From 9ca3d3a911a2f68012765f4a0e2de2b85f1025d2 Mon Sep 17 00:00:00 2001
From: Jacopo Cappellato <jacopo.cappellato@gmail.com>
Date: Mon, 6 Apr 2026 09:34:15 +0200
Subject: [PATCH 1/2] Fixed: Move checkContextFileBoundary call to ensure file
 boundary is checked before existence check

---
 .../java/org/apache/ofbiz/content/data/DataResourceWorker.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
index 4711071fb0b..1706a9a8212 100644
--- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
+++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
@@ -718,10 +718,10 @@ public static File getContentFile(String dataResourceTypeId, String objectInfo,
                 sep = "/";
             }
             file = FileUtil.getFile(contextRoot + sep + objectInfo);
+            checkContextFileBoundary(file, contextRoot);
             if (!file.exists()) {
                 throw new FileNotFoundException("No file found: " + (contextRoot + sep + objectInfo));
             }
-            checkContextFileBoundary(file, contextRoot);
         }
 
         return file;

From 7120fa7c87e8c4ae3b6fb87fba73bf0fd8b48e64 Mon Sep 17 00:00:00 2001
From: Jacopo Cappellato <jacopo.cappellato@gmail.com>
Date: Mon, 6 Apr 2026 11:06:02 +0200
Subject: [PATCH 2/2] Fixed: Update checkContextFileBoundary method visibility
 and ensure it is called in DataServices to validate file paths

---
 .../apache/ofbiz/content/data/DataResourceWorker.java  |  4 ++--
 .../org/apache/ofbiz/content/data/DataServices.java    | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
index 1706a9a8212..4035c8d2484 100644
--- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
+++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
@@ -544,7 +544,7 @@ private static void checkOfbizFileAllowList(File file) throws GeneralException {
     /**
      * Checks that the given file is within the provided context root directory.
      */
-    private static void checkContextFileBoundary(File file, String contextRoot) throws GeneralException {
+    static void checkContextFileBoundary(File file, String contextRoot) throws GeneralException {
         try {
             String canonicalAllowed = new File(contextRoot).getCanonicalPath();
             String canonicalFilePath = file.getCanonicalPath();
@@ -1285,10 +1285,10 @@ public static void renderFile(String dataResourceTypeId, String objectInfo, Stri
                 sep = "/";
             }
             File file = FileUtil.getFile(prefix + sep + objectInfo);
+            checkContextFileBoundary(file, rootDir);
             if (!file.exists()) {
                 throw new FileNotFoundException("No file found: " + file.getAbsolutePath());
             }
-            checkContextFileBoundary(file, rootDir);
             try (InputStreamReader in = new InputStreamReader(new FileInputStream(file), StandardCharsets.UTF_8)) {
                 if (Debug.infoOn()) {
                     String enc = in.getEncoding();
diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
index 56a618a18e7..2feed5755d6 100644
--- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
+++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
@@ -268,6 +268,11 @@ public static Map<String, Object> createFileMethod(DispatchContext dctx, Map<Str
                 sep = "/";
             }
             file = new File(prefix + sep + objectInfo);
+            try {
+                DataResourceWorker.checkContextFileBoundary(file, prefix);
+            } catch (GeneralException e) {
+                return ServiceUtil.returnError(e.getMessage());
+            }
         }
         if (file == null) {
             return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE, "ContentUnableObtainReferenceToFile",
@@ -478,6 +483,11 @@ public static Map<String, Object> updateFileMethod(DispatchContext dctx, Map<Str
                     sep = "/";
                 }
                 file = new File(prefix + sep + objectInfo);
+                try {
+                    DataResourceWorker.checkContextFileBoundary(file, prefix);
+                } catch (GeneralException e) {
+                    return ServiceUtil.returnError(e.getMessage());
+                }
             }
             if (file == null) {
                 throw new IOException("File is null");