[ofbiz-framework] branch trunk updated: Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) (#352)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 05bd9ca  Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) 
(#352)
05bd9ca is described below

commit 05bd9caf1210e923d903348f7170dcbca175df8e
Author: rohitkou <93367235+rohit...@users.noreply.github.com>
AuthorDate: Tue Nov 23 15:05:41 2021 +0530

    Fixed: CVE-2021-37608 vulnerability bypass (OFBIZ-12307) (#352)
    
    Fixed the Additional image uploading issue which got somehow missed in 
service addAdditionalViewForProduct.
    
    Co-authored-by: Rohit Koushal <rohit.kousha...@gmail.com>
---
 .../main/java/org/apache/ofbiz/product/product/ProductServices.java  | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git 
a/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductServices.java
 
b/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductServices.java
index 122c307..3ad89f0 100644
--- 
a/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductServices.java
+++ 
b/applications/product/src/main/java/org/apache/ofbiz/product/product/ProductServices.java
@@ -1077,10 +1077,13 @@ public class ProductServices {
                 String fileToCheck = imageServerPath + "/" + fileLocation + 
"." + extension.getString("fileExtensionId");
                 File file = new File(fileToCheck);
                 try {
-                    if 
(!org.apache.ofbiz.security.SecuredUpload.isValidFile(fileToCheck, "Image", 
delegator)) {
+                    Path tempFile = Files.createTempFile(null, null);
+                    Files.write(tempFile, imageData.array(), 
StandardOpenOption.APPEND);
+                    if 
(!org.apache.ofbiz.security.SecuredUpload.isValidFile(tempFile.toString(), 
"Image", delegator)) {
                         String errorMessage = 
UtilProperties.getMessage("SecurityUiLabels", "SupportedImageFormats", locale);
                         return ServiceUtil.returnError(errorMessage);
                     }
+                    Files.delete(tempFile);
                     RandomAccessFile out = new RandomAccessFile(fileToCheck, 
"rw");
                     out.write(imageData.array());
                     out.close();