This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 66c87ad731 Fixed: noWebshellInMetadata NPEs when readMetadata can't
parse the file
66c87ad731 is described below
commit 66c87ad7316627e85350366f27e36f3b5640377a
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Aug 10 19:47:27 2026 +0530
Fixed: noWebshellInMetadata NPEs when readMetadata can't parse the file
Imaging.guessFormat() only checks a file's magic number, so a malformed
file that still starts with a valid PNG/JPEG/GIF/TIFF signature reaches
noWebshellInMetadata(). When ImageMetadataReader.readMetadata() then
fails to parse it, metadata stayed null and the following
metadata.getDirectories() call threw an unhandled NullPointerException
instead of rejecting the upload cleanly. Confirmed with a minimal
8-byte file containing only the PNG signature. Returns false in the
catch block so the file is rejected the same way any other unparseable
upload is.
---
.../security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java | 1 +
1 file changed, 1 insertion(+)
diff --git
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index ae4f33920f..ae8d0f0700 100644
---
a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++
b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -672,6 +672,7 @@ public class SecuredUpload {
metadata = ImageMetadataReader.readMetadata(file);
} catch (ImageProcessingException | IOException error) {
Debug.logError("================== Not saved for security reason
==================" + error, MODULE);
+ return false;
}
for (Directory directory : metadata.getDirectories()) {
