(ofbiz-framework) branch release24.09 updated: Fix path interpretation for windows machines

[kmarinos]

This is an automated email from the ASF dual-hosted git repository.

Criux pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 5ce40a20c0 Fix path interpretation for windows machines
5ce40a20c0 is described below

commit 5ce40a20c062d133cf892e90d30a7925a7c003ff
Author: Konstantinos Marinos <cont...@kmarinos.com>
AuthorDate: Mon Sep 28 09:06:53 2026 +0200

    Fix path interpretation for windows machines
    
    Fixed: Path interpretation for windows machines for UtilValidate and
    WidgetSecureLocation.
    
    With the introduction of WidgetSecureLocation (#1650) and the related
    changes to UtilValidate, path interpretation breaks for windows machines
    since Path.toString() uses backslashes when normalizing paths.
    
    This issue was also hinted at here:
    
    https://github.com/apache/ofbiz-framework/pull/1586#discussion_r3735382962
    and this PR aims to fix the compatibility issue for windows without
    introducing any functional changes.
    
    (cherry picked from commit e2d9c38c477bac3bad63239c9f7f3ac8c0873157)
---
 .../org/apache/ofbiz/base/util/UtilValidate.java    | 21 +++++++++++++++++++--
 .../ofbiz/widget/model/WidgetSecureLocation.java    | 14 +++++++++++++-
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git 
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java 
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
index dba02b2bb0..ad22695c66 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilValidate.java
@@ -18,11 +18,14 @@
  
*******************************************************************************/
 package org.apache.ofbiz.base.util;
 
+import java.io.File;
+import java.nio.file.InvalidPathException;
 import java.nio.file.Paths;
 import java.sql.Timestamp;
 import java.util.Collection;
 import java.util.Map;
 import java.util.regex.Pattern;
+import java.util.regex.PatternSyntaxException;
 
 import org.apache.commons.validator.routines.EmailValidator;
 import org.apache.commons.validator.routines.UrlValidator;
@@ -674,8 +677,22 @@ public final class UtilValidate {
         if (UtilValidate.isEmpty(allowFilePaths)) {
             return false;
         }
-        String normalizedPath = 
Paths.get(rawPathString).normalize().toString();
-        return 
Pattern.compile(allowFilePaths).matcher(normalizedPath).matches();
+        String normalizedPath;
+        try {
+            normalizedPath = Paths.get(rawPathString).normalize().toString();
+        } catch (InvalidPathException e) {
+            Debug.logWarning(String.format("Invalid path [%s], %s", 
rawPathString, e.getReason()), MODULE);
+            return false;
+        }
+        if (File.separatorChar != '/') {
+            normalizedPath = normalizedPath.replace(File.separatorChar, '/');
+        }
+        try {
+            return 
Pattern.compile(allowFilePaths).matcher(normalizedPath).matches();
+        } catch (PatternSyntaxException e) {
+            Debug.logError(e, "security.properties allowFilePaths is not a 
valid regular expression, denying every path", MODULE);
+            return false;
+        }
     }
 
     /** isYear returns true if string s is a valid
diff --git 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/WidgetSecureLocation.java
 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/WidgetSecureLocation.java
index 16a6e2f85e..1df38cc87d 100644
--- 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/model/WidgetSecureLocation.java
+++ 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/model/WidgetSecureLocation.java
@@ -18,6 +18,8 @@
  
*******************************************************************************/
 package org.apache.ofbiz.widget.model;
 
+import java.io.File;
+import java.nio.file.InvalidPathException;
 import java.nio.file.Paths;
 
 import org.apache.ofbiz.base.util.Debug;
@@ -66,7 +68,17 @@ public final class WidgetSecureLocation {
                 Debug.logWarning(String.format("Traversal sequence '..' is not 
allowed in location: [%s]", location), MODULE);
                 return null;
             }
-            return COMPONENT_PROTOCOL + 
Paths.get(componentRelativePath).normalize();
+            String normalizedPath;
+            try {
+                normalizedPath = 
Paths.get(componentRelativePath).normalize().toString();
+            } catch (InvalidPathException e) {
+                Debug.logWarning(String.format("Invalid path in location: 
[%s], %s", location, e.getReason()), MODULE);
+                return null;
+            }
+            if (File.separatorChar != '/') {
+                normalizedPath = normalizedPath.replace(File.separatorChar, 
'/');
+            }
+            return COMPONENT_PROTOCOL + normalizedPath;
         }
         if (UtilValidate.isAllowedPath(location)) {
             return location;