[jira] [Commented] (OFBIZ-8302) Sorting of lists generates undesired results

[Nicolas Malin (Jira)]

    [ https://issues.apache.org/jira/browse/OFBIZ-8302?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17224187#comment-17224187 ]

ASF subversion and git services commented on OFBIZ-8302:
--------------------------------------------------------

Commit cd242ea34ce38a0bb0182359ac2ed4f7952104b9 in ofbiz-framework's branch refs/heads/trunk from Jacques Le Roux
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=cd242ea ]

Fixed: Sorting of lists generates undesired results (OFBIZ-8302)

For this issue (OFBIZ-8302) I reverted the point 1 of
http://svn.apache.org/viewvc?view=revision&revision=1759555

As reported by Alvaro Munoz from GH security team it's not sufficient:
<<the second part of the fix was not effective, since the attacker can close the
raw string context with a double quote and write a new attribute or even close
the macro tag and write arbitrary FreeMarker code.>>

So this removes the 2nd part and add better solution to fix the OFBIZ-8302 issue
The solution is to encode only the QueryString and to handle it correctly in
UtilHttp::getParameterMap. I must say it was not a sinecure!

> Sorting of lists generates undesired results
> --------------------------------------------
>
>                 Key: OFBIZ-8302
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-8302
>             Project: OFBiz
>          Issue Type: Bug
>          Components: product
>    Affects Versions: Release Branch 15.12, Trunk
>            Reporter: Pierre Smits
>            Assignee: Jacques Le Roux
>            Priority: Major
>             Fix For: Release Branch 13.07, Release Branch 14.12, 16.11.01, Release Branch 15.12
>
>
> When trying to sort the overview of products in the product catalog on one of the options, a blank screen is returned.
> As an example the following returned url:
> {code}
> https://ofbiz-vm.apache.org:8443/catalog/control/https%3A%2F%2Fofbiz-vm.apache.org%3A8443%2Fcatalog%2Fcontrol%2FFindProduct%3FsortField%3DproductId%26amp%3BnoConditionFind%3DY%26amp%3BproductId_ic%3DY%26amp%3BproductId_op%3Dcontains%26amp%3BinternalName_ic%3DY%26amp%3BinternalName_op%3Dcontains
> {code}

--
This message was sent by Atlassian Jira
(v8.3.4#803005)