Allowlist Support

14 Allowlist Support

In the Oracle Cloud implementations of your application, the use of allow list is enforced to protect resources within the implementation. These allowlists can also apply to non-cloud implementations and in some cases can be extended to suit individual needs.

Note:

Custom allowlists are not supported on Oracle Utilities SaaS Cloud Services.

URL Allowlist

Note:

The URL allowlist is blank by default unless otherwise configured as part of your customizations.

Note:

For this facility to be used the com.oracle.ouaf.uriValidation.enable parameter in the spl.properties file must be set to true.

It is possible to limit the values of URL's within the product for key objects with the configuration. This is implemented as a allowlist that can filter on scheme (aka protocol), hosts and ports. These are checked at runtime and can generate an error if they do not adhere to the allowlist.

The feature allows for the following:

Individual scheme hosts and port combinations can be configured to limit runtime access for specific features.
Specification of the '*' wildcard is supported for scheme, hosts and ports.

The allowlist is configured using the following settings in the spl.properties file:

Configuration Parameter	Comments
`com.oracle.ouaf.uriValidation.enable`	Enable or disable URI validation.
`com.oracle.ouaf.whitelist.file`	Location and name of product allowlist file.
`com.oracle.ouaf.customer.whitelist.file`	Location and name of custom allowlist file.

The format of the allowlist file is as follows:

XML Tag	Comments
`"<Parameter>"`	Feature within product to limit. This is a preset string linked to a URI parameter in the product.
`uri`	URI tag.
`scheme`	Protocol supported by `<Parameter>`. Valid values will vary depending on the `<Parameter>` value. For example, URL's support `file, http, https`, and so on.
`host`	Host name(s) or IP Address(es) to filter upon.
`port`	Port number(s) to filter upon.

For example:

<?xml version="1.0" encoding="UTF-8"?>
<whitelist>
…
"Message Sender HTTP URL properties"
<uri>
<scheme>https<scheme/>
<host>myhost.mycompany.com<host/>
<port>*<port/>
</uri>
…
</whitelist>

Refer to the Server Administration Guide for more details of the usage and format of this file.

Implementing a Custom URL Allowlists

It is possible to establish a custom allow ist to implement URL allowlists for non-cloud implementations. The format of the allowlist is the same as the above allowlist and this will augment and enhance the existing allowlist (if present). To support a custom allowlist perform the following steps:

Logon to the machine you have made the changes upon as the product administrator.
If you have not already done so, use the splenviron utility to set the environment variables for the product environment.
If it does not already exist, clone the product allowlist located as indicated in the com.oracle.ouaf.whitelist.file parameter. Ensure the custom file is in the same location as this allow list file and is prefixed with "cm" to indicate it is a customization. The file name can be valid for your operating system and site preferences and must be suffixed with ".xml". Uncomment any section you want to set.
Create a custom spl.properties template or use the templating function to set the following parameter with the filename and location of the custom allow ist.
com.oracle.ouaf.customer.whitelist.file=<filename>
Execute the initialSetup.shto implement the new setting.

SQL Allowlist

Note:

Custom SQL Allowlists are not supported at this time.

Sites not wanting to use this SQL function allow list should ensure that the spl.runtime.customSQLSecurity is set to false in the spl.properties file.

The SQL used in query zones and in Groovy scripts can be limited in terms of what SQL functions are supported to prevent performance issues or inappropriate access to the database via functions.

The product provided allow list is implemented as a Managed Content object named F1-SQLFunctionWhiteList. This allow list is not changeable and lists the supported functions that are allow listed for use. Any function used that is not used in this allow list, if the facility is enabled, will generate a runtime error when the SQL is executed.

HTML Allowlist

The HTML used in UI Maps can be limited using a HTML allow list. This product managed allow list lists the valid HTML tags that can be used in the HTML objects. The allow list is implemented as a Managed Content allow list named F1-HTMLWhiteList.

Any attempt to run a UI Map with a tag that is not listed in the F1-HTMLWhiteList will be ignored (as comments) which may lead to unexpected behavior.

Implementing a Custom HTML Allowlist

It is possible to replace the inbuilt HTML allow list by creating a custom HTML allow list to extend the tags supported at runtime in UI Maps.

To implement a custom HTML allow list, copy the F1-HTMLWhiteList Managed Content to CM-HTMLWhiteList Managed Content and extend the allowlist.

Note:

Do not remove any tags that exist within F1-HTMLWhiteList in your custom allowlist. This may cause unexpected behavior across base UI Maps.

Any upgrades to F1-HTMLWhiteList must be also manually reflected in CM-HTMLWhiteList for any subsequent upgrade.

Groovy Allowlist

The Groovy language has been added as an alternative language used for scripting. As the Groovy language can access low level API's it has been allow listed to exclude parts of the language not appropriate for cloud implementations. The allowlist confirms to the Oracle Cloud SDK Supported Classes and Methods for Use in Groovy Scripting. ADF extensions to Groovy are not supported. Refer to the online documentation for additional advice and examples.