[jira] [Updated] (OFBIZ-6973) Flaw in content wrapper cache handling with encoderType

[Nicolas Malin (Jira)]

     [ https://issues.apache.org/jira/browse/OFBIZ-6973?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

P Proulx updated OFBIZ-6973:
----------------------------
    Description:
In Ofbiz 14.12 branch there is a flaw in the patches added in ticket
https://issues.apache.org/jira/browse/OFBIZ-6669

In ProductContentWrapper#getProductContentAsText and all similar content wrappers using a cache, the cacheKey does not include the new encoderType:

{code}
            String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId");
{code}

This makes it possible for subsequent calls on the same wrapper using different encoderTypes to return content having the wrong encoding and create potential security flaws.

The key should include the encoderType:

{code}
                String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId")  + SEPARATOR + encoderType;
{code}

I leave you to find all the occurrences.

  was:
In Ofbiz 14.12 branch there is a flaw in the patches added in ticket
https://issues.apache.org/jira/browse/OFBIZ-6669

In ProductContentWrapper#getProductContentAsText and all similar content wrappers using a cache, the cacheKey does not include the new encoderType:

{code}
            String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId");
{code}

This makes it possible for subsequent calls on the same wrapper using different encoderTypes to return content having the wrong encoding and create potential security flaws.

They should enclude the encoderType:

{code}
                String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId")  + SEPARATOR + encoderType;
{code}

I leave you to find all the occurrences.

> Flaw in content wrapper cache handling with encoderType
> -------------------------------------------------------
>
>                 Key: OFBIZ-6973
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-6973
>             Project: OFBiz
>          Issue Type: Bug
>          Components: ALL APPLICATIONS
>    Affects Versions: Release Branch 14.12
>            Reporter: P Proulx
>
> In Ofbiz 14.12 branch there is a flaw in the patches added in ticket
> https://issues.apache.org/jira/browse/OFBIZ-6669
> In ProductContentWrapper#getProductContentAsText and all similar content wrappers using a cache, the cacheKey does not include the new encoderType:
> {code}
>             String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId");
> {code}
> This makes it possible for subsequent calls on the same wrapper using different encoderTypes to return content having the wrong encoding and create potential security flaws.
> The key should include the encoderType:
> {code}
>                 String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId")  + SEPARATOR + encoderType;
> {code}
> I leave you to find all the occurrences.

--
This message was sent by Atlassian JIRA
(v6.3.4#6332)