From bf5788bc5773f057d3ca09cefd43ed69285dc7ec Mon Sep 17 00:00:00 2001
From: Jacques Le Roux <jacques.le.roux@les7arts.com>
Date: Fri, 29 Nov 2024 07:42:42 +0100
Subject: [PATCH] Improved: Prevent URL parameters manipulation (OFBIZ-13147)

Adds few new deniedWebShellTokens in security.properties
---
 framework/security/config/security.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/framework/security/config/security.properties b/framework/security/config/security.properties
index e018769b76..dd18fbd6d4 100644
--- a/framework/security/config/security.properties
+++ b/framework/security/config/security.properties
@@ -244,7 +244,7 @@ deniedWebShellTokens=java.,beans,freemarker,<script,javascript,<body,body ,<form
                     chmod,mkdir,fopen,fclose,new file,upload,getfilename,download,getoutputstring,readfile,iframe,object,embed,onload,build,\
                     python,perl ,/perl,ruby ,/ruby,process,function,class,InputStream,to_server,wget ,static,assign,webappPath,\
                     ifconfig,route,crontab,netstat,uname ,hostname,iptables,whoami,"cmd",*cmd|,+cmd|,=cmd|,localhost,thread,require,gzdeflate,\
-                    execute,println,calc,touch,curl,base64, tcp ,4444,base32, tr , xxd ,bash
+                    execute,println,calc,touch,curl,base64, tcp ,4444,base32, tr , xxd ,bash, od ,|od ,printf,echo
 
 
 #-- SHA-1 versions of tokens containing (as String) at least one deniedWebShellTokens