OF-2722 OF-2902: Remove commons-fileupload #2667
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The commons-fileupload dependency that is used by Openfire has a CVE reported against it (rather: against one of its dependencies). Java/Jetty can nowadays natively process file uploads. There no longer is a need for commons-fileupload. This commit replaces commons-fileupload, which resolves the outstanding CVE report. Additionally some plugin-upload properties were slightly refactored.
By moving JSP code into a servlet, static analyzers are finding more issues. One of the reported issues based on the change in the previous commit is that unsanitized user-provided input is used in the code that implements the downloading of plugins. This particular code isn't used at all by the admin console. I've removed it in this commit.
Plugin uploads were already added to the audit log. With this change, whenever an admin downloads a plugin, an entry is added to the audit log too.
Fishbowler
reviewed
Feb 6, 2025
xmppserver/src/main/java/org/jivesoftware/openfire/update/PluginDownloadManager.java
Show resolved
Hide resolved
Fishbowler
approved these changes
Feb 7, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The commons-fileupload dependency that is used by Openfire has a CVE reported against it (rather: against one of its dependencies).
Java/Jetty can nowadays natively process file uploads. There no longer is a need for commons-fileupload.
This commit replaces commons-fileupload, which resolves the outstanding CVE report.
Additionally some plugin-upload properties were slightly refactored.