ofbiz-framework icon indicating copy to clipboard operation
ofbiz-framework copied to clipboard

Improved: Allow to use GroovyDsl in FlexibleStringExpander (OFBIZ-13133)

Open nmalin opened this issue 4 months ago • 1 comments

Second improvement on this functionality with increase the security by analyse each script to control the presence of potential code injection.

The regexp to control is a property: security.deniedScriptletsTokens. If a script match the regexp, OFBiz raise in log an alert with the script and the script hash. The script is disabled and can't run.

If you have a safe script who is matched by the regexp, you can add the hash given by OFBiz on the property: security.allowedScriptletHashes

nmalin avatar Oct 10 '24 12:10 nmalin