This is an automated email from the ASF dual-hosted git repository. mridulpathak pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 46d7803791a1036457fe6a08a09ce4e36ccd9180 Author: Mridul Pathak <[email protected]> AuthorDate: Sun Oct 18 22:39:10 2026 +0530 Fixed: Check every URL parameter value for markup in ControlFilter ControlFilter rejected a request whose parameter value contained "<", but the result for each parameter replaced the previous one, so only the last parameter checked counted. Any such parameter now rejects the request. Only the parameters passed in the URL (query string and path) are checked, so form bodies that legitimately contain markup, such as HTML content, are accepted. --- .../main/java/org/apache/ofbiz/webapp/control/ControlFilter.java | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java index 3694e7f701..aaf7139a8d 100644 --- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java +++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java @@ -164,7 +164,8 @@ public class ControlFilter extends HttpFilter { if (!(isControlFilterTests() || isEntityImport || isProgramExport)) { // Prevents stream exploitation UrlServletHelper.setRequestAttributes(req, null, req.getServletContext()); - Map<String, Object> parameters = UtilHttp.getParameterMap(req); + // Only the parameters passed in the URL are checked, a form body can legitimately contain markup + Map<String, Object> parameters = UtilHttp.getUrlOnlyParameterMap(req); boolean reject = false; if (!parameters.isEmpty()) { for (String key : parameters.keySet()) { @@ -174,8 +175,9 @@ public class ControlFilter extends HttpFilter { List<String> toCheck = object.getClass().equals(String.class) ? List.of((String) object) : UtilGenerics.checkCollection(object, String.class); - reject = toCheck.stream() - .anyMatch(val -> val.contains("<")); + if (toCheck.stream().anyMatch(val -> val.contains("<"))) { + reject = true; + } } catch (IllegalArgumentException e) { Debug.logWarning(e, MODULE); reject = true;
