Skip to content

Fixed: Validate last view name input in RequestHandler to enhance security #1072

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jacopoc merged 1 commit into from
Apr 7, 2026
Merged

Fixed: Validate last view name input in RequestHandler to enhance security #1072

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1171,8 +1171,10 @@ private void renderView(String view, boolean allowExtView, HttpServletRequest re
// add in the attributes as well so everything needed for the rendering context will be in place if/when we get back to this view
paramMap.putAll(UtilHttp.getAttributeMap(req));
UtilMisc.makeMapSerializable(paramMap);
// Used by lookups to keep the real view (request)
req.getSession().setAttribute("_LAST_VIEW_NAME_", paramMap.getOrDefault("_LAST_VIEW_NAME_", view));
// Used by lookups to keep the real view (request); accept the request parameter only if it is a safe view name (alphanumeric/dash/underscore)
String lastViewNameParam = (String) paramMap.get("_LAST_VIEW_NAME_");
String lastViewName = (lastViewNameParam != null && lastViewNameParam.matches("[\\w\\-]+")) ? lastViewNameParam : view;
req.getSession().setAttribute("_LAST_VIEW_NAME_", lastViewName);
req.getSession().setAttribute("_LAST_VIEW_PARAMS_", paramMap);

if ("SAVED".equals(saveName)) {
Expand Down
7 changes: 2 additions & 5 deletions framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1483,11 +1483,8 @@ public void renderLookupField(Appendable writer, Map<String, Object> context, Lo
if (showDescription == null) {
showDescription = "Y".equals(visualTheme.getModelTheme().getLookupShowDescription());
}
// lastViewName, used by lookup to remember the real last view name
String lastViewName = request.getParameter("_LAST_VIEW_NAME_"); // Try to get it from parameters firstly
if (UtilValidate.isEmpty(lastViewName)) { // get from session
lastViewName = (String) request.getSession().getAttribute("_LAST_VIEW_NAME_");
}
// lastViewName, used by lookup to remember the real last view name; read only from session (set by RequestHandler) to prevent user input
String lastViewName = (String) request.getSession().getAttribute("_LAST_VIEW_NAME_");
if (UtilValidate.isEmpty(lastViewName)) {
lastViewName = "";
}
Expand Down
Loading