Skip to main content
Jahia Store
EN

Request Safety Patch

supported
Download 1.17.1

Information

Module ID
request-safety-patch
Group ID
org.jahia.modules
Status
supported
Category
Security
Author
JSG
Developer website
http://www.jahia.com
Requires Jahia
8.0.0.0
Released
2026-09-21
Source
scm:git:git@github.com:Jahia/request-safety-patch.git
Tags
  • security

This module protects against two security vulnerabilities discovered in Jahia and documented on the Academy: https://academy.jahia.com/customer-center/security/security-advisories/security-patch-june-2026-jahia

Versions

1.17.1Download

Breaking Changes

  • Moved the four components that still lived in the org.sample.modules.sampleservletfilter package, a leftover of the Maven archetype this module was generated from, into org.jahia.modules.requestsafety. No detection logic, rule, status code, filter order or render priority changed.
    • Am I impacted? Only if you configure the Spring Web Flow guard: its OSGi configuration PID changed from org.sample.modules.sampleservletfilter.WebflowSpelFlowServletFilter to org.jahia.modules.requestsafety.filter.WebflowSpelFlowServletFilter. The three other moved components (the /atmosphere guard, the session-cookie validation and the HTML-externalisation disabler) carry no configuration, so nothing has to be renamed for them.
    • What to do: A configuration file named after the old PID must be renamed, or its settings stop applying. A file that followed the module documentation already used the new name: it did nothing until now, because the documentation named the package the component was about to move to, and it starts applying with this release. Either way, check the value of requireRenderedFlowOrigin, filterFlowParameterNames and additionalBindableNames after upgrading.
  • Unified every blocked-request log line into one format, at WARN level: [REQUEST-SAFETY-BLOCK] rule=<what matched> action=<reject-400|reject-405|blank-fragment> client=<ip> uri=<path>. 
    • Am I impacted? Only if an alert or dashboard matches the previous block messages, such as Blocked request from ..., Blanked 'link' view ... or invalid jid cookie: invalid UUID format. Those six wordings are gone, and the session-cookie rejection reasons became codes (invalid UUID format is now invalid-uuid).
    • What to do: Match on [REQUEST-SAFETY-BLOCK] instead. It is a complete and exact feed of what the module blocked, and a value a monitoring rule can group on. Activation and diagnostic lines carry the shorter [REQUEST-SAFETY] tag, which that search does not match. Two behaviour changes come with it: a blocked request is now logged once rather than twice, and a block arriving on an error dispatch is no longer silent.

Improvements

  • Refused a request whose Content-Type declares a charset outside an allow-list, UTF-8 by default, before the URL is read. 
    • A request that declares no charset is unaffected. Tune the list with allowedRequestCharsets, or turn the rule off with filterRequestCharset=false (PID org.jahia.modules.requestsafety.filter.MalformedUrlFilter) once the deployment runs a Jahia build that pins the URL-decoding charset itself.
  • Accepted only binding-path parameter names on the Spring Web Flow surface, replacing the single-character deny-list, and refused a request that reaches the /flow servlet directly rather than through a rendered content view. 
    • A deployment that ships its own flows can widen the grammar with additionalBindableNames; a pattern that would admit a known code-execution name is dropped with a warning rather than installed. The direct-request rule is controlled by requireRenderedFlowOrigin.
  • Ran the /atmosphere guard on FORWARD dispatches as well as REQUEST, so a request forwarded to the Atmosphere servlet by a core rewrite is inspected too.
  • Refused a request to an error page whose query string carries a line break, literal or percent-encoded.
    • A line break in a parameter elsewhere is unaffected. The rule is controlled by the enabled property of PID org.jahia.modules.requestsafety.filter.ErrorPageCrlfFilter.

Bug fixes

  • Brought the Spring Web Flow parameter-name grammar to parity with Jahia core's own guard, in both directions. 
    • A bare map key such as policy[minLength], the shape a Spring form tag emits for a map, was refused by 1.17.0 and answered 400 to an ordinary flow submission. It binds again.
    • A class-introspection path such as class.classLoader.resources was accepted in its dotted spelling. Every spelling is now refused, while cssClass, className and classes still bind.
Requires Jahia 8.0.0.0Released 2026-09-21
1.16.1Download
  • Change internal filter order
    • Am I impacted? If you're on any version before 1.16.1 and use non-ASCII characters in form-encoded POST requests — search terms, content fields, or anything with accented/special characters submitted from edit mode or the content managers — those values may have been mis-decoded or dropped. This is fixed by restoring the correct filter order so Jahia's own encoding handling runs first. Separately, if you run a custom UI theme whose name isn't purely letters/digits/hyphens/underscores, or rely on repository paths with leading/trailing whitespace in a segment, this release also enforces those restrictions.
    • What to do? Upgrade to 1.16.1 — no configuration change is required. If your theme name falls outside the allowed character set, rename the theme folder (or disable via OSGi PID EngineThemeParameterFilter, enabled=false); if you rely on whitespace-padded path segments, disable via the blockSegmentEdgeWhitespace option.
Requires Jahia 8.0.0.0Released 2026-08-26
1.15.0Download
  • Restricted the theme parameter accepted by engine views to letters, digits, hyphens, and underscores.
    • Am I impacted? Only if you run a custom theme whose folder name uses a character outside that set — requests for that theme are rejected once this filter is active. Deployments using standard themes are unaffected.
    • What to do: Rename the theme folder to that character set, or disable this specific check via OSGi configuration (PID org.jahia.modules.requestsafety.filter.EngineThemeParameterFilter, enabled=false) until it can be renamed.
Requires Jahia 8.0.0.0Released 2026-08-20
1.14.1Download
  • Disable double slash rejection by default, this corrects compatibility issues noticed with some other Jahia modules
Requires Jahia 8.0.0.0Released 2026-08-05
1.12.0Download
  • Fixed the WebFlow expression-injection guard blanking unrelated pages: it now inspects only WebFlow fragments, so a request parameter name containing a parenthesis (as produced by routine vulnerability scanners) no longer renders an empty page nor stores that empty page in the HTML cache for subsequent visitors. Protection against the injection itself is unchanged.
  • Enlarge the scope of the detection for malformed URL. 
Requires Jahia 8.0.0.0Released 2026-07-30
1.11.1Download

Bug fixes

  • Ensured we blanked only nt_base/html/link.jsp views 
Requires Jahia 8.0.0.0Released 2026-07-28
1.10.0Download

Improvements

  • Ensured the built-in link component always renders through this patch's safe view: any other source of that view is now blocked, so request parameters can no longer be reflected unescaped through it.
  • Blocked double-encoded URLs before security filters to prevent unauthenticated access to admin tools.
Requires Jahia 8.0.0.0Released 2026-07-24

Improvements

Hardened the /atmosphere X-Atmosphere-Post-Body block to scan the raw query string

Requires Jahia 8.0.0.0Released 2026-07-15

Improvements

Closed an additional /atmosphere bypass using a GET request

Requires Jahia 8.0.0.0Released 2026-07-14

Improvements

Escapes nt:base link view params and pause HTML externalization filter

Requires Jahia 8.0.0.0Released 2026-07-14

Improvements

  • Closed /atmosphere/rpc filter bypass
Requires Jahia 8.0.0.0Released 2026-06-26

Initial version of the module

Requires Jahia 8.0.0.0Released 2026-06-01