[ofbiz-framework] branch release17.12 updated: Fixed: Prevent FreeMarker Template Injection (SSTI)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release17.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release17.12 by this push:
     new dc60f6f  Fixed: Prevent FreeMarker Template Injection (SSTI)
dc60f6f is described below

commit dc60f6fdb35e46cd538489386b4364f6e5369e21
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Sat May 16 20:56:54 2020 +0200

    Fixed: Prevent FreeMarker Template Injection (SSTI)
    
    (OFBIZ-11709)
    
    Since Freemarker 2.3.17 a known solution to these issues is to register a
    TemplateClassResolver in Freemarker configuration in order to limit which
    TemplateModels can be instantiated in the templates. The predefined resolver
    SAFER_RESOLVER doesn't allow to instantiate the Execute class[4].
    
    So the solution is to add the line
        
newConfig.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
    in FreeMarkerWorker.java
---
 .../main/java/org/apache/ofbiz/base/util/template/FreeMarkerWorker.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/template/FreeMarkerWorker.java
 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/template/FreeMarkerWorker.java
index 4801448..6c45127 100644
--- 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/template/FreeMarkerWorker.java
+++ 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/template/FreeMarkerWorker.java
@@ -49,6 +49,7 @@ import freemarker.cache.StringTemplateLoader;
 import freemarker.cache.TemplateLoader;
 import freemarker.cache.URLTemplateLoader;
 import freemarker.core.Environment;
+import freemarker.core.TemplateClassResolver;
 import freemarker.ext.beans.BeanModel;
 import freemarker.ext.beans.BeansWrapper;
 import freemarker.ext.beans.BeansWrapperBuilder;
@@ -115,6 +116,7 @@ public final class FreeMarkerWorker {
         } catch (TemplateException e) {
             Debug.logError("Unable to set date/time and number formats in 
FreeMarker: " + e, module);
         }
+        
newConfig.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
         // Transforms properties file set up as key=transform name, 
property=transform class name
         ClassLoader loader = Thread.currentThread().getContextClassLoader();
         Enumeration<URL> resources;