This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 37345ed4f1 Fixed: isExecutable() missed Tika's ELF sub-types, letting
real Linux binaries through the check (OFBIZ-13486)
37345ed4f1 is described below
commit 37345ed4f1e2eb421f988cb789646fabe86a5685
Author: Mridul Pathak <[email protected]>
AuthorDate: Fri Aug 7 23:20:31 2026 +0530
Fixed: isExecutable() missed Tika's ELF sub-types, letting real Linux
binaries through the check (OFBIZ-13486)
SecuredUpload.isExecutable() only matched the generic mimeType
application/x-elf, but Tika (verified against tika-core:3.3.1) classifies real
ELF binaries into more specific sub-types instead — application/x-executable,
application/x -sharedlib, application/x-object, application/x-coredump — so
actual executables and shared libraries passed the check undetected. Confirmed
with two real ELF files (a JNA native .so and a JDK's bin/java PIE executable),
both detected as application/x-sha [...]
---
.../src/main/java/org/apache/ofbiz/security/SecuredUpload.java | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index f608795d19..dc10140416 100644
---
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -1130,8 +1130,14 @@ public class SecuredUpload {
Debug.logError("The file " + fileName + " is a Windows executable,
for security reason it's not accepted", MODULE);
return true;
}
- // Check for ELF (Linux) and scripts
+ // Check for ELF (Linux) and scripts. Tika reports the generic
application/x-elf only for
+ // ELF files it can't further classify; real-world binaries are
detected as one of its
+ // more specific sub-types below (e.g. every PIE-compiled executable
or shared library).
if ("application/x-elf".equals(mimeType)
+ || "application/x-executable".equals(mimeType)
+ || "application/x-sharedlib".equals(mimeType)
+ || "application/x-object".equals(mimeType)
+ || "application/x-coredump".equals(mimeType)
|| "application/x-sh".equals(mimeType)
|| "text/x-perl".equals(mimeType)
|| "text/x-ruby".equals(mimeType)
