Skip to Content
मेन्यू
This question has been flagged
1 Reply
3789 Views

Hello,

We are are trying to make a pci compliant website with odoo community 11, in particular we are getting a vulnerability issue, with a Saint scan software when it tries to execute index.jsp (wich of course doesn't exists in Odoo), Odoo webserver response with Javascript code (here a fragment):


Sent: GET /web/content/1715-456fe75/index.JSP

_.isFunction(value)?value.call(object):value;};var idCounter=0;_.uniqueId=function(prefix){var
id=++idCounter+'';return prefix?prefix+id:id;};_.templateSettings={evaluate:/<%([\s\S]+?)%>/g,interpolate:
/<%=([\s\S]+?)%>/g,escape:/<%-([\s\S]+?)%>/g};var noMatch=/(.)^/;var escapes={"'":"'",'\\':'\\','

Is there any way to avoid this?

Regards,

Avatar
Discard
Best Answer

odoo minify all the js and css content and stored in a database and generate unique/hash URL starts with /web/content/XXX/assets and server it WebClient as static assets. sadly it didn't check file extraction resource request.

even GET /web/content/1715-456fe75/index.sucks  # it also accessible :)

so here you have two options
1) configure Nginx and block all the request url start with /web/content and end with an unknown extension (allow only .js, .css. and image extension)
2) https://github.com/odoo/odoo/blob/11.0/odoo/addons/base/ir/ir_http.py#L325 
here you get filename check it and return 404 for an unknown extension.

Avatar
Discard
Related Posts Replies Views Activity
2
अक्तू॰ 19
3782
2
अग॰ 19
4245
1
मार्च 23
14661
0
दिस॰ 22
3842
2
अग॰ 25
574