Skip to content

Commit 6fa7bcf

Browse files
kwwalljeremiahjstacey
kwwall
authored and
jeremiahjstacey
committed
Final preparation for ESAPI 2.2.0.0 release (#501)
* Change release version to 2.2.0.0 for official release. * Update / correct ESAPI release steps. * Fix ironic spelling typo. * Fix ironic spelling typo. * Changes to suppress most of the noise, but also fixes to all for .XML and .PROPERTIES suffixes and to fix and return null when property is null or empty string. * Changes to suppress most of the noise and to actually handle the exceptions that we should have been all along (e.g., IOExceptions). * Comment out the crude benchmark related assertion that sometimes was failing because of JIT-related issues. Needs to be eventually replaced by JMH. * Close #499 by resetting 'parent' when Windows is detected to root of drive where Windows is installed. * Close issue #488. These are slight enhancements to PR #489 by @JoergAdler that I rejected because Eclipse did something to cause every line to differ. But shout out to Jörg Adler for originally finding this issue and patching it. * Close issue #488. These are slight enhancements to PR #489 by @JoergAdler that I rejected because Eclipse did something to cause every line to differ. But shout out to Jörg Adler for originally finding this issue and patching it. I also added an additional test or 2, so don't blame @JoergAdler if I messed that up. * Close issue #488. These are slight enhancements to PR #489 by @JoergAdler that I rejected because Eclipse did something to cause every line to differ. But shout out to Jörg Adler for originally finding this issue and patching it. I tremendously stripped down the contents of this file because really all it needed was a single property referencing the validation.properties file. * Add 3 additional issues that were closed and fixes to some minor formatting. * Final updates for the ESAPI 2.2.0.0 official release. * Figure I probably ought to add my name instead of assuming people knew it and my email address. * Changed schema from allowing unbounded number of properties to allow only 10000. That really should NOT be a problem. However, it should help silence some of the SAST engines. * Additional changes to fix GitHub Issue #500
1 parent 06aa99e commit 6fa7bcf

23 files changed

+516
-122
lines changed

‎CONTRIBUTING-TO-ESAPI.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Finding Something Interesting to Work on:
1717
what it is. Then if you want to work on a particular issue, we can assign
1818
it to you so someone else won't take it.
1919

20-
If you have questions, email me or Matt Seil ([email protected]).
20+
If you have questions, email Kevin Wall ([email protected]) or Matt Seil ([email protected]).
2121

2222
Overview:
2323
We are following the branching model described in

‎documentation/ESAPI-release-steps.odt‎

105 KB
Binary file not shown.

‎documentation/esapi4java-core-2.2.0.0-release-notes.txt‎

Lines changed: 31 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
Release notes for ESAPI 2.2.0.0
2-
Release date: 2019-MMM-DD
2+
Release date: 2019-June-23
33
Project leaders:
44
-Kevin W. Wall <[email protected]>
55
-Matt Seil <[email protected]>
@@ -26,14 +26,14 @@ It was mainly because of these first two bullet items above that we bumped the r
2626
Basic ESAPI facts
2727

2828
ESAPI 2.1.0.1 release:
29-
177 source files
30-
1547 Junit tests
29+
177 Java source files
30+
1547 Junit tests in 88 Java source files
3131

3232
ESAPI 2.2.0.0 release:
33-
194 source files
34-
4145 JUnit tests!!!!!
33+
194 Java source files
34+
4150 JUnit tests in 118 Java source files
3535

36-
That's 2598 NEW tests since the 2.1.0.1 release!!!
36+
That's 2603 NEW tests since the 2.1.0.1 release!!!
3737

3838
GitHub Issues fixed in this release
3939
[i.e., since 2.1.0.1 release on 2016-Feb-05]
@@ -149,22 +149,26 @@ Issue # GitHub Issue Title
149149
462 Allow configurable init parameter in ESAPIFilter for unauthorized requests
150150
463 Create release notes for next ESAPI release
151151
465 Update both ESAPI.properties files to show comment for ESAPI logger support for SLF4J
152-
471 Bump ESAPI release # to 2.2.0.0
153-
476 DefaultValidator.getValidInput implementation ignores 'canonicalize' method parameter
154-
478 Remove obsolete references to Google Code in pom.xml and any other release prep
152+
471 Bump ESAPI release # to 2.2.0.0
153+
476 DefaultValidator.getValidInput implementation ignores 'canonicalize' method parameter
154+
478 Remove obsolete references to Google Code in pom.xml and any other release prep
155155
482 ESAPI 2.2.0.0 release date?
156-
483 More miscellaneous prep work for ESAPI 2.2.0.0 release
157-
485 Update Maven dependency check plugin to 5.0.0-M2
156+
483 More miscellaneous prep work for ESAPI 2.2.0.0 release
157+
485 Update Maven dependency check plugin to 5.0.0-M2
158+
488 Missed a legal input case in DefaultSecurityConfiguration.java
158159
492 Release candidates on maven central
159160
493 wrong regex validation
161+
499 ValidatorTest.isValidDirectoryPath() has tests that fail under Windows if ESAPI tests run from different drive where Windows installed
162+
500 Suppress noise from ESAPI searching for properties and stop ignoring important IOExceptions
163+
160164

161165
-----------------------------------------------------------------------------
162166

163167
Changes requiring special attention
164168

165169
* Various deprecated methods were _actually_ deleted! This could break existing application code.
166170

167-
442 Remove deprecated fields in Encoder interface
171+
Issue 442 Remove deprecated fields in Encoder interface
168172

169173
Specifically, if you are using any of these previously deprecated fields from the Encoder interface, you need to update your application code to refer insteat to the constances from org.owasp.esapi.EncoderConstants:
170174

@@ -180,19 +184,19 @@ Issue # GitHub Issue Title
180184
public final static char[] CHAR_PASSWORD_SPECIALS = EncoderConstants.CHAR_PASSWORD_SPECIALS;
181185
public final static char[] CHAR_PASSWORD_LETTERS = EncoderConstants.CHAR_PASSWORD_LETTERS;
182186

183-
444 Delete deprecated method Base64.decodeToObject() and related methods
187+
Issue 444 Delete deprecated method Base64.decodeToObject() and related methods
184188

185189
Specifically, the following methods were removed from the org.owasp.esapi.codecs.Base64 class. If you will using any of these methods, you likely already had vulnerabilities in your application code. If any of these methods were being used, you will need to rewrite your application code:
186190

187191
public static String encodeObject( java.io.Serializable serializableObject )
188192
public static String encodeObject( java.io.Serializable serializableObject, int options )
189193
public static Object decodeToObject( String encodedObject )
190194

191-
483 More miscellaneous prep work for ESAPI 2.2.0.0 release
195+
Issue 483 More miscellaneous prep work for ESAPI 2.2.0.0 release
192196
Specifically, CipherText.getSerialVersionUID() and DefaultSecurityConfiguration.MAX_FILE_NAME_LENGTH have actually been deleted from the ESAPI code base. For the former, use CipherText.cipherTextVersion() instead. For the latter, there is no replacement. (This wasn't being used, but it was set to 1000 in case you're wondering.)
193197

194198
* Various properties in ESAPI.properties were changed in a way that might affect your application:
195-
439 Tighten ESAPI defaults to disallow dubious file suffixes
199+
Issue 439 Tighten ESAPI defaults to disallow dubious file suffixes
196200

197201
Specifically, the property HttpUtilities.ApprovedUploadExtensions changed from
198202
HttpUtilities.ApprovedUploadExtensions=.zip,.pdf,.doc,.docx,.ppt,.pptx,.tar,.gz,.tgz,.rar,.war,.jar,.ear,.xls,.rtf,.properties,.java,.class,.txt,.xml,.jsp,.jsf,.exe,.dll
@@ -220,6 +224,18 @@ Issue # GitHub Issue Title
220224
to:
221225
Validator.HTTPURI=^/([a-zA-Z0-9.\\-_]*/?)*$
222226

227+
* Other changes:
228+
Issue 500 Suppress noise from ESAPI searching for properties and stop ignoring important IOExceptions
229+
230+
Fixing this required changes to the CTORs of the following classes:
231+
232+
org.owasp.esapi.configuration.EsapiPropertyManager
233+
org.owasp.esapi.configuration.AbstractPrioritizedPropertyLoader
234+
org.owasp.esapi.configuration.EsapiPropertyLoaderFactory
235+
org.owasp.esapi.configuration.StandardEsapiPropertyLoader
236+
org.owasp.esapi.configuration.XmlEsapiPropertyLoader
237+
238+
These CTORs now explicitly throw IOException if the specified ESAPI property file is not found or not readable. Note that this should not affect most people as most use DefaultSecurityCOnfigurator and it still only throws ConfigurationException. (IOExceptions from these other classes are caught and rethrow as ConfigurationException.) Use of these classes directly should be very rare.
223239

224240
-----------------------------------------------------------------------------
225241

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<modelVersion>4.0.0</modelVersion>
44
<groupId>org.owasp.esapi</groupId>
55
<artifactId>esapi</artifactId>
6-
<version>2.2.0.0-RC3</version>
6+
<version>2.2.0.0</version>
77
<packaging>jar</packaging>
88

99
<distributionManagement>

‎src/main/java/org/owasp/esapi/configuration/AbstractPrioritizedPropertyLoader.java‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33

44
import java.io.File;
5+
import java.io.FileNotFoundException;
6+
import java.io.IOException;
57
import java.util.Properties;
68

79
/**
@@ -32,7 +34,7 @@ public abstract class AbstractPrioritizedPropertyLoader implements EsapiProperty
3234

3335
private final int priority;
3436

35-
public AbstractPrioritizedPropertyLoader(String filename, int priority) {
37+
public AbstractPrioritizedPropertyLoader(String filename, int priority) throws IOException {
3638
this.priority = priority;
3739
this.filename = filename;
3840
initProperties();
@@ -64,13 +66,17 @@ public String name() {
6466
/**
6567
* Initializes properties object and fills it with data from configuration file.
6668
*/
67-
private void initProperties() {
69+
private void initProperties() throws IOException {
6870
properties = new Properties();
6971
File file = new File(filename);
7072
if (file.exists() && file.isFile()) {
71-
loadPropertiesFromFile(file);
73+
if ( file.canRead() ) {
74+
loadPropertiesFromFile(file);
75+
} else {
76+
throw new IOException("Can't read specificied configuration file: " + filename);
77+
}
7278
} else {
73-
logSpecial("Configuration file " + filename + " does not exist");
79+
throw new FileNotFoundException("Specified configuration file " + filename + " does not exist or not regular file");
7480
}
7581
}
7682

‎src/main/java/org/owasp/esapi/configuration/EsapiPropertyLoaderFactory.java‎

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
import org.owasp.esapi.configuration.consts.EsapiConfiguration;
44
import org.owasp.esapi.errors.ConfigurationException;
55

6-
import java.io.FileNotFoundException;
6+
import java.io.IOException;
77

88
import static org.owasp.esapi.configuration.consts.EsapiConfigurationType.PROPERTIES;
99
import static org.owasp.esapi.configuration.consts.EsapiConfigurationType.XML;
@@ -17,17 +17,38 @@
1717
public class EsapiPropertyLoaderFactory {
1818

1919
public static AbstractPrioritizedPropertyLoader createPropertyLoader(EsapiConfiguration cfg)
20-
throws ConfigurationException, FileNotFoundException {
20+
throws ConfigurationException, IOException {
2121
String cfgPath = System.getProperty(cfg.getConfigName());
22-
if (cfgPath == null) {
23-
throw new ConfigurationException("System property [" + cfg.getConfigName() + "] is not set");
22+
if ( cfgPath == null || cfgPath.equals("") ) {
23+
// TODO / FIXME:
24+
// This case was previously a warning, but it should NOT have been
25+
// since these system properties are optional. Most people just use
26+
// the traditional ESAPI.properties file and not these prioritized ones.
27+
// A warning gets logged in EsapiPropertyManager if logSpecial output
28+
// has not been discarded.
29+
//
30+
// Note also there were a LOT of cases in our JUnit tests where the
31+
// file extension was empty, causing the ConfigurationException to
32+
// be thrown with the error message:
33+
// "Configuration storage type [] is not supported"
34+
// I don't think that was intentional, but because prior to the
35+
// changes for this commit, these were all ConfigurationExceptions
36+
// and they all were just being caught and not re-thrown by
37+
// DefaultSecurityConfigurator. I think that is an error, probably
38+
// in the tests, but I don't have timed to chase it down right now
39+
// because of the pending 2.2.0.0 release.
40+
//
41+
// Also, I made several fixes in DefaultSecurityConfiguration
42+
// related to this clean-up where IOExceptions were being silently
43+
// caught when they should not have been. -kwwall
44+
return null;
2445
}
2546
String fileExtension = cfgPath.substring(cfgPath.lastIndexOf('.') + 1);
2647

27-
if (XML.getTypeName().equals(fileExtension)) {
48+
if (XML.getTypeName().equalsIgnoreCase(fileExtension)) {
2849
return new XmlEsapiPropertyLoader(cfgPath, cfg.getPriority());
2950
}
30-
if (PROPERTIES.getTypeName().equals(fileExtension)) {
51+
if (PROPERTIES.getTypeName().equalsIgnoreCase(fileExtension)) {
3152
return new StandardEsapiPropertyLoader(cfgPath, cfg.getPriority());
3253
} else {
3354
throw new ConfigurationException("Configuration storage type [" + fileExtension + "] is not " +

‎src/main/java/org/owasp/esapi/configuration/EsapiPropertyManager.java‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,15 @@
44
import org.owasp.esapi.errors.ConfigurationException;
55

66
import java.util.TreeSet;
7+
import java.io.IOException;
78

89
import static org.owasp.esapi.configuration.EsapiPropertyLoaderFactory.createPropertyLoader;
910

11+
// Have dependency like this on a reference implmentation is majorly ugly, I know, but I
12+
// don't want to refactor code and delay the 2.2.0.0 release further and this class
13+
// is WAY too noisy. - kwwall
14+
import static org.owasp.esapi.reference.DefaultSecurityConfiguration.logToStdout;
15+
1016
/**
1117
* Manager used for loading security configuration properties. Does all the logic to obtain the correct property from
1218
* correct source. Uses following system properties to find configuration files:
@@ -21,7 +27,7 @@ public class EsapiPropertyManager implements EsapiPropertyLoader {
2127

2228
protected TreeSet<AbstractPrioritizedPropertyLoader> loaders;
2329

24-
public EsapiPropertyManager() {
30+
public EsapiPropertyManager() throws IOException {
2531
initLoaders();
2632
}
2733

@@ -34,7 +40,7 @@ public int getIntProp(String propertyName) throws ConfigurationException {
3440
try {
3541
return loader.getIntProp(propertyName);
3642
} catch (ConfigurationException e) {
37-
System.err.println("Property not found in " + loader.name());
43+
logToStdout("Integer property '" + propertyName + "' not found in " + loader.name(), e);
3844
}
3945
}
4046
throw new ConfigurationException("Could not find property " + propertyName + " in configuration");
@@ -49,7 +55,7 @@ public byte[] getByteArrayProp(String propertyName) throws ConfigurationExceptio
4955
try {
5056
return loader.getByteArrayProp(propertyName);
5157
} catch (ConfigurationException e) {
52-
System.err.println("Property not found in " + loader.name());
58+
logToStdout("Byte array property '" + propertyName + "' not found in " + loader.name(), e);
5359
}
5460
}
5561
throw new ConfigurationException("Could not find property " + propertyName + " in configuration");
@@ -64,7 +70,7 @@ public Boolean getBooleanProp(String propertyName) throws ConfigurationException
6470
try {
6571
return loader.getBooleanProp(propertyName);
6672
} catch (ConfigurationException e) {
67-
System.err.println("Property not found in " + loader.name());
73+
logToStdout("Boolean property '" + propertyName + "' not found in " + loader.name(), e);
6874
}
6975
}
7076
throw new ConfigurationException("Could not find property " + propertyName + " in configuration");
@@ -79,25 +85,37 @@ public String getStringProp(String propertyName) throws ConfigurationException {
7985
try {
8086
return loader.getStringProp(propertyName);
8187
} catch (ConfigurationException e) {
82-
System.err.println("Property : " + propertyName + " not found in " + loader.name());
88+
logToStdout("Property '" + propertyName + "' not found in " + loader.name(), e);
8389
}
8490
}
8591
throw new ConfigurationException("Could not find property " + propertyName + " in configuration");
8692
}
8793

88-
private void initLoaders() {
94+
private void initLoaders() throws IOException {
8995
loaders = new TreeSet<AbstractPrioritizedPropertyLoader>();
9096
try {
91-
loaders.add(createPropertyLoader(EsapiConfiguration.OPSTEAM_ESAPI_CFG));
92-
} catch (Exception e) {
93-
System.err.println(e.getMessage());
97+
AbstractPrioritizedPropertyLoader appl = createPropertyLoader(EsapiConfiguration.OPSTEAM_ESAPI_CFG);
98+
if ( appl == null ) {
99+
String msg = "WARNING: System property [" + EsapiConfiguration.OPSTEAM_ESAPI_CFG.getConfigName() + "] is not set";
100+
logToStdout(msg, null);
101+
} else {
102+
loaders.add( appl );
103+
}
104+
} catch (IOException e) {
105+
logToStdout("WARNING: Exception encountered while setting up ESAPI configuration manager for OPS team", e);
106+
throw e;
94107
}
95108
try {
96-
loaders.add(createPropertyLoader(EsapiConfiguration.DEVTEAM_ESAPI_CFG));
97-
} catch (Exception e) {
98-
System.err.println(e.getMessage());
109+
AbstractPrioritizedPropertyLoader appl = createPropertyLoader(EsapiConfiguration.DEVTEAM_ESAPI_CFG);
110+
if ( appl == null ) {
111+
String msg = "WARNING: System property [" + EsapiConfiguration.DEVTEAM_ESAPI_CFG.getConfigName() + "] is not set";
112+
logToStdout(msg, null);
113+
} else {
114+
loaders.add( appl );
115+
}
116+
} catch (IOException e) {
117+
logToStdout("WARNING: Exception encountered while setting up ESAPI configuration manager for DEV team", e);
118+
throw e;
99119
}
100120
}
101-
102-
103121
}

‎src/main/java/org/owasp/esapi/configuration/StandardEsapiPropertyLoader.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
*/
1313
public class StandardEsapiPropertyLoader extends AbstractPrioritizedPropertyLoader {
1414

15-
public StandardEsapiPropertyLoader(String filename, int priority) {
15+
public StandardEsapiPropertyLoader(String filename, int priority) throws IOException {
1616
super(filename, priority);
1717
}
1818

‎src/main/java/org/owasp/esapi/configuration/XmlEsapiPropertyLoader.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
*/
2727
public class XmlEsapiPropertyLoader extends AbstractPrioritizedPropertyLoader {
2828

29-
public XmlEsapiPropertyLoader(String filename, int priority) {
29+
public XmlEsapiPropertyLoader(String filename, int priority) throws IOException {
3030
super(filename, priority);
3131
}
3232

@@ -80,7 +80,7 @@ public Boolean getBooleanProp(String propertyName) throws ConfigurationException
8080
return false;
8181
} else {
8282
throw new ConfigurationException("Incorrect type of : " + propertyName + ". Value " + property +
83-
"cannot be converted to boolean");
83+
"cannot be converted to boolean; legal values are: true, false, yes, no");
8484
}
8585
}
8686

@@ -120,6 +120,7 @@ protected void loadPropertiesFromFile(File file) throws ConfigurationException {
120120
}
121121
}
122122
} catch (Exception e) {
123+
logSpecial("XML config file " + filename + " has invalid schema", e);
123124
throw new ConfigurationException("Configuration file : " + filename + " has invalid schema." + e.getMessage(), e);
124125
}
125126
}

‎src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -235,9 +235,9 @@ public static SecurityConfiguration getInstance() {
235235
*/
236236
DefaultSecurityConfiguration(String resourceFile) {
237237
this.resourceFile = resourceFile;
238-
this.esapiPropertyManager = new EsapiPropertyManager();
239238
// load security configuration
240239
try {
240+
this.esapiPropertyManager = new EsapiPropertyManager();
241241
loadConfiguration();
242242
this.setCipherXProperties();
243243
} catch( IOException e ) {
@@ -646,7 +646,13 @@ private Properties loadConfigurationFromClasspath(String fileName) throws Illega
646646
try {
647647
// try root
648648
String currentClasspathSearchLocation = "/ (root)";
649-
in = loaders[i].getResourceAsStream(DefaultSearchPath.ROOT.toString());
649+
// Note: do NOT add '/' anywhere here even though root value is empty string!
650+
// Note that since DefaultSearchPath.ROOT.value() is now "" (the empty string),
651+
// then this is logically equivalent to what we used to have, which was:
652+
//
653+
// in = loaders[i].getResourceAsStream(fileName);
654+
//
655+
in = loaders[i].getResourceAsStream(DefaultSearchPath.ROOT.value() + fileName);
650656

651657
// try resourceDirectory folder
652658
if (in == null) {
@@ -1391,7 +1397,7 @@ public enum DefaultSearchPath {
13911397

13921398
RESOURCE_DIRECTORY("resourceDirectory/"),
13931399
SRC_MAIN_RESOURCES("src/main/resources/"),
1394-
ROOT("/"),
1400+
ROOT(""),
13951401
DOT_ESAPI(".esapi/"),
13961402
ESAPI("esapi/"),
13971403
RESOURCES("resources/");

0 commit comments

Comments
 (0)