This is an automated email from the ASF dual-hosted git repository.
ashishvijaywargiya pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 41afcbcc58 Fixed: unrestricted file destination in DataServices
createFile/updateFile (#1748)
41afcbcc58 is described below
commit 41afcbcc58c901c282c5060530cb4de86c9fde44
Author: Ashish Vijaywargiya <[email protected]>
AuthorDate: Thu Aug 27 11:18:17 2026 +0530
Fixed: unrestricted file destination in DataServices createFile/updateFile
(#1748)
createFileMethod and updateFileMethod build a target File from the
caller-supplied objectInfo for LOCAL_FILE and OFBIZ_FILE resource types
and write to it directly. Unlike the CONTEXT_FILE branch in the same
methods, and unlike the read path in DataResourceWorker for the same
resource types, neither branch confirmed the resolved path stayed within
the directories configured in security.properties, so a target outside
those directories was accepted and written.
Added the same SecurityUtil.checkLocalFileAllowList/
checkOfbizFileAllowList calls the read path already makes, in both
methods, matching the existing CONTEXT_FILE handling.
Test coverage from the original commit is omitted here per request.
Thank you Krishna Uprit for your help.
(cherry picked from commit d3e92834301129a84b199f8b3fc037af58b4c4dc)
---
.../org/apache/ofbiz/content/data/DataServices.java | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git
a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
index 2feed5755d..e59c89fad5 100644
---
a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
+++
b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
@@ -50,6 +50,7 @@ import org.apache.ofbiz.entity.GenericEntityException;
import org.apache.ofbiz.entity.GenericValue;
import org.apache.ofbiz.entity.util.EntityQuery;
import org.apache.ofbiz.security.SecuredUpload;
+import org.apache.ofbiz.security.SecurityUtil;
import org.apache.ofbiz.service.DispatchContext;
import org.apache.ofbiz.service.GenericServiceException;
import org.apache.ofbiz.service.ModelService;
@@ -253,12 +254,22 @@ public class DataServices {
if (!file.isAbsolute()) {
return
ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE,
"ContentLocalFileDoesNotPointToAbsoluteLocation", locale));
}
+ try {
+ SecurityUtil.checkLocalFileAllowList(file);
+ } catch (GeneralException e) {
+ return ServiceUtil.returnError(e.getMessage());
+ }
} else if ("OFBIZ_FILE".equals(dataResourceTypeId) ||
"OFBIZ_FILE_BIN".equals(dataResourceTypeId)) {
prefix = System.getProperty("ofbiz.home");
if (objectInfo.indexOf('/') != 0 && prefix.lastIndexOf('/') !=
(prefix.length() - 1)) {
sep = "/";
}
file = new File(prefix + sep + objectInfo);
+ try {
+ SecurityUtil.checkOfbizFileAllowList(file);
+ } catch (GeneralException e) {
+ return ServiceUtil.returnError(e.getMessage());
+ }
} else if ("CONTEXT_FILE".equals(dataResourceTypeId) ||
"CONTEXT_FILE_BIN".equals(dataResourceTypeId)) {
prefix = (String) context.get("rootDir");
if (UtilValidate.isEmpty(prefix)) {
@@ -471,12 +482,22 @@ public class DataServices {
if (!file.isAbsolute()) {
throw new GenericServiceException("File: " + fileName + "
is not absolute.");
}
+ try {
+ SecurityUtil.checkLocalFileAllowList(file);
+ } catch (GeneralException e) {
+ return ServiceUtil.returnError(e.getMessage());
+ }
} else if (dataResourceTypeId.startsWith("OFBIZ_FILE")) {
prefix = System.getProperty("ofbiz.home");
if (objectInfo.indexOf('/') != 0 && prefix.lastIndexOf('/') !=
(prefix.length() - 1)) {
sep = "/";
}
file = new File(prefix + sep + objectInfo);
+ try {
+ SecurityUtil.checkOfbizFileAllowList(file);
+ } catch (GeneralException e) {
+ return ServiceUtil.returnError(e.getMessage());
+ }
} else if (dataResourceTypeId.startsWith("CONTEXT_FILE")) {
prefix = (String) context.get("rootDir");
if (objectInfo.indexOf('/') != 0 && prefix.lastIndexOf('/') !=
(prefix.length() - 1)) {
