[OFBIZ-6973] Flaw in content wrapper cache handling with encoderType

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Release Branch 14.12
• Fix Version/s: 14.12.01, 15.12.01
• Component/s: ALL APPLICATIONS
• Assignee: Jacques Le Roux
• Reporter: P Proulx
• Created: 31/Mar/16 22:59
• Updated: 13/Apr/16 19:51
• Resolved: 01/Apr/16 20:35

Description

In Ofbiz 14.12 branch there is a flaw in the patches added in ticket
https://issues.apache.org/jira/browse/OFBIZ-6669

In ProductContentWrapper#getProductContentAsText and all similar content wrappers using a cache, the cacheKey does not include the new encoderType:

            String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId");

This makes it possible for subsequent calls on the same wrapper using different encoderTypes to return content having the wrong encoding and create potential security flaws.

The key should include the encoderType:

                String cacheKey = productContentTypeId + SEPARATOR + locale + SEPARATOR + mimeTypeId + SEPARATOR + product.get("productId")  + SEPARATOR + encoderType;

I leave you to find all the occurrences.

Issue Links

• is related to: OFBIZ-6979 All static variables should be revisited for multitenant operation