Misc code enhancements

applications/content/config/ContentUiLabels.xml

@@ -2089,6 +2089,9 @@
         <value xml:lang="zh">生成${contentType}是出错：${errorString}</value>
         <value xml:lang="zh-TW">產生${contentType}時出錯:${errorString}</value>
     </property>
+    <property key="ContentRenderingPathTraversalError">
+        <value xml:lang="en">Rejected output path: "${fileName}" resolves outside the allowed directory "${filePath}"</value>
+    </property>
     <property key="ContentRequiredField">
         <value xml:lang="en">Required field ${requiredField} is missing in simple method call ${resourceDescription}</value>
         <value xml:lang="fr">Le champ requis ${requiredField} est manquant dans l'appel d'une méthode simple : ${resourceDescription}</value>

applications/content/src/main/java/org/apache/ofbiz/content/output/OutputServices.java

@@ -218,7 +218,7 @@ public static Map<String, Object> createFileFromScreen(DispatchContext dctx, Map
         Map<String, Object> screenContext = UtilGenerics.cast(serviceContext.remove("screenContext"));
         String contentType = (String) serviceContext.remove("contentType");
         String filePath = (String) serviceContext.remove("filePath");
-        String fileName = (String) serviceContext.remove("fileName");
+        String fileName = new File((String) serviceContext.remove("fileName")).getName();
 
         if (UtilValidate.isEmpty(screenContext)) {
             screenContext = new HashMap<>();
@@ -265,7 +265,12 @@ public static Map<String, Object> createFileFromScreen(DispatchContext dctx, Map
             if (UtilValidate.isEmpty(filePath)) {
                 filePath = EntityUtilProperties.getPropertyValue("content", "content.output.path", "/output", delegator);
             }
-            File file = new File(filePath, fileName);
+            File baseDir = new File(filePath).getCanonicalFile();
+            File file = new File(baseDir, fileName).getCanonicalFile();
+            if (!file.toPath().startsWith(baseDir.toPath())) {
+                return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE, "ContentRenderingPathTraversalError",
+                        UtilMisc.toMap("fileName", fileName, "filePath", filePath), locale));
+            }
 
             FileOutputStream fos = new FileOutputStream(file);
             fos.write(baos.toByteArray());

framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java

@@ -368,6 +368,11 @@ public static Document readHtmlDocument(String str) {
             URL url = FlexibleLocation.resolveLocation(str);
             if (url != null) {
                 DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+                factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+                factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+                factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+                factory.setXIncludeAware(false);
+                factory.setExpandEntityReferences(false);
                 DocumentBuilder builder = factory.newDocumentBuilder();
                 document = builder.parse(url.openStream());
                 document.getDocumentElement().normalize();

framework/common/src/main/java/org/apache/ofbiz/common/login/LdapAuthenticationServices.java

@@ -26,6 +26,7 @@
 import javax.naming.NamingException;
 import javax.naming.directory.DirContext;
 import javax.naming.directory.InitialDirContext;
+import javax.naming.ldap.Rdn;
 import javax.transaction.Transaction;
 
 import org.apache.ofbiz.base.crypto.HashCrypt;
@@ -75,7 +76,7 @@ public static boolean userLogin(DispatchContext ctx, Map<String, ?> context) {
         if (UtilValidate.isEmpty(dn)) {
             String dnTemplate = (String) env.get("ldap.dn.template");
             if (dnTemplate != null) {
-                dn = dnTemplate.replace("%u", username);
+                dn = dnTemplate.replace("%u", Rdn.escapeValue(username));
             }
             if (Debug.verboseOn()) {
                 Debug.logVerbose("Using DN template: " + dn, MODULE);

framework/entity/src/main/java/org/apache/ofbiz/entity/jdbc/JdbcValueHandler.java

@@ -37,6 +37,7 @@
 import javax.sql.rowset.serial.SerialBlob;
 
 import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.SafeObjectInputStream;
 
 /**
  * An object that handles getting/setting column values in JDBC
@@ -617,7 +618,7 @@ public Object getValue(ResultSet rs, int columnIndex) throws SQLException {
                 if (bis == null) {
                     return null;
                 }
-                in = new ObjectInputStream(bis);
+                in = new SafeObjectInputStream(bis);
                 return in.readObject();
             } catch (Exception e) {
                 throw new SQLException(e);