent possible post-auth RCE from
webtools/control/ProgramExport (OFBIZ-12055)
Adds 3 tokens: execute,println,calc
---
framework/security/config/security.properties | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/framework/security/config/security.properties
b/framework/security/config/security.properties
index 63407fc306..a5fb32f108 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -277,7 +277,8 @@
deniedWebShellTokens=java.,beans,freemarker,<script,javascript,<body,body ,<form
%eval,@eval,eval(,runtime,import,passthru,shell_exec,assert,str_rot13,system,decode,include,page
,\
chmod,mkdir,fopen,fclose,new
file,upload,getfilename,download,getoutputstring,readfile,iframe,object,embed,onload,build,\
python,perl ,/perl,ruby
,/ruby,process,function,class,InputStream,to_server,wget
,static,assign,webappPath,\
- ifconfig,route,crontab,netstat,uname
,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost,thread,require,gzdeflate
+ ifconfig,route,crontab,netstat,uname
,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost,thread,require,gzdeflate,\
+ execute,println,calc
allowStringConcatenationInUploadedFiles=false
