Improved: Prevent possible post-auth RCE from webtools/control/ProgramExport
This was reported to the security team by Shuibo Ye
We did not create a CVE because it's a post-auth "vulnerability"
Thanks: Shuibo Ye
@@ -85,6 +85,13 @@ def shell = new GroovyShell(loader, binding, configuration)
if (groovyProgram) {
try {
+ // TODO more can be added...
+ if (groovyProgram.contains("new File")
+ || groovyProgram.contains(".jsp")
+ || groovyProgram.contains("<%=")) {
+ request.setAttribute("_ERROR_MESSAGE_", "Not executed for security reason")
+ return
+ }
shell.parse(groovyProgram)
shell.evaluate(groovyProgram)
recordValues = shell.getVariable("recordValues")
