[
https://issues.apache.org/jira/browse/OFBIZ-12594?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17516650#comment-17516650
]
ASF subversion and git services commented on OFBIZ-12594:
---------------------------------------------------------
Commit 3284ad3994331eb322966d1488ed37c8e1b52220 in ofbiz-framework's branch
refs/heads/release22.01 from Jacques Le Roux
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=3284ad3994 ]
Improved: Prevent Freemarker interpolation in fields (OFBIZ-12594)
OFBIZ_12587 is a definitive solution to prevent any kind of Freemarker exploits.
But it's hard to realise because OFBiz exposes objects, like attributes from the
Servlet scopes. So in the meantime preventing Freemarker interpolation in fields
is a pragmatic solution.
This is an improvement but needs to be backported because it kinda affects
security
> Prevent Freemarker interpolation in fields
> ------------------------------------------
>
> Key: OFBIZ-12594
> URL: https://issues.apache.org/jira/browse/OFBIZ-12594
> Project: OFBiz
> Issue Type: Improvement
> Components: ALL APPLICATIONS, ALL PLUGINS
> Affects Versions: 18.12.06, 22.01.01
> Reporter: Jacques Le Roux
> Assignee: Jacques Le Roux
> Priority: Major
>
> OFBIZ-12587 is a definitive solution to prevent any kind of Freemarker
> exploits. But it's hard to realise because OFBiz exposes objects, like
> attributes from the Servlet scopes. So in the meantime preventing Freemarker
> interpolation in fields is a pragmatic solution.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
