Improved: Prevent URL parameters manipulation (OFBIZ-13147)

Allows Solr tests to pass, so far so good... Conflict handled by hand
apache · Oct 23, 2024 · 94e40f9 · 94e40f9
1 parent 84ff5ee
commit 94e40f9
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/ControlFilter.java
@@ -142,9 +142,11 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
             String queryString = httpRequest.getQueryString();
             if (queryString != null) {
                 queryString = URLDecoder.decode(queryString, "UTF-8");
+                // wt=javabin allows Solr tests, see https://cwiki.apache.org/confluence/display/solr/javabin
                 if (UtilValidate.isUrl(queryString)
-                        || (!SecuredUpload.isValidText(queryString, Collections.emptyList())
-                                && !queryString.contains("JavaScriptEnabled=Y"))) {
+                        || !SecuredUpload.isValidText(queryString, Collections.emptyList())
+                                && !(queryString.contains("JavaScriptEnabled=Y")
+                                        || queryString.contains("wt=javabin"))) {
                     Debug.logError("For security reason this URL is not accepted", module);
                     throw new RuntimeException("For security reason this URL is not accepted");
                 }