This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new c0592a33b3 Fixed: Enable indirect import checks and remove Object from
receivers whitelist in ProgramExport for enhanced security
c0592a33b3 is described below
commit c0592a33b31b4d1ff2904bb49e76b664086b3b63
Author: Jacopo Cappellato <[email protected]>
AuthorDate: Tue May 12 15:27:03 2026 +0200
Fixed: Enable indirect import checks and remove Object from receivers
whitelist in ProgramExport for enhanced security
---
.../main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
index 7e8e405fd0..de7b415b11 100644
---
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
+++
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
@@ -156,7 +156,7 @@ if (security.hasPermission('ENTITY_MAINT', session)) {
setStarImportsWhitelist([])
setStaticImportsWhitelist([])
setStaticStarImportsWhitelist([])
- setIndirectImportCheckEnabled(false)
+ setIndirectImportCheckEnabled(true)
// Constant types whitelist
setConstantTypesClassesWhiteList([
Object, String, Integer, Long, Float, Double, Boolean,
@@ -178,7 +178,6 @@ if (security.hasPermission('ENTITY_MAINT', session)) {
setExpressionsBlacklist([MethodPointerExpression])
// Receiver whitelist - only safe OFBiz entity operations
setReceiversWhiteList([
- 'java.lang.Object',
'org.apache.ofbiz.entity.Delegator',
'org.apache.ofbiz.entity.util.EntityQuery',
'org.apache.ofbiz.entity.util.EntityFindOptions',
