[OFBIZ-13192] Issues when uploading SVG files

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 18.12.17, 24.09.01
• Fix Version/s: 24.09.01, 18.12.18
• Component/s: content, party
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 08/Dec/24 15:32
• Updated: 09/Dec/24 06:19
• Resolved: 09/Dec/24 06:19

Description

SVG files can only be uploaded when the "All" type is used. That's only done inside the Content component. This component can also be used by other component, like Party for instance.

There are some issues when uploading SVG files.

• When the All type is used and a SVG file is uploaded, the checking type order places the CSV file before the SVG file type. In some cases this error arises:

  java.io.IOException: (line 8) invalid char between encapsulated token and delimiter

• Most often they are minified. Then, apart very small ones, they contains long lines, at least longer than 10000 default.
• They almost all contain the word "class". Once you remove it from deniedWebShellTokens in security.properties the files pass and are uploaded w/o modification. They can also contain token like "javascript", etc.

Issue Links

• relates to: OFBIZ-12080 Secure the uploads