Ir al contenido
Menú
Se marcó esta pregunta
1 Responder
3791 Vistas

Hello,

We are are trying to make a pci compliant website with odoo community 11, in particular we are getting a vulnerability issue, with a Saint scan software when it tries to execute index.jsp (wich of course doesn't exists in Odoo), Odoo webserver response with Javascript code (here a fragment):


Sent: GET /web/content/1715-456fe75/index.JSP

_.isFunction(value)?value.call(object):value;};var idCounter=0;_.uniqueId=function(prefix){var
id=++idCounter+'';return prefix?prefix+id:id;};_.templateSettings={evaluate:/<%([\s\S]+?)%>/g,interpolate:
/<%=([\s\S]+?)%>/g,escape:/<%-([\s\S]+?)%>/g};var noMatch=/(.)^/;var escapes={"'":"'",'\\':'\\','

Is there any way to avoid this?

Regards,

Avatar
Descartar
Mejor respuesta

odoo minify all the js and css content and stored in a database and generate unique/hash URL starts with /web/content/XXX/assets and server it WebClient as static assets. sadly it didn't check file extraction resource request.

even GET /web/content/1715-456fe75/index.sucks  # it also accessible :)

so here you have two options
1) configure Nginx and block all the request url start with /web/content and end with an unknown extension (allow only .js, .css. and image extension)
2) https://github.com/odoo/odoo/blob/11.0/odoo/addons/base/ir/ir_http.py#L325 
here you get filename check it and return 404 for an unknown extension.

Avatar
Descartar
Publicaciones relacionadas Respuestas Vistas Actividad
2
oct 19
3787
2
ago 19
4246
1
mar 23
14663
0
dic 22
3846
2
ago 25
582