This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 832db7446e Improved: Strip the control characters from the Location
header of the redirects of RequestHandler and of the SEO forward filters
(OFBIZ-13650)
832db7446e is described below
commit 832db7446e5403c2aebd97cc3453054da9372595
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Oct 6 20:44:14 2026 +0530
Improved: Strip the control characters from the Location header of the
redirects of RequestHandler and of the SEO forward filters (OFBIZ-13650)
RequestHandler.callRedirect set the Location header from a URL that can
contain values of the request (the decoded path info of the redirect to the
secure channel and of the saved previous request used after a login), and
SeoContextFilter.forwardUri and UrlRegexpTransform.forwardUri set it from the
request URI, so a carriage return or a line feed in such a value could end up
in the header. Tomcat replaces these characters when it writes the header, so
this is not exploitable today, bu [...]
- Add UtilHttp.stripControlCharacters, which removes the control characters
of a value that is going to be set in a response header.
- Use it in RequestHandler.callRedirect, for the header and for the log
message, and in the three places of SeoContextFilter and UrlRegexpTransform
that set the Location header.
---
.../org/apache/ofbiz/product/category/SeoContextFilter.java | 4 ++--
.../apache/ofbiz/product/category/ftl/UrlRegexpTransform.java | 3 ++-
.../src/main/java/org/apache/ofbiz/base/util/UtilHttp.java | 10 ++++++++++
.../java/org/apache/ofbiz/webapp/control/RequestHandler.java | 6 ++++--
4 files changed, 18 insertions(+), 5 deletions(-)
diff --git
a/applications/product/src/main/java/org/apache/ofbiz/product/category/SeoContextFilter.java
b/applications/product/src/main/java/org/apache/ofbiz/product/category/SeoContextFilter.java
index 9e5298cfe2..537efaf066 100644
---
a/applications/product/src/main/java/org/apache/ofbiz/product/category/SeoContextFilter.java
+++
b/applications/product/src/main/java/org/apache/ofbiz/product/category/SeoContextFilter.java
@@ -220,7 +220,7 @@ public final class SeoContextFilter implements Filter {
} else {
// redirect with url change in browser
httpResponse.setStatus(SeoConfigUtil.getDefaultResponseCode());
- httpResponse.setHeader("Location", redirectPath);
+ httpResponse.setHeader("Location",
UtilHttp.stripControlCharacters(redirectPath));
}
}
Debug.logWarning(filterMessage, MODULE);
@@ -278,7 +278,7 @@ public final class SeoContextFilter implements Filter {
} else {
response.setStatus(responseCodeInt);
}
- response.setHeader("Location", uri);
+ response.setHeader("Location",
UtilHttp.stripControlCharacters(uri));
} else {
Debug.logInfo("Can NOT forward this url: " + uri, MODULE);
}
diff --git
a/applications/product/src/main/java/org/apache/ofbiz/product/category/ftl/UrlRegexpTransform.java
b/applications/product/src/main/java/org/apache/ofbiz/product/category/ftl/UrlRegexpTransform.java
index 494f4e4149..510ff6329a 100644
---
a/applications/product/src/main/java/org/apache/ofbiz/product/category/ftl/UrlRegexpTransform.java
+++
b/applications/product/src/main/java/org/apache/ofbiz/product/category/ftl/UrlRegexpTransform.java
@@ -30,6 +30,7 @@ import jakarta.servlet.http.HttpSession;
import org.apache.ofbiz.base.component.ComponentConfig;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.UtilHttp;
import org.apache.ofbiz.base.util.template.FreeMarkerWorker;
import org.apache.ofbiz.entity.Delegator;
import org.apache.ofbiz.entity.GenericEntityException;
@@ -287,7 +288,7 @@ public class UrlRegexpTransform implements
TemplateTransformModel {
} else {
response.setStatus(responseCodeInt);
}
- response.setHeader("Location", uri);
+ response.setHeader("Location",
UtilHttp.stripControlCharacters(uri));
} else {
Debug.logInfo("Can NOT forward this url: " + uri, MODULE);
}
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
index 6720f4d8bc..9c05f3248a 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHttp.java
@@ -1641,6 +1641,16 @@ public final class UtilHttp {
return (session == null ? "unknown" : session.getId());
}
+ /**
+ * Removes the control characters, such as the carriage return and the
line feed, from a value that is going to
+ * be set in a response header, so that the value cannot end the header or
add another one.
+ * @param value the value to clean, may be null
+ * @return the value without control characters, or null if the value is
null
+ */
+ public static String stripControlCharacters(String value) {
+ return value == null ? null : value.replaceAll("\\p{Cntrl}", "");
+ }
+
/**
* Returns true if the user has JavaScript enabled.
* @param request
diff --git
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
index 9ed6e27eb2..b9a7439899 100644
---
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
+++
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
@@ -264,8 +264,10 @@ public final class RequestHandler {
private static void callRedirect(String url, HttpServletResponse resp,
HttpServletRequest req, String statusCodeString)
throws RequestHandlerException {
+ // the url may contain values of the request, keep any control
character out of the header and the log
+ String location = UtilHttp.stripControlCharacters(url);
if (Debug.infoOn()) {
- Debug.logInfo("Sending redirect to: [" + url + "]. " +
showSessionId(req), MODULE);
+ Debug.logInfo("Sending redirect to: [" + location + "]. " +
showSessionId(req), MODULE);
}
// set the attributes in the session so we can access it.
Enumeration<String> attributeNameEnum =
UtilGenerics.cast(req.getAttributeNames());
@@ -303,7 +305,7 @@ public final class RequestHandler {
// send the redirect
try {
resp.setStatus(statusCode);
- resp.setHeader("Location", url);
+ resp.setHeader("Location", location);
resp.setHeader("Connection", "close");
} catch (IllegalStateException ise) {
throw new RequestHandlerException(ise.getMessage(), ise);
