Skip to content

Commit 3797e60

Browse files
committed
Improved: Prevent Freemarker interpolation in fields (OFBIZ-12594)
OFBIZ_12587 is a definitive solution to prevent any kind of Freemarker exploits. But it's hard to realise because OFBiz exposes objects, like attributes from the Servlet scopes. So in the meantime preventing Freemarker interpolation in fields is a pragmatic solution. This is an improvement but needs to be backported because it kinda affects security Conflicts handled by hand SeoContextFilter.java ControlFilter.java When I worked with Mathieu I did not measure how it will be hard sometimes to backport later :/ Also due to checkstyle module to MODULE change is always a pain in the ass :/
1 parent 843b1c7 commit 3797e60

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

framework/security/src/main/java/org/apache/ofbiz/security/SecurityUtil.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ public static boolean containsFreemarkerInterpolation(HttpServletResponse resp,
231231
|| stringToCheck.contains("%5B%23") || stringToCheck.contains("[#")) { // not used OOTB in OFBiz, but possible
232232

233233
Debug.logError("===== Not saved for security reason, strings '${', '<#', '#{', '[=' or '[#' not accepted in fields! =====",
234-
MODULE);
234+
module);
235235
resp.sendError(HttpServletResponse.SC_FORBIDDEN,
236236
"Not saved for security reason, strings '${', '<#', '#{', '[=' or '[#' not accepted in fields!");
237237
return true;

0 commit comments

Comments
 (0)