Author: jleroux Date: Sat Sep 14 08:21:23 2019 New Revision: 1866922 URL: http://svn.apache.org/viewvc?rev=1866922&view=rev Log: "Applied fix from trunk for revision: 1866920" ------------------------------------------------------------------------ r1866920 | jleroux | 2019-09-14 10:19:18 +0200 (sam. 14 sept. 2019) | 18 lignes
Fixed: Path Traversal in webtools/control/FetchLogs and ViewFile (OFBIZ-11196) These are not really path traversal issues. We can't solve them using the traditional way to fix path traversal issues (ie normalising path). Because Fetchlogs and ViewFile are actually reading files and if you have the right to read these files then nothing will prevent you to read them. The problem is more what those requests are supposed to do. Fetchlogs is supposed to read a log in the log dir and ViewFile is supposed to read a file containing labels (ie either an XML or Properties file). So the solution is to allow these requests to only do what they are supposed to do. This is what is done in ViewFile and FetLogs Groovy files. ------------------------------------------------------------------------ Modified: ofbiz/ofbiz-framework/branches/release17.12/ (props changed) ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/log/FetchLogs.groovy Propchange: ofbiz/ofbiz-framework/branches/release17.12/ ------------------------------------------------------------------------------ --- svn:mergeinfo (original) +++ svn:mergeinfo Sat Sep 14 08:21:23 2019 @@ -10,4 +10,4 @@ /ofbiz/branches/json-integration-refactoring:1634077-1635900 /ofbiz/branches/multitenant20100310:921280-927264 /ofbiz/branches/release13.07:1547657 -/ofbiz/ofbiz-framework/trunk:1819499,1819598,1819800,1819805,1819811,1819947,1820038,1820262,1820374-1820375,1820441,1820457,1820644,1820658,1820790,1820823,1820949,1820966,1821012,1821036,1821112,1821115,1821144,1821186,1821219,1821226,1821230,1821386,1821613,1821628,1821965,1822125,1822310,1822377,1822383,1822393,1823467,1823562,1823876,1824314,1824316,1824732,1824803,1824847,1824855,1825192,1825211,1825216,1825233,1825450,1826374,1826502,1826592,1826671,1826674,1826780,1826805,1826938,1826997,1827439,1828255,1828316,1828346,1828424,1828512,1828514,1829690,1830936,1831074,1831078,1831234,1831608,1831831,1832577,1832662,1832756,1832800,1832944,1833173,1833211,1834181,1834191,1834736,1835235,1835871,1835887,1835891,1835953,1835964,1836144,1836871,1837857,1838032,1838256,1838381,1840189,1840199,1840828,1841657,1841662,1842372,1842921,1843225,1843893,1844943,1845418,1845420,1845466,1845544,1845552,1845558,1845933,1845995,1846097,1846107,1846214,1846594,1846632,1847398,1847478,1847670, 1847715,1847890,1848263,1848336,1848386,1848398,1848441,1848444,1848447,1848449,1848467,1848469,1848745,1848849-1848850,1849021,1849165,1849191,1849193,1849275,1849467,1849528,1849540,1849567,1849693,1850015,1850023,1850530,1850647,1850685,1850694,1850914,1850918,1850948,1850953,1851006,1851068,1851074,1851130,1851158,1851163,1851200,1851247,1851319,1851350,1851805,1851998,1852587,1852818,1853070,1853109,1853691,1853745,1853750,1854306,1854457,1855078,1855287,1855371,1855403,1855488,1855492,1855497,1855501,1855898,1856405,1856455,1856459-1856460,1856484,1856598,1856617,1856667,1857088,1857099,1857173,1857180,1857213,1857392,1857617,1857692,1857813,1858035,1858250,1858256,1858275,1858319,1858432,1858444,1858523,1858539,1858965,1858980,1859033,1859055,1859087,1859255,1859263,1859543,1859571,1859576,1859691,1859694,1859698,1859704,1859708,1859735,1859796,1859800,1859807,1859871,1859877,1859882,1859915,1859931,1859968,1859972,1859981,1860082,1860141,1860274,1860357,1860526,1860592,18606 13,1860797,1861615,1861837,1861849,1861859,1861869,1862045-1862046,1862207,1862271,1862278,1862466,1862648,1863560,1864716,1864721,1864881,1864891,1864930,1865344,1865347,1865367,1865370,1865811,1865852,1865883,1865891,1865924,1866259,1866834,1866890 +/ofbiz/ofbiz-framework/trunk:1819499,1819598,1819800,1819805,1819811,1819947,1820038,1820262,1820374-1820375,1820441,1820457,1820644,1820658,1820790,1820823,1820949,1820966,1821012,1821036,1821112,1821115,1821144,1821186,1821219,1821226,1821230,1821386,1821613,1821628,1821965,1822125,1822310,1822377,1822383,1822393,1823467,1823562,1823876,1824314,1824316,1824732,1824803,1824847,1824855,1825192,1825211,1825216,1825233,1825450,1826374,1826502,1826592,1826671,1826674,1826780,1826805,1826938,1826997,1827439,1828255,1828316,1828346,1828424,1828512,1828514,1829690,1830936,1831074,1831078,1831234,1831608,1831831,1832577,1832662,1832756,1832800,1832944,1833173,1833211,1834181,1834191,1834736,1835235,1835871,1835887,1835891,1835953,1835964,1836144,1836871,1837857,1838032,1838256,1838381,1840189,1840199,1840828,1841657,1841662,1842372,1842921,1843225,1843893,1844943,1845418,1845420,1845466,1845544,1845552,1845558,1845933,1845995,1846097,1846107,1846214,1846594,1846632,1847398,1847478,1847670, 1847715,1847890,1848263,1848336,1848386,1848398,1848441,1848444,1848447,1848449,1848467,1848469,1848745,1848849-1848850,1849021,1849165,1849191,1849193,1849275,1849467,1849528,1849540,1849567,1849693,1850015,1850023,1850530,1850647,1850685,1850694,1850914,1850918,1850948,1850953,1851006,1851068,1851074,1851130,1851158,1851163,1851200,1851247,1851319,1851350,1851805,1851998,1852587,1852818,1853070,1853109,1853691,1853745,1853750,1854306,1854457,1855078,1855287,1855371,1855403,1855488,1855492,1855497,1855501,1855898,1856405,1856455,1856459-1856460,1856484,1856598,1856617,1856667,1857088,1857099,1857173,1857180,1857213,1857392,1857617,1857692,1857813,1858035,1858250,1858256,1858275,1858319,1858432,1858444,1858523,1858539,1858965,1858980,1859033,1859055,1859087,1859255,1859263,1859543,1859571,1859576,1859691,1859694,1859698,1859704,1859708,1859735,1859796,1859800,1859807,1859871,1859877,1859882,1859915,1859931,1859968,1859972,1859981,1860082,1860141,1860274,1860357,1860526,1860592,18606 13,1860797,1861615,1861837,1861849,1861859,1861869,1862045-1862046,1862207,1862271,1862278,1862466,1862648,1863560,1864716,1864721,1864881,1864891,1864930,1865344,1865347,1865367,1865370,1865811,1865852,1865883,1865891,1865924,1866259,1866834,1866890,1866920 Modified: ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy?rev=1866922&r1=1866921&r2=1866922&view=diff ============================================================================== --- ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy (original) +++ ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy Sat Sep 14 08:21:23 2019 @@ -31,7 +31,7 @@ if (parameters.fileName) { UtilXml.writeXmlDocument(document, os, "UTF-8", true, true, 4) os.close() fileString = os.toString() - } else { + } else if (parameters.fileName.endsWith(".properties")) { fileString = FileUtil.readString("UTF-8", file) } rows = fileString.split(System.getProperty("line.separator")) Modified: ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/log/FetchLogs.groovy URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/log/FetchLogs.groovy?rev=1866922&r1=1866921&r2=1866922&view=diff ============================================================================== --- ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/log/FetchLogs.groovy (original) +++ ofbiz/ofbiz-framework/branches/release17.12/framework/webtools/groovyScripts/log/FetchLogs.groovy Sat Sep 14 08:21:23 2019 @@ -42,7 +42,7 @@ for (int i = 0; i < listLogFiles.length; } context.listLogFileNames = listLogFileNames -if (parameters.logFileName) { +if (parameters.logFileName && logFileName.contains(parameters.logFileName)) { List logLines = [] try { File logFile = FileUtil.getFile(ofbizLogDir.concat(parameters.logFileName))