[
https://issues.apache.org/jira/browse/OFBIZ-12324?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17491964#comment-17491964
]
ASF subversion and git services commented on OFBIZ-12324:
---------------------------------------------------------
Commit 719ca41467c369fc1f382c3b260812a133c863a6 in ofbiz-framework's branch
refs/heads/trunk from Jacques Le Roux
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=719ca41 ]
Improved: Create a deny list to reject webshell tokens (OFBIZ-12324)
After reviewing https://docs.oracle.com/cd/B14099_19/web.1012/b14014/jspxml.htm,
since we use "<jsp:" this removes "scriptlet>", "declaration>" and
"expression>".
They are redundant with "<jsp:"; "<jsp:" covers those already.
Also adds eval( for js and shrinks base64_decode to decode, and processbuilder
to process because of OFBIZ 12571
I always test the denied tokens against a lib of images with 33 600 elements (
3.99 GB). If an image contains the token it can't be in the denied list.
> Create a deny list to reject webshell tokens
> --------------------------------------------
>
> Key: OFBIZ-12324
> URL: https://issues.apache.org/jira/browse/OFBIZ-12324
> Project: OFBiz
> Issue Type: Improvement
> Components: framework/security
> Affects Versions: Trunk
> Reporter: Jacques Le Roux
> Assignee: Jacques Le Roux
> Priority: Minor
> Fix For: Release Branch 17.12, 18.12.01
>
>
> In OFBIZ-12305 I said
> bq. Somehow related: I'll also soon extract the list of words used in
> SecuredUpload::isValidText in a deniedWebShellWords property in
> security.properties
> This is it
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
