[OFBIZ-12594] Prevent Freemarker interpolation in fields

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Implemented
• Affects Version/s: 18.12.06, 22.01.01
• Fix Version/s: 18.12.06, 22.01.01
• Component/s: ALL APPLICATIONS, ALL PLUGINS
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 04/Apr/22 06:02
• Updated: 20/Apr/22 12:17
• Resolved: 04/Apr/22 07:58

Description

OFBIZ-12587 is a definitive solution to prevent any kind of Freemarker exploits. But it's hard to realise because OFBiz exposes objects, like attributes from the Servlet scopes. So in the meantime preventing Freemarker interpolation in fields is a pragmatic solution.

Issue Links

• breaks: OFBIZ-12595 Test run was unsuccessful because of failing solr tests
• breaks: OFBIZ-12600 Solr requires application/x-www-form-urlencoded
• breaks: OFBIZ-12602 XML Import fails due to security check