Skip to content

Commit 8a1a297

Browse files
committed
Added deprecations, deprecation warnings, and other Javadoc refinements.
1 parent 05605c4 commit 8a1a297

File tree

5 files changed

+95
-23
lines changed

5 files changed

+95
-23
lines changed

src/main/java/org/owasp/esapi/Encoder.java

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -490,8 +490,14 @@ public interface Encoder {
490490
* the text to encode for SQL
491491
*
492492
* @return input encoded for use in SQL
493+
* @see <a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf">
494+
* ESAPI Security Bulletin #13</a>
495+
* @deprecated This class is considered dangerous and not easily made safe and thus under strong
496+
* consideration to be removed within 1 years time after the 2.7.0.0 release. Please
497+
* see the referenced ESAPI Security Bulletin #13 for further details.
493498
*/
494-
String encodeForSQL(Codec codec, String input);
499+
@Deprecated
500+
String encodeForSQL(Codec codec, String input);
495501

496502
/**
497503
* Encode for an operating system command shell according to the selected codec (appropriate codecs include the WindowsCodec and UnixCodec).

src/main/java/org/owasp/esapi/codecs/DB2Codec.java

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,13 @@
2626
* @author Sivasankar Tanakala ([email protected])
2727
* @since October 26, 2010
2828
* @see org.owasp.esapi.Encoder
29+
* @see <a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf">
30+
* ESAPI Security Bulletin #13</a>
31+
* @deprecated This class is considered dangerous and not easily made safe and thus under strong
32+
* consideration to be removed within 1 years time after the 2.7.0.0 release. Please
33+
* see the referenced ESAPI Security Bulletin #13 for further details.
2934
*/
35+
@Deprecated
3036
public class DB2Codec extends AbstractCharacterCodec {
3137

3238
public String encodeCharacter(char[] immune, Character c) {

src/main/java/org/owasp/esapi/codecs/MySQLCodec.java

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,13 @@
6363
* <a href= "https://dev.mysql.com/doc/refman/8.0/en/string-literals.html">MySQL 8.0 String Literals</a>
6464
* <a href= "https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet#MySQL_Escaping">OWASP
6565
* SQL_Injection_Prevention_Cheat_Sheet#MySQL_Escaping</a>
66+
* @see <a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf">
67+
* ESAPI Security Bulletin #13</a>
68+
* @deprecated This class is considered dangerous and not easily made safe and thus under strong
69+
* consideration to be removed within 1 years time after the 2.7.0.0 release. Please
70+
* see the referenced ESAPI Security Bulletin #13 for further details.
6671
*/
72+
@Deprecated
6773
public class MySQLCodec extends AbstractCharacterCodec {
6874
/**
6975
* Specifies the SQL Mode the target MySQL Server is running with. For details about MySQL Server Modes

src/main/java/org/owasp/esapi/codecs/OracleCodec.java

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,44 @@
2020
/**
2121
* Implementation of the {@link org.owasp.esapi.codecs.Codec} interface for Oracle DB strings.
2222
* This function will only protect you from SQLi in limited situations.
23-
* To improve your chances of success, you made also need to do some
23+
* To improve your chances of success, you may also need to do some
2424
* additional canonicalization and input validation first. Before using this class,
25-
* please be sure to read the "SECURITY WARNING" in
25+
* please be sure to read the "<b>SECURITY WARNING</b>" in
2626
* {@link org.owasp.esapi.Encoder#encodeForSQL}
2727
* before using this particular {@link org.owasp.esapi.codecs.Codec} and raising your hope of finding
2828
* a silver bullet to kill all the SQLi werewolves.
29-
*
30-
* @see <a href="http://oraqa.com/2006/03/20/how-to-escape-single-quotes-in-strings/">how-to-escape-single-quotes-in-strings</a>
31-
*
29+
* </p><p>
30+
* <b>CAUTION:</b> This class has some known issues. During the investigation of
31+
* CVE-2025-5878, it was discovered that since this class' inception in
32+
* 2007, that Oracle databases also use \ (backslash) as a default escape char.
33+
* That was fundamental in the vulnerability, since the escape character itself
34+
* was not being escaped. We had originally planned to address this, but while
35+
* researching the issue, we discovered that not only was there a new default
36+
* escape character for Oracle SQL*Plus, but that developers could actually
37+
* override the default to a character of their choosing. (For details see
38+
* <a href="https://www.oreilly.com/library/view/oracle-sqlplus-the/0596007469/re62.html">SET ESCAPE</a>
39+
* and <a href="https://techjourney.net/how-to-escape-characters-in-oracle-plsql-queries/">
40+
* How to Escape Characters in Oracle PL/SQL Queries</a>.) The second instance is
41+
* especially scary, since it illustrates how a developer can potentially can
42+
* the default escape character as part of an ordinary SQL statement. We
43+
* realized that there is no way we can defend against this, so it seemed
44+
* pointless to even bother to try to quote default escape character passed in
45+
* as input when {@code OracleCodec} is used with the {@code Encoder.encodeForSQL}
46+
* interface. Therefore, you really should not use this, but if dead set in
47+
* still using this leg canon, it;s on you. You have been warned.
48+
* </p>
49+
* @see org.owasp.esapi.Encoder
50+
* @see <a href="https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf">
51+
* ESAPI Security Bulletin #13</a>
3252
* @author Jeff Williams (jeff.williams .at. aspectsecurity.com) <a href="http://www.aspectsecurity.com">Aspect Security</a>
3353
* @author Jim Manico ([email protected]) <a href="http://www.manico.net">Manico.net</a>
3454
* @since June 1, 2007
35-
* @see org.owasp.esapi.Encoder
55+
* @see <a href="http://oraqa.com/2006/03/20/how-to-escape-single-quotes-in-strings/">how-to-escape-single-quotes-in-strings</a>
56+
* @deprecated This class is considered dangerous and not easily made safe and thus under strong
57+
* consideration to be removed within 1 years time after the 2.7.0.0 release. Please
58+
* see the referenced ESAPI Security Bulletin #13 for further details.
3659
*/
60+
@Deprecated
3761
public class OracleCodec extends AbstractCharacterCodec {
3862

3963

src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java

Lines changed: 46 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -43,29 +43,59 @@
4343
import org.owasp.esapi.errors.ConfigurationException;
4444

4545
/**
46-
* The reference {@code SecurityConfiguration} manages all the settings used by the ESAPI in a single place. In this reference
47-
* implementation, resources can be put in several locations, which are searched in the following order:
46+
* Thse reference implementation class for {@code SecurityConfiguration} manages all the settings used by the ESAPI
47+
* in a single place. In this reference implementation, resources can be put in several locations, which are
48+
* searched in the following order:
4849
* <p>
49-
* 1) Inside a directory set with a call to SecurityConfiguration.setResourceDirectory( "C:\temp\resources" ).
50-
* <p>
51-
* 2) Inside the System.getProperty( "org.owasp.esapi.resources" ) directory.
50+
* <ol>
51+
* <li>
52+
* Inside a directory set with a call to SecurityConfiguration.setResourceDirectory( "C:\temp\resources" ).
53+
* </p><p>
54+
* <b>CAUTION:</b> Generally this technique should be avoided if you are
55+
* using ESAPI in a resusable library, as it makes it very difficult for an
56+
* application using your library to use its own version of
57+
* <b>ESAPI.properties</b>.
58+
* </p><p>
59+
* The only exception might be if you are writing a wrapper library for ESAPI
60+
* and wish to provide a set of ESAPI properties that the application cannot <i>accidentally</i>
61+
* change. However, selecting this option won't intentionally prevent changing <b>ESAPI.properties</b>
62+
* unless you are signing the jar * and somehow forcing the verifiction of its digital signature at
63+
* runtime. That's because it's easy enough to unjar your library, edit the <b>ESAPI.properties</b>
64+
* file and then re-jar the library.
65+
* </p><p>
66+
* This option was probably more intended for use by web applications by embedding
67+
* them as resources in .war or .ear files, possibly with the intent of
68+
* dissauding operations staff from making "improvements", a practice which
69+
* makes much less--if any--sense in the era of DevOps and DevSecOps.
70+
* </p>
71+
* </li>
72+
* <li>
73+
* Inside the {@code System.getProperty( "org.owasp.esapi.resources" )} directory.
5274
* You can set this on the java command line as follows (for example):
5375
* <pre>
54-
* java -Dorg.owasp.esapi.resources="C:\temp\resources"
76+
*
77+
* java -Dorg.owasp.esapi.resources="C:\apps\myApp\resources"
5578
* </pre>
5679
* You may have to add this to the start-up script that starts your web server. For example, for Tomcat,
5780
* in the "catalina" script that starts Tomcat, you can set the JAVA_OPTS variable to the {@code -D} string above.
58-
* <p>
59-
* 3) Inside the {@code System.getProperty( "user.home" ) + "/.esapi"} directory (supported for backward compatibility) or
81+
* </li>
82+
* <li>
83+
* Inside the {@code System.getProperty( "user.home" ) + "/.esapi"} directory (supported for backward compatibility) or
6084
* inside the {@code System.getProperty( "user.home" ) + "/esapi"} directory.
61-
* <p>
62-
* 4) The first ".esapi" or "esapi" directory on the classpath. (The former for backward compatibility.)
63-
* <p>
64-
* Once the Configuration is initialized with a resource directory, you can edit it to set things like master
65-
* keys and passwords, logging locations, error thresholds, and allowed file extensions.
66-
* <p>
67-
* WARNING: Do not forget to update ESAPI.properties to change the master key and other security critical settings.
68-
* <p>
85+
* </li>
86+
* <li>
87+
* The first ".esapi" or "esapi" directory on the classpath. (The former for backward compatibility.)
88+
* </li>
89+
* </ol>
90+
* </p><p>
91+
* Once the ESAPI configuration is initialized with a resource directory, you can edit it to set things like master
92+
* keys and passwords, logging locations, error thresholds, and allowed file extensions. (But see the above cautionary
93+
* note if you are using ESAPI in a reusable library.)
94+
* </p><p>
95+
* <b>WARNING:</b> Do not forget to update ESAPI.properties to change the master key and other security critical settings
96+
* as well as reviewing changes in the <code>esapi-&lt;<i>vers</i>-configuration.jar</code> for differences
97+
* with your current version to see if any important properties were added or removed.
98+
* </p><p>
6999
* <b>DEPRECATION WARNING</b>: All of the variables of the type '{@code public static final String}'
70100
* are now declared and defined in the {@code org.owasp.esapi.PropNames}. These public fields
71101
* representing property names and values in <i>this</i> class <i>will</i> be eventually deleted and

0 commit comments

Comments
 (0)