(ofbiz-framework) branch trunk updated: Improved: add permission and path checks to XmlDsDump.groovy (#1712)

[ashish]

This is an automated email from the ASF dual-hosted git repository.

ashishvijaywargiya pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new c9a27ad03a Improved: add permission and path checks to 
XmlDsDump.groovy (#1712)
c9a27ad03a is described below

commit c9a27ad03a44262adf46667152cb2fa244177573
Author: Krishna Uprit <krishna.collage.offic...@gmail.com>
AuthorDate: Mon Aug 24 12:09:23 2026 +0530

    Improved: add permission and path checks to XmlDsDump.groovy (#1712)
    
    - Added a permission check at the top of the script, matching the
    pattern used by sibling scripts and the equivalent Java export service
    in this package.
    
    - Added destination path validation (via
    SecurityUtil.checkOfbizFileAllowList) for both the single-file and
    directory export branches, before any file/directory write happens.
    
    Thank you Krishna Uprit for your contribution.
    
    ---------
    
    Co-authored-by: Krishnauprit18 <krishnaupri...@users.noreply.github.com>
---
 .../apache/ofbiz/webtools/entity/XmlDsDump.groovy  | 33 +++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git 
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/XmlDsDump.groovy
 
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/XmlDsDump.groovy
index 861d871c77..513e5dc736 100644
--- 
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/XmlDsDump.groovy
+++ 
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/XmlDsDump.groovy
@@ -19,6 +19,7 @@
 package org.apache.ofbiz.webtools.entity
 
 import org.apache.ofbiz.base.util.Debug
+import org.apache.ofbiz.base.util.GeneralException
 import org.apache.ofbiz.base.util.UtilFormatOut
 import org.apache.ofbiz.entity.condition.EntityComparisonOperator
 import org.apache.ofbiz.entity.condition.EntityCondition
@@ -26,6 +27,15 @@ import org.apache.ofbiz.entity.condition.EntityJoinOperator
 import org.apache.ofbiz.entity.model.ModelViewEntity
 import org.apache.ofbiz.entity.transaction.TransactionUtil
 import org.apache.ofbiz.entity.util.EntityQuery
+import org.apache.ofbiz.security.SecurityUtil
+
+// Kept in sync with the permission check the page's own decorator and 
template already
+// perform (CommonScreens.xml#CommonImportExportDecorator, XmlDsDump.ftl); 
this script must
+// not run its logic -- especially the file/directory writes further down -- 
ahead of that
+// check, since screen actions run unconditionally, before any widget-level 
permission gate.
+if (!security.hasPermission('ENTITY_MAINT', session)) {
+    return
+}
 
 outpath = parameters.outpath
 filename = parameters.filename
@@ -197,7 +207,18 @@ if (passedEntityNames) {
             if (outpath && !(filename.contains('/') && 
filename.contains('\\'))) {
                 filename = outpath + File.separator + filename
             }
-            writer = new PrintWriter(new BufferedWriter(new 
OutputStreamWriter(new FileOutputStream(filename), 'UTF-8')))
+            File outfile = new File(filename)
+            allowedPath = true
+            try {
+                SecurityUtil.checkOfbizFileAllowList(outfile)
+            } catch (GeneralException e) {
+                context.errorMessage = e.getMessage()
+                allowedPath = false
+            }
+            if (!allowedPath) {
+                return
+            }
+            writer = new PrintWriter(new BufferedWriter(new 
OutputStreamWriter(new FileOutputStream(outfile), 'UTF-8')))
             writer.println('<?xml version="1.0" encoding="UTF-8"?>')
             writer.println('<entity-engine-xml>')
 
@@ -248,6 +269,16 @@ if (passedEntityNames) {
         context.results = results
         if (outpath && !filename) {
             outdir = new File(outpath)
+            allowedPath = true
+            try {
+                SecurityUtil.checkOfbizFileAllowList(outdir)
+            } catch (GeneralException e) {
+                context.errorMessage = e.getMessage()
+                allowedPath = false
+            }
+            if (!allowedPath) {
+                return
+            }
             if (!outdir.exists()) {
                 outdir.mkdir()
             }