(ofbiz-framework) branch trunk updated: Fixed: PDF upload accepted embedded attachments when ZUGFeRD upload was disabled (OFBIZ-13485) (#1573)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 55a3879895 Fixed: PDF upload accepted embedded attachments when 
ZUGFeRD upload was disabled (OFBIZ-13485) (#1573)
55a3879895 is described below

commit 55a3879895057c81841b6ef2eb29ed7ed72b6f51
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Fri Aug 7 10:45:40 2026 +0530

    Fixed: PDF upload accepted embedded attachments when ZUGFeRD upload was 
disabled (OFBIZ-13485) (#1573)
    
    Fixed: PDF upload accepted embedded attachments when ZUGFeRD upload was 
disabled (OFBIZ-13485)
    
    canParseZUGFeRD was initialized to true and only ever reset to false inside 
the ZUGFeRD-compliant-upload branch. When allowZUGFeRDCompliantUpload=false, 
that branch never ran, so any PDF containing embedded files of any] type was 
reported safe regardless of content. Initializing canParseZUGFeRD to false 
restores fail-closed behavior for that path.
    
    Also fixes a related regression: in the secure ZUGFeRD sub-mode 
(allowZUGFeRDnotSecure=false), canParseZUGFeRD was never set back to true on 
successful XML validation, so legitimate ZUGFeRD invoices were always rejected 
under the shipped defaults.
---
 .../src/main/java/org/apache/ofbiz/security/SecuredUpload.java        | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 8a1e72c74b..1432cc1f00 100644
--- 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -1022,7 +1022,7 @@ public class SecuredUpload {
         }
         File file = new File(fileName);
         boolean safeState = false;
-        boolean canParseZUGFeRD = true;
+        boolean canParseZUGFeRD = false;
         try {
             if (Objects.isNull(file) || !file.exists()) {
                 return safeState;
@@ -1061,6 +1061,8 @@ public class SecuredUpload {
                                         + " is not a readable (valid and 
secure) PDF file. For security reason it's not accepted as a such file",
                                         MODULE);
 
+                            } else {
+                                canParseZUGFeRD = true;
                             }
                         } catch (SAXException | ParserConfigurationException | 
IOException e) {
                             safeState = false;