[ofbiz-framework] branch release17.12 updated: Fixed: Secure the uploads (OFBIZ-12080)

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release17.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release17.12 by this push:
     new 363e0be  Fixed: Secure the uploads (OFBIZ-12080)
363e0be is described below

commit 363e0be7708cd30c4c3c994716352a6e57305973
Author: Jacques Le Roux <[hidden email]>
AuthorDate: Mon Dec 14 19:00:37 2020 +0100

    Fixed: Secure the uploads (OFBIZ-12080)
   
    According to https://s.apache.org/rpzog, adds few, maybe redundant, Java
    API/methods found in webshell, or alike, source code
---
 .../main/java/org/apache/ofbiz/security/SecuredUpload.java | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 273bdf5..d9c0952 100644
--- a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -111,8 +111,8 @@ public class SecuredUpload {
                 return false;
             } else if (!fileToCheck.matches("[a-zA-Z0-9]{1,249}.[a-zA-Z0-9]{1,10}")) {
                 Debug.logError("Uploaded file "
-                        + " should contain only Alpha-Numeric characters, only 1 dot as an input for the file name and the extension; "
-                        + "in which the file name and also the extension should not be empty at all  ",
+                        + " should contain only Alpha-Numeric characters, only 1 dot as an input for the file name and the extension."
+                        + "The file name and the extension should not be empty at all",
                         MODULE);
                 return false;
             }
@@ -122,8 +122,8 @@ public class SecuredUpload {
                 return false;
             } else if (!fileToCheck.matches("[a-zA-Z0-9]{1,4086}.[a-zA-Z0-9]{1,10}")) {
                 Debug.logError("Uploaded file "
-                        + " should contain only Alpha-Numeric characters, only 1 dot as an input for the file name and the extension; "
-                        + "in which the file name and also the extension should not be empty at all  ",
+                        + " should contain only Alpha-Numeric characters, only 1 dot as an input for the file name and the extension."
+                        + "Tthe file name and the extension should not be empty at all",
                         MODULE);
                 return false;
             }
@@ -619,6 +619,12 @@ public class SecuredUpload {
                 || content.toLowerCase().contains("mkdir")
                 || content.toLowerCase().contains("fopen")
                 || content.toLowerCase().contains("fclose")
+                || content.toLowerCase().contains("new file")
+                || content.toLowerCase().contains("import")
+                || content.toLowerCase().contains("upload")
+                || content.toLowerCase().contains("getFileName")
+                || content.toLowerCase().contains("Download")
+                || content.toLowerCase().contains("getOutputString")
                 || content.toLowerCase().contains("readfile"));
         // TODO.... to be continued with known webshell contents... a complete allow list is impossible anyway...
         // eg: https://www.acunetix.com/blog/articles/detection-prevention-introduction-web-shells-part-5/