Fixed: Secure the uploads
Just occurred to my mind that I forgot to lower case the tokens in
DENIEDWEBSHELLTOKENS when checking with SecuredUpload::isValidText
@@ -104,7 +104,7 @@ public class SecuredUpload {
private static final Integer MAXLINELENGTH = UtilProperties.getPropertyAsInteger("security", "maxLineLength", 10000);
public static boolean isValidText(String content, List<String> allowed) throws IOException {
- return content != null ? DENIEDWEBSHELLTOKENS.stream().allMatch(token -> isValid(content, token, allowed)) : false;
+ return content != null ? DENIEDWEBSHELLTOKENS.stream().allMatch(token -> isValid(content, token.toLowerCase(), allowed)) : false;
}
public static boolean isValidFileName(String fileToCheck, Delegator delegator) throws IOException {
