Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-05 14:47:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1180 from henrikplate/fix-CVE-2024-53677

Browse Source 
Fix CVE-2024-53677 in 2-3-x
This commit is contained in:
Lukasz Lenart
2025-01-07 17:54:42 +01:00
committed by GitHub
parent 056228cd1e d2d01dfe93
commit 930fef7679
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/apache/struts2/interceptor/FileUploadInterceptor.java
+12 -9
View File
@@ -306,9 +306,9 @@ public class FileUploadInterceptor extends AbstractInterceptor {
if (!acceptedFiles.isEmpty()) {
Map<String, Object> params = ac.getParameters();
putCaseInsensitive(params, inputName, acceptedFiles.toArray(new File[acceptedFiles.size()]));
putCaseInsensitive(params, contentTypeName, acceptedContentTypes.toArray(new String[acceptedContentTypes.size()]));
putCaseInsensitive(params, fileNameName, acceptedFileNames.toArray(new String[acceptedFileNames.size()]));
params.put(inputName, acceptedFiles.toArray(new File[acceptedFiles.size()]));
putWithCheck(params, contentTypeName, acceptedContentTypes.toArray(new String[acceptedContentTypes.size()]));
putWithCheck(params, fileNameName, acceptedFileNames.toArray(new String[acceptedFileNames.size()]));
}
}
} else {
@@ -328,19 +328,22 @@ public class FileUploadInterceptor extends AbstractInterceptor {
}
/**
* Removes existing parameters with identical name (case-insensitive) before adding the given parameter.
* Minimal invasiv solution to fix CVE-2023-50164 for the 2.3.x branch.
* Removes existing parameters that contain the given name (case-insensitive) before adding the parameter.
* Minimal invasiv solution to fix CVE-2023-50164 and CVE-2024-53677 for the 2.3.x branch.
* For example, malicious parameters "uploadFileName" (CVE-2023-50164) or "top.uploadFileName" (CVE-2024-53677)
* would be removed from the map before adding the legitimate parameter "UploadFileName".
*
* @param params - parameters to update.
* @param key - parameter name (compared case-insensitive with existing ones).
* @param key - parameter name (compared with existing ones).
* @param value - parameter value.
*/
private void putCaseInsensitive(Map<String, Object> params, String key, Object value) {
// Remove existing map entry if its key is equal to the given key (case-insensitive)
private void putWithCheck(Map<String, Object> params, String key, Object value) {
// Remove existing map entry if it contains the given key (a check for case-
// insensitive equality does not catch all OGNL expressions, cf. CVE-2024-53677).
Iterator<Map.Entry<String, Object>> iterator = params.entrySet().iterator();
while (iterator.hasNext()) {
Map.Entry<String, Object> entry = iterator.next();
if (key.equalsIgnoreCase(entry.getKey())) {
if (entry.getKey().toLowerCase().contains(key.toLowerCase())) {
iterator.remove();
}
}