This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new e8497577f1 Fixed: ViewFile no longer discloses arbitrary properties or
xml files
e8497577f1 is described below
commit e8497577f1966c08de6d2ce2172512accc71692c
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Sep 21 21:01:33 2026 +0530
Fixed: ViewFile no longer discloses arbitrary properties or xml files
ViewFile.groovy read any file path passed in the fileName request
parameter, with only a filename-suffix check and no restriction on which
directory it came from. It no longer serves .properties files at all, since no
current label-management flow produces or consumes them - Label Manager has
moved fully to XML label resources. For .xml files, it now checks that the path
falls under some registered component's minilang/ directory, matching the only
domain its real caller (View Referen [...]
---
.../ofbiz/webtools/labelmanager/ViewFile.groovy | 27 ++++++++++++++++++----
1 file changed, 23 insertions(+), 4 deletions(-)
diff --git
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/labelmanager/ViewFile.groovy
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/labelmanager/ViewFile.groovy
index 551e9c67e7..46bff8785d 100644
---
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/labelmanager/ViewFile.groovy
+++
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/labelmanager/ViewFile.groovy
@@ -18,21 +18,40 @@
*/
package org.apache.ofbiz.webtools.labelmanager
-import org.apache.ofbiz.base.util.FileUtil
+import org.apache.ofbiz.base.component.ComponentConfig
import org.apache.ofbiz.base.util.UtilXml
import org.w3c.dom.Document
+// ViewFile's only real caller (ViewReferences.ftl) only ever links to files
that
+// LabelReferences.java found while scanning for label usage, and for .xml
that scan
+// is always <component-root>/minilang/*.xml. Restricting to that exact domain
- rather
+// than the generic applications/themes/plugins/runtime content allowlist,
which excludes
+// framework/ entirely - keeps framework-rooted label references viewable
while still
+// blocking framework config files such as entityengine.xml.
+boolean isUnderComponentMinilangDir(File file) {
+ try {
+ String canonicalFilePath = file.getCanonicalPath()
+ for (ComponentConfig config : ComponentConfig.getAllComponents()) {
+ String canonicalMinilangDir =
config.rootLocation().resolve('minilang').toFile().getCanonicalPath()
+ if (canonicalFilePath == canonicalMinilangDir ||
canonicalFilePath.startsWith(canonicalMinilangDir + File.separator)) {
+ return true
+ }
+ }
+ } catch (IOException ignored) {
+ return false
+ }
+ return false
+}
+
fileString = ''
if (parameters.fileName) {
file = new File(parameters.fileName)
- if (parameters.fileName.endsWith('.xml')) {
+ if (parameters.fileName.endsWith('.xml') &&
isUnderComponentMinilangDir(file)) {
Document document = UtilXml.readXmlDocument(file.toURL(), false)
ByteArrayOutputStream os = new ByteArrayOutputStream()
UtilXml.writeXmlDocument(document, os, 'UTF-8', true, true, 4)
os.close()
fileString = os.toString()
- } else if (parameters.fileName.endsWith('.properties')) {
- fileString = FileUtil.readString('UTF-8', file)
}
rows = fileString.split(System.getProperty('line.separator'))
context.rows = rows.size()
