(ofbiz-framework) branch trunk updated: Fixed: Issues when uploading SVG files (OFBIZ-13192)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 28bcf7463f Fixed: Issues when uploading SVG files (OFBIZ-13192)
28bcf7463f is described below

commit 28bcf7463f349ff2f69de7110baed1f227f8e167
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Mon Dec 9 06:58:05 2024 +0100

    Fixed: Issues when uploading SVG files (OFBIZ-13192)
    
    * Bypasses CSV file type checking when the file contains "</svg>"
    * Change "maxLineLength" property in security.properties from null to 10000 
and
      allows 0 bypass the "maxLineLength" check
    
    Note: SVG files are text files and may contain deniedWebShellTokens. If you 
need
    to upload SVG files the easiest way is to remove the used tokens from
    deniedWebShellTokens.
---
 framework/security/config/security.properties               |  4 ++--
 .../main/java/org/apache/ofbiz/security/SecuredUpload.java  | 13 ++++++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/framework/security/config/security.properties 
b/framework/security/config/security.properties
index 9ff639ac37..7b6561482a 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -292,8 +292,8 @@ allowedTokens=$SHA$OFBiz$2naHrANKTniFcgLJk4oXr3IRQ48
 
 allowStringConcatenationInUploadedFiles=false
 
-#-- Max line length for uploaded files, by default 10000
-maxLineLength=
+#-- Max line length for uploaded files, by default 10000. You can use 0 to 
allow any line length.
+maxLineLength=0
 
 # Allow uploading non-empty pdf files as long as they are ZUGFeRD compliant
 allowZUGFeRDCompliantUpload=true
diff --git 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 474b14cbfd..b1a06a76f7 100644
--- 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -111,7 +111,7 @@ public class SecuredUpload {
     private static final String MODULE = SecuredUpload.class.getName();
     private static final List<String> DENIEDFILEEXTENSIONS = 
getDeniedFileExtensions();
     private static final List<String> DENIEDWEBSHELLTOKENS = 
getDeniedWebShellTokens();
-    private static final Integer MAXLINELENGTH = 
UtilProperties.getPropertyAsInteger("security", "maxLineLength", 10000);
+    private static final Integer MAXLINELENGTH = 
UtilProperties.getPropertyAsInteger("security", "maxLineLength", 0);
     private static final Boolean ALLOWSTRINGCONCATENATIONINUPLOADEDFILES =
             UtilProperties.getPropertyAsBoolean("security", 
"allowStringConcatenationInUploadedFiles", false);
 
@@ -622,8 +622,12 @@ public class SecuredUpload {
         }
 
         // cf. 
https://commons.apache.org/proper/commons-csv/apidocs/org/apache/commons/csv/CSVFormat.html
-        try (CSVParser parser = new CSVParser(in, cvsFormat)) {
-            parser.getRecords();
+        if (!content.contains("</svg>")) {
+            try (CSVParser parser = new CSVParser(in, cvsFormat)) {
+                parser.getRecords();
+            }
+        } else {
+            Debug.logInfo("The file " + fileName + " is not a valid CSV file. 
For security reason it's not accepted as a such file", MODULE);
         }
         return isValidTextFile(fileName, false); // Validate content to 
prevent webshell
     }
@@ -902,6 +906,9 @@ public class SecuredUpload {
 
 
     private static boolean checkMaxLinesLength(String fileToCheck) {
+        if (MAXLINELENGTH == 0) {
+            return true;
+        }
         try {
             File file = new File(fileToCheck);
             List<String> lines = FileUtils.readLines(file, 
Charset.defaultCharset());