This is an automated email from the ASF dual-hosted git repository.
golja pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new c1b4bd4f4c Improved: hardens validation of screen location
c1b4bd4f4c is described below
commit c1b4bd4f4c5c1dc137e0f1407874d43b4ad1ca27
Author: Lukas Finster <[email protected]>
AuthorDate: Wed Jul 29 11:55:48 2026 +0200
Improved: hardens validation of screen location
(cherry picked from commit cba41c7b6340c2749613cfecf03a683316cf247f)
---
.../org/apache/ofbiz/base/util/UtilValidate.java | 23 ++++++++++++++++++++++
.../apache/ofbiz/widget/model/ScreenFactory.java | 4 ++++
2 files changed, 27 insertions(+)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
index 3be7d81ba2..3feda0787e 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
@@ -18,6 +18,8 @@
*******************************************************************************/
package org.apache.ofbiz.base.util;
+import java.nio.file.Path;
+import java.nio.file.Paths;
import java.sql.Timestamp;
import java.util.Collection;
import java.util.Map;
@@ -153,6 +155,9 @@ public final class UtilValidate {
public static final String CONTIGUOUS_US_STATE_CODES =
"AL|AZ|AR|CA|CO|CT|DE|DC|FL|GA|ID|IL|IN|IA|KS|KY|LA|ME|MD|MA|MI|MN|MS|MO|MT|NE|NV|NH|"
+ "NJ|NM|NY|NC|ND|OH|OK|OR|PA|RI|SC|SD|TN|TX|UT|VT|VA|WA|WV|WI|WY";
+ /** Paths from which loading files should be prevented */
+ public static final String[] BLOCKED_PATHS = {"proc/self/fd"};
+
/** Check whether an object is empty, will see if it is a String, Map,
Collection, etc. */
public static boolean isEmpty(Object o) {
return ObjectType.isEmpty(o);
@@ -656,6 +661,24 @@ public final class UtilValidate {
return UrlValidator.getInstance().isValid(s);
}
+ /**
+ * isBlockedPath takes a String representing a filePath, normalizes it and
checks it against a Blacklist
+ * @param rawPathString
+ * @return true if its a blocked path, false otherwise or if it is empty
+ */
+ public static boolean isBlockedPath(String rawPathString) {
+ if (UtilValidate.isEmpty(rawPathString)) {
+ return false;
+ }
+ Path normalized = Paths.get(rawPathString).normalize();
+ String normalizedPath = normalized.toString();
+ for (String blocked : BLOCKED_PATHS) {
+ if (normalizedPath.contains(blocked)) {
+ return true;
+ }
+ }
+ return false;
+ }
/** isYear returns true if string s is a valid
* Year number. Must be 2 or 4 digits only.
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ScreenFactory.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ScreenFactory.java
index 549075c926..60ac552f6e 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ScreenFactory.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/ScreenFactory.java
@@ -197,6 +197,10 @@ public class ScreenFactory {
ModelScreen modelScreen = null;
if (UtilValidate.isNotEmpty(location)) {
+ if (UtilValidate.isBlockedPath(location)) {
+ Debug.logWarning("The location of screen [%s] is on a blocked
Path. Abbort rendering. Raw location [%s]", MODULE, name, location);
+ throw new IllegalArgumentException("Abort screenrendering due
to screenlocation pointing to a blocked path");
+ }
try {
modelScreen = ScreenFactory.getScreenFromLocation(location,
name);
} catch (IOException | SAXException | ParserConfigurationException
e) {
