svn commit: r1866920 - in /ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts: labelmanager/ViewFile.groovy log/FetchLogs.groovy

Author: jleroux
Date: Sat Sep 14 08:19:18 2019
New Revision: 1866920

URL: http://svn.apache.org/viewvc?rev=1866920&view=rev
Log:
Fixed: Path Traversal in webtools/control/FetchLogs and ViewFile
(OFBIZ-11196)

These are not really path traversal issues.

We can't solve them using the traditional way to fix path traversal issues
(ie normalising path). Because Fetchlogs and ViewFile are actually reading
files and if you have the right to read these files then nothing will prevent
you to read them.

The problem is more what those requests are supposed to do.
Fetchlogs is supposed to read a log in the log dir
and ViewFile is supposed to read a file containing labels
(ie either an XML or Properties file).

So the solution is to allow these requests to only do what they are supposed to
do. This is what is done in ViewFile and FetLogs Groovy files.

Modified:
    ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy
    ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/log/FetchLogs.groovy

Modified: ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy?rev=1866920&r1=1866919&r2=1866920&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy (original)
+++ ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/labelmanager/ViewFile.groovy Sat Sep 14 08:19:18 2019
@@ -31,7 +31,7 @@ if (parameters.fileName) {
         UtilXml.writeXmlDocument(document, os, "UTF-8", true, true, 4)
         os.close()
         fileString = os.toString()
-    } else {
+    } else if (parameters.fileName.endsWith(".properties")) {
         fileString = FileUtil.readString("UTF-8", file)
     }
     rows = fileString.split(System.getProperty("line.separator"))

Modified: ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/log/FetchLogs.groovy
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/log/FetchLogs.groovy?rev=1866920&r1=1866919&r2=1866920&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/log/FetchLogs.groovy (original)
+++ ofbiz/ofbiz-framework/trunk/framework/webtools/groovyScripts/log/FetchLogs.groovy Sat Sep 14 08:19:18 2019
@@ -42,7 +42,7 @@ for (int i = 0; i < listLogFiles.length;
 }
 context.listLogFileNames = listLogFileNames.sort()
 
-if (parameters.logFileName) {
+if (parameters.logFileName && logFileName.contains(parameters.logFileName)) {
     List logLines = []
     try {
         File logFile = FileUtil.getFile(ofbizLogDir.concat(parameters.logFileName))