Handling files in Multipart request to fix Struts 1.x vulnerability issue

Question

The Struts 1.x vulnerability issue as mentioned below:

Apache Struts is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions.

To handle multipart requests we used the following code:

DiskFileItemFactory factory = new DiskFileItemFactory();
        // Configure a repository (to ensure a secure temp location is
        // used)
        ServletContext servletContext = filterConfig.getServletContext();
        File repository = (File) servletContext.getAttribute( "javax.servlet.context.tempdir" );
        factory.setRepository( repository );// Create a new file upload
        // handler
        ServletFileUpload upload = new ServletFileUpload( factory );
        // Parse the request
        List<FileItem> multipartItems = upload.parseRequest( request );
        // Prepare the request parameter map.
        Map<String, String[]> parameterMap = new HashMap<String, String[]>();
        // Loop through multipart request items.
        for ( FileItem multipartItem : multipartItems )
        {
            if ( multipartItem.isFormField() )
            {
                // Process regular form field (input type="text|radio|checkbox|etc", select, etc).
                processFormField( multipartItem, parameterMap );
            }
            else
            {
                // Process form file field (input type="file").
                processFileField( multipartItem, request );
            }
        }

We are processing the file field as:

 private void processFileField( FileItem fileField, HttpServletRequest request )
{
    if ( fileField.getName().length() <= 0 )
    {
        // No file uploaded.
        request.setAttribute( fileField.getFieldName(), null );
    }
    else
    {
        // File uploaded with good size.
        request.setAttribute( fileField.getFieldName(), fileField );
    }
}

But in Action class, when we are trying to retrieve the form field, we are getting NULL. How do we get the file field in the form.

Options tried are: 1) Setting multipartItem.setFormField() as true 2) Setting the form field along with non-file parameters.

None of the above helped. Need ideas.

score 0 · Answer 1 · edited May 23 '17 at 12:30

0

You forgot to check if request is a maltipart form request. For example

boolean isMultipart = ServletFileUpload.isMultipartContent(request);

For a code snippet you should check out this answer File upload with ServletFileUpload's parseRequest.

edited May 23 '17 at 12:30

Community

1
1

answered May 07 '14 at 16:45

Roman C

49,761
33
66
176

We are implementing the first piece of code using "DiskFileItemFactory " only when the request is a multipart form request. That code has not been mentioned in the question. The issue we are facing is retrieveing the FormFile details in Action class. It seems that the FormFile field is resetted. – SMI May 08 '14 at 05:23

Handling files in Multipart request to fix Struts 1.x vulnerability issue

1 Answers1