This is an automated email from the ASF dual-hosted git repository. jleroux pushed a commit to branch release18.12 in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release18.12 by this push: new 40e525a Fixed: Secure the uploads (OFBIZ-12080) 40e525a is described below commit 40e525aba49f29ff1c950a0887c0f49d829ce178 Author: Jacques Le Roux <jacques.le.r...@les7arts.com> AuthorDate: Fri Feb 18 15:32:31 2022 +0100 Fixed: Secure the uploads (OFBIZ-12080) In previous comment, to prevent linked images inside SVG I used xlink:href That's no good, it must be followed by <<="http">>, this does it. Else a lot of SVP images would not be loadable. Because xlink:href can be used in other cases. --- .../security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java index d56482b..e863276 100644 --- a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java +++ b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java @@ -657,7 +657,7 @@ public class SecuredUpload { } } String content = new String(bytesFromFile); - if (content.toLowerCase().contains("xlink:href")) { + if (content.toLowerCase().contains("xlink:href=\"http")) { Debug.logError("Linked images inside SVG are not allowed for security reason", MODULE); return false; }