This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 1fbfa23e08 Fixed: Enable indirect import checks and remove Object from
receivers whitelist in ProgramExport for enhanced security
1fbfa23e08 is described below
commit 1fbfa23e0843032ecd4025ce77adaab765c82033
Author: Jacopo Cappellato <[email protected]>
AuthorDate: Tue May 12 15:27:03 2026 +0200
Fixed: Enable indirect import checks and remove Object from receivers
whitelist in ProgramExport for enhanced security
(cherry picked from commit c0592a33b31b4d1ff2904bb49e76b664086b3b63)
---
.../main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
index 7e8e405fd0..de7b415b11 100644
---
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
+++
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
@@ -156,7 +156,7 @@ if (security.hasPermission('ENTITY_MAINT', session)) {
setStarImportsWhitelist([])
setStaticImportsWhitelist([])
setStaticStarImportsWhitelist([])
- setIndirectImportCheckEnabled(false)
+ setIndirectImportCheckEnabled(true)
// Constant types whitelist
setConstantTypesClassesWhiteList([
Object, String, Integer, Long, Float, Double, Boolean,
@@ -178,7 +178,6 @@ if (security.hasPermission('ENTITY_MAINT', session)) {
setExpressionsBlacklist([MethodPointerExpression])
// Receiver whitelist - only safe OFBiz entity operations
setReceiversWhiteList([
- 'java.lang.Object',
'org.apache.ofbiz.entity.Delegator',
'org.apache.ofbiz.entity.util.EntityQuery',
'org.apache.ofbiz.entity.util.EntityFindOptions',
