This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 7b8bc02d31 Fixed: noWebshellInMetadata NPEs when readMetadata can't
parse the file
7b8bc02d31 is described below
commit 7b8bc02d31089601676dc65fbd822098790611be
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Aug 10 19:47:27 2026 +0530
Fixed: noWebshellInMetadata NPEs when readMetadata can't parse the file
Imaging.guessFormat() only checks a file's magic number, so a malformed
file that still starts with a valid PNG/JPEG/GIF/TIFF signature reaches
noWebshellInMetadata(). When ImageMetadataReader.readMetadata() then
fails to parse it, metadata stayed null and the following
metadata.getDirectories() call threw an unhandled NullPointerException
instead of rejecting the upload cleanly. Confirmed with a minimal
8-byte file containing only the PNG signature. Returns false in the
catch block so the file is rejected the same way any other unparseable
upload is.
---
.../security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java | 1 +
1 file changed, 1 insertion(+)
diff --git
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index dc10140416..363a658be0 100644
---
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -686,6 +686,7 @@ public class SecuredUpload {
metadata = ImageMetadataReader.readMetadata(file);
} catch (ImageProcessingException | IOException error) {
Debug.logError("================== Not saved for security reason
==================" + error, MODULE);
+ return false;
}
for (Directory directory : metadata.getDirectories()) {
