(ofbiz-framework) branch release24.09 updated: Fixed: PDF upload accepted embedded attachments when ZUGFeRD upload was disabled (OFBIZ-13485)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new edf5dbc2ca Fixed: PDF upload accepted embedded attachments when 
ZUGFeRD upload was disabled (OFBIZ-13485)
edf5dbc2ca is described below

commit edf5dbc2ca0a88fff7ddb3d835084f184227a860
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Fri Aug 7 10:47:19 2026 +0530

    Fixed: PDF upload accepted embedded attachments when ZUGFeRD upload was 
disabled (OFBIZ-13485)
    
    canParseZUGFeRD was initialized to true and only ever reset to false inside 
the ZUGFeRD-compliant-upload branch. When allowZUGFeRDCompliantUpload=false, 
that branch never ran, so any PDF containing embedded files of any type was 
reported safe regardless of content. Initializing canParseZUGFeRD to false 
restores fail-closed behavior for that path.
    
    Also fixes a related regression: in the secure ZUGFeRD sub-mode 
(allowZUGFeRDnotSecure=false), canParseZUGFeRD was never set back to true on 
successful XML validation, so legitimate ZUGFeRD invoices were always rejected 
under the shipped defaults.
    
    Backported from trunk (#1573).
---
 .../src/main/java/org/apache/ofbiz/security/SecuredUpload.java        | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index b5110a1560..b3440ac061 100644
--- 
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ 
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -1003,7 +1003,7 @@ public class SecuredUpload {
     private static boolean isValidPdfFile(String fileName) {
         File file = new File(fileName);
         boolean safeState = false;
-        boolean canParseZUGFeRD = true;
+        boolean canParseZUGFeRD = false;
         try {
             if (Objects.isNull(file) || !file.exists()) {
                 return safeState;
@@ -1040,6 +1040,8 @@ public class SecuredUpload {
                                         + " is not a readable (valid and 
secure) PDF file. For security reason it's not accepted as a such file",
                                         MODULE);
 
+                            } else {
+                                canParseZUGFeRD = true;
                             }
                         } catch (SAXException | ParserConfigurationException | 
IOException e) {
                             safeState = false;