This is an automated email from the ASF dual-hosted git repository. jleroux pushed a commit to branch release18.12 in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release18.12 by this push: new c638ec2 Fixed: Secure the uploads (OFBIZ-12080) c638ec2 is described below commit c638ec26f8a0d2b78f1f275dcc5ff934e3019a30 Author: Jacques Le Roux <jacques.le.r...@les7arts.com> AuthorDate: Mon Feb 21 17:02:12 2022 +0100 Fixed: Secure the uploads (OFBIZ-12080) Trivial change in DataServices.java: uses the SecuredUpload import in 2 places it was missing. Adds some tokens in security.properties::deniedWebShellTokens Removes a duplicated htaccess in security.properties::deniedFileExtensions --- .../src/main/java/org/apache/ofbiz/content/data/DataServices.java | 4 ++-- framework/security/config/security.properties | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java index cec71ac..96a4b3f 100644 --- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java +++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java @@ -205,7 +205,7 @@ public class DataServices { File file = new File(fileNameAndPath); if (!originalFileName.isEmpty()) { // Check the file name - if (!org.apache.ofbiz.security.SecuredUpload.isValidFileName(originalFileName, delegator)) { + if (!SecuredUpload.isValidFileName(originalFileName, delegator)) { String errorMessage = UtilProperties.getMessage("SecurityUiLabels", "SupportedFileFormatsIncludingSvg", locale); return ServiceUtil.returnError(errorMessage); } @@ -213,7 +213,7 @@ public class DataServices { // We would just have a better error message if (file.exists()) { // Check if a webshell is not uploaded - if (!org.apache.ofbiz.security.SecuredUpload.isValidFile(fileNameAndPath, "All", delegator)) { + if (!SecuredUpload.isValidFile(fileNameAndPath, "All", delegator)) { String errorMessage = UtilProperties.getMessage("SecurityUiLabels", "SupportedFileFormatsIncludingSvg", locale); return ServiceUtil.returnError(errorMessage); } diff --git a/framework/security/config/security.properties b/framework/security/config/security.properties index b11ec6a..70fb232 100644 --- a/framework/security/config/security.properties +++ b/framework/security/config/security.properties @@ -209,7 +209,7 @@ templateClassResolver= #-- List of denied files suffixes to be uploaded #-- OFBiz of course also check contents... deniedFileExtensions=html,htm,php,php1,php2,hph3,php4,php5,php6,php7,phps,asp,aspx,asa,asax,ascx,ashx,asmx,jsp,jspa,jspx,jsw,jsv,jspf,jtml,cfm,cfc,bat,exe,com,dll,\ - vbs,js,reg,cgi,htaccess,asis,sh,phtm,pht,phtml,shtm,inc,asp,cdx,asa,cer,py,pl,shtml,hta,ps1,tag,pgif,htaccess,phar,inc,cgi,wss,do,action + vbs,js,reg,cgi,asis,sh,phtm,pht,phtml,shtm,inc,asp,cdx,asa,cer,py,pl,shtml,hta,ps1,tag,pgif,htaccess,phar,inc,cgi,wss,do,action #-- #-- The upload vulnerability is only a post-auth (needs a credential with suitable permissions), #-- people may like to allow more than what is allowed OOTB @@ -221,11 +221,11 @@ allowAllUploads= #-- "freemarker" should be OK, should not be used in Freemarker templates, not part of the syntax. #-- Else "template.utility.Execute" is a good replacement but not as much catching, who knows... #-- If you are sure you are safe for a token you can remove it, etc. -deniedWebShellTokens=freemarker,<script,javascript,<body,<form,<jsp:,<c:out,taglib,<prefix,<%@ page,\ +deniedWebShellTokens=freemarker,<script,javascript,<body,<form,<jsp:,<c:out,taglib,<prefix,<%@ page,<?php,exec(\ %eval,@eval,eval(,runtime,import,passthru,shell_exec,assert,str_rot13,system,decode,include,page ,\ chmod,mkdir,fopen,fclose,new file,upload,getfilename,download,getoutputstring,readfile,\ - python,perl ,/perl,ruby ,/ruby,process,function,class,InputStream,to_server,\ - ifconfig,route,crontab,netstat,uname,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd| + python,perl ,/perl,ruby ,/ruby,process,function,class,InputStream,to_server,wget,\ + ifconfig,route,crontab,netstat,uname,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost #-- Max line length for uploaded files, by default 10000