This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new a63cc20481 Improved: Harden the ProgramExport Groovy sandbox against
indirectly-named method calls
a63cc20481 is described below
commit a63cc204819c19abcd6f4faa7cb980c9fe09620e
Author: Mridul Pathak <[email protected]>
AuthorDate: Thu Sep 24 13:48:39 2026 +0530
Improved: Harden the ProgramExport Groovy sandbox against indirectly-named
method calls
The in-file SecureASTCustomizer restricts method calls by receiver type and
by a
source-text pattern list. Both checks rely on the receiver type and the
method name
being statically visible, so a method invoked through a computed or
GString-valued
name is covered by neither. Add a SecureASTCustomizer expression checker
that rejects
any method call whose name is not a compile-time constant. Export scripts
call methods
only by their literal name, so legitimate use is unaffected.
---
.../org/apache/ofbiz/webtools/entity/ProgramExport.groovy | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
index 204ac89c83..cac97e9d64 100644
---
a/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
+++
b/framework/webtools/src/main/groovy/org/apache/ofbiz/webtools/entity/ProgramExport.groovy
@@ -27,6 +27,8 @@ import org.apache.ofbiz.entity.condition.EntityOperator
import org.apache.ofbiz.entity.model.ModelEntity
import org.apache.ofbiz.entity.util.EntityFindOptions
import org.apache.ofbiz.entity.util.EntityQuery
+import org.codehaus.groovy.ast.expr.ConstantExpression
+import org.codehaus.groovy.ast.expr.MethodCallExpression
import org.codehaus.groovy.ast.expr.MethodPointerExpression
import org.codehaus.groovy.ast.stmt.ForStatement
import org.codehaus.groovy.ast.stmt.SwitchStatement
@@ -222,6 +224,17 @@ if (security.hasPermission('ENTITY_MAINT', session)) {
setMethodDefinitionAllowed(false)
}
+ // Reject method calls whose method name is not a compile-time constant,
e.g. obj."$name"(),
+ // obj.("a" + "b")() or any other computed/GString-valued invocation. The
receiver allow-list
+ // above and the dangerousPatterns regex both key off statically visible
types and literal method
+ // names, so a dynamically resolved name slips past both layers:
'x'."${'exec' + 'ute'}"() calls
+ // String.execute() (a GDK method on the allowed java.lang.String /
java.lang.Object receivers)
+ // and runs an OS command. Legitimate export scripts only ever call
methods by their literal name,
+ // so forbidding indirect method dispatch closes that bypass class without
affecting real usage.
+ secureCustomizer.addExpressionCheckers({ expr ->
+ !(expr instanceof MethodCallExpression) || expr.method instanceof
ConstantExpression
+ } as SecureASTCustomizer.ExpressionChecker)
+
// Add imports for script.
ImportCustomizer importCustomizer = new ImportCustomizer()
importCustomizer.addImport('org.apache.ofbiz.entity.GenericValue')
