This is an automated email from the ASF dual-hosted git repository.
Lukas-Finster pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new cba41c7b63 Improved: hardens validation of screen location
cba41c7b63 is described below
commit cba41c7b6340c2749613cfecf03a683316cf247f
Author: Lukas Finster <[email protected]>
AuthorDate: Wed Jul 29 11:55:48 2026 +0200
Improved: hardens validation of screen location
---
.../org/apache/ofbiz/base/util/UtilValidate.java | 23 ++++++++++++++++++++++
.../apache/ofbiz/widget/model/ScreenFactory.java | 9 +++++++--
2 files changed, 30 insertions(+), 2 deletions(-)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
index d0f86e8698..4a9b3d96b8 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
@@ -18,6 +18,8 @@
*******************************************************************************/
package org.apache.ofbiz.base.util;
+import java.nio.file.Path;
+import java.nio.file.Paths;
import java.sql.Timestamp;
import java.util.Collection;
import java.util.Map;
@@ -153,6 +155,9 @@ public final class UtilValidate {
public static final String CONTIGUOUS_US_STATE_CODES =
"AL|AZ|AR|CA|CO|CT|DE|DC|FL|GA|ID|IL|IN|IA|KS|KY|LA|ME|MD|MA|MI|MN|MS|MO|MT|NE|NV|NH|"
+ "NJ|NM|NY|NC|ND|OH|OK|OR|PA|RI|SC|SD|TN|TX|UT|VT|VA|WA|WV|WI|WY";
+ /** Paths from which loading files should be prevented */
+ public static final String[] BLOCKED_PATHS = {"proc/self/fd"};
+
/** Check whether an object is empty, will see if it is a String, Map,
Collection, etc. */
public static boolean isEmpty(Object o) {
return ObjectType.isEmpty(o);
@@ -656,6 +661,24 @@ public final class UtilValidate {
return UrlValidator.getInstance().isValid(s);
}
+ /**
+ * isBlockedPath takes a String representing a filePath, normalizes it and
checks it against a Blacklist
+ * @param rawPathString
+ * @return true if its a blocked path, false otherwise or if it is empty
+ */
+ public static boolean isBlockedPath(String rawPathString) {
+ if (UtilValidate.isEmpty(rawPathString)) {
+ return false;
+ }
+ Path normalized = Paths.get(rawPathString).normalize();
+ String normalizedPath = normalized.toString();
+ for (String blocked : BLOCKED_PATHS) {
+ if (normalizedPath.contains(blocked)) {
+ return true;
+ }
+ }
+ return false;
+ }
/** isYear returns true if string s is a valid
* Year number. Must be 2 or 4 digits only.
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ScreenFactory.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ScreenFactory.java
index 21369cd0c2..9c540abafe 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ScreenFactory.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ScreenFactory.java
@@ -24,8 +24,6 @@ import java.util.HashMap;
import java.util.List;
import java.util.Map;
-import jakarta.servlet.ServletContext;
-import jakarta.servlet.http.HttpServletRequest;
import javax.xml.parsers.ParserConfigurationException;
import org.apache.ofbiz.base.location.FlexibleLocation;
@@ -40,6 +38,9 @@ import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.xml.sax.SAXException;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.http.HttpServletRequest;
+
/**
* Widget Library - Screen factory class
@@ -197,6 +198,10 @@ public class ScreenFactory {
ModelScreen modelScreen = null;
if (UtilValidate.isNotEmpty(location)) {
+ if (UtilValidate.isBlockedPath(location)) {
+ Debug.logWarning("The location of screen [%s] is on a blocked
Path. Abbort rendering. Raw location [%s]", MODULE, name, location);
+ throw new IllegalArgumentException("Abort screenrendering due
to screenlocation pointing to a blocked path");
+ }
try {
modelScreen = ScreenFactory.getScreenFromLocation(location,
name);
} catch (IOException | SAXException | ParserConfigurationException
e) {
