ofbiz-framework
ofbiz-framework copied to clipboard
Improved: Allow to use GroovyDsl in FlexibleStringExpander (OFBIZ-13133)
Second improvement on this functionality with increase the security by analyse each script to control the presence of potential code injection.
The regexp to control is a property: security.deniedScriptletsTokens. If a script match the regexp, OFBiz raise in log an alert with the script and the script hash. The script is disabled and can't run.
If you have a safe script who is matched by the regexp, you can add the hash given by OFBiz on the property: security.allowedScriptletHashes