Skip to content

Commit a9b1439

Browse files
xeno6696kwwall
xeno6696
authored and
kwwall
committed
Fixed issues #503 by writing a new addReferer method, also temporaril… (#514)
* Fixed issues #503 by writing a new addReferer method, also temporarily silenced issues related to mocking in #496. * Additional fix to #503.
1 parent 7f57ac1 commit a9b1439

File tree

5 files changed

+288
-244
lines changed

5 files changed

+288
-244
lines changed

‎pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,7 @@
309309
<dependency>
310310
<groupId>org.powermock</groupId>
311311
<artifactId>powermock-api-mockito2</artifactId>
312-
<version>2.0.0</version>
312+
<version>2.0.2</version>
313313
<scope>test</scope>
314314
<exclusions>
315315
<exclusion>
@@ -358,7 +358,7 @@
358358
<dependency>
359359
<groupId>org.powermock</groupId>
360360
<artifactId>powermock-module-junit4</artifactId>
361-
<version>2.0.0</version>
361+
<version>2.0.2</version>
362362
<scope>test</scope>
363363
</dependency>
364364
<dependency>

‎src/main/java/org/owasp/esapi/filters/SecurityWrapperResponse.java‎

Lines changed: 55 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ public class SecurityWrapperResponse extends HttpServletResponseWrapper implemen
4949
* @param response
5050
*/
5151
public SecurityWrapperResponse(HttpServletResponse response) {
52-
super( response );
52+
super( response );
5353
}
5454

5555
/**
@@ -60,13 +60,13 @@ public SecurityWrapperResponse(HttpServletResponse response) {
6060
* @param mode The mode for this wrapper. Legal modes are "log", "skip", "sanitize", "throw".
6161
*/
6262
public SecurityWrapperResponse(HttpServletResponse response, String mode) {
63-
super( response );
63+
super( response );
6464
this.mode = mode;
6565
}
6666

6767

6868
private HttpServletResponse getHttpServletResponse() {
69-
return (HttpServletResponse)super.getResponse();
69+
return (HttpServletResponse)super.getResponse();
7070
}
7171

7272
/**
@@ -138,10 +138,10 @@ private String createCookieHeader(String name, String value, int maxAge, String
138138
header += "; Path=" + path;
139139
}
140140
if ( secure || ESAPI.securityConfiguration().getBooleanProp("HttpUtilities.ForceSecureCookies") ) {
141-
header += "; Secure";
141+
header += "; Secure";
142142
}
143143
if ( ESAPI.securityConfiguration().getBooleanProp("HttpUtilities.ForceHttpOnlyCookies") ) {
144-
header += "; HttpOnly";
144+
header += "; HttpOnly";
145145
}
146146
return header;
147147
}
@@ -154,7 +154,7 @@ private String createCookieHeader(String name, String value, int maxAge, String
154154
*/
155155
public void addDateHeader(String name, long date) {
156156
try {
157-
SecurityConfiguration sc = ESAPI.securityConfiguration();
157+
SecurityConfiguration sc = ESAPI.securityConfiguration();
158158
String safeName = ESAPI.validator().getValidInput("safeSetDateHeader", name, "HTTPHeaderName", sc.getIntProp("HttpUtilities.MaxHeaderNameSize"), false);
159159
getHttpServletResponse().addDateHeader(safeName, date);
160160
} catch (ValidationException e) {
@@ -175,7 +175,7 @@ public void addDateHeader(String name, long date) {
175175
public void addHeader(String name, String value) {
176176
try {
177177
// TODO: make stripping a global config
178-
SecurityConfiguration sc = ESAPI.securityConfiguration();
178+
SecurityConfiguration sc = ESAPI.securityConfiguration();
179179
String strippedName = StringUtilities.stripControls(name);
180180
String strippedValue = StringUtilities.stripControls(value);
181181
String safeName = ESAPI.validator().getValidInput("addHeader", strippedName, "HTTPHeaderName", sc.getIntProp("HttpUtilities.MaxHeaderNameSize"), false);
@@ -185,16 +185,35 @@ public void addHeader(String name, String value) {
185185
logger.warning(Logger.SECURITY_FAILURE, "Attempt to add invalid header denied", e);
186186
}
187187
}
188+
189+
/**
190+
* Add a referer header to the response, after validating there are no illegal characters according to the
191+
* Validator.isValidURI() method, as well as ensuring there are no instances of mixed or double encoding
192+
* depending on how you have configured ESAPI defaults.
193+
* @param uri
194+
*/
195+
public void addReferer( String uri) {
196+
197+
// TODO: make stripping a global config
198+
String strippedValue = StringUtilities.stripControls(uri);
199+
boolean isValidURI = ESAPI.validator().isValidURI("refererHeader", strippedValue, false);
200+
String safeValue = "";
201+
if(isValidURI) {
202+
safeValue = strippedValue;
203+
}
204+
205+
getHttpServletResponse().addHeader("referer", safeValue);
206+
}
188207

189208
/**
190209
* Add an int header to the response after ensuring that there are no
191-
* encoded or illegal characters in the name and value.
210+
* encoded or illegal characters in the name and value. git
192211
* @param name
193212
* @param value
194213
*/
195214
public void addIntHeader(String name, int value) {
196215
try {
197-
SecurityConfiguration sc = ESAPI.securityConfiguration();
216+
SecurityConfiguration sc = ESAPI.securityConfiguration();
198217
String safeName = ESAPI.validator().getValidInput("safeSetDateHeader", name, "HTTPHeaderName", sc.getIntProp("HttpUtilities.MaxHeaderNameSize"), false);
199218
getHttpServletResponse().addIntHeader(safeName, value);
200219
} catch (ValidationException e) {
@@ -361,12 +380,12 @@ public void resetBuffer() {
361380
* @throws IOException
362381
*/
363382
public void sendError(int sc) throws IOException {
364-
SecurityConfiguration config = ESAPI.securityConfiguration();
365-
if (config.getBooleanProp("HttpUtilities.OverwriteStatusCodes")) {
366-
getHttpServletResponse().sendError(HttpServletResponse.SC_OK, getHTTPMessage(sc));
367-
} else {
368-
getHttpServletResponse().sendError(sc, getHTTPMessage(sc));
369-
}
383+
SecurityConfiguration config = ESAPI.securityConfiguration();
384+
if(config.getBooleanProp("HttpUtilities.OverwriteStatusCodes")){
385+
getHttpServletResponse().sendError(HttpServletResponse.SC_OK, getHTTPMessage(sc));
386+
}else{
387+
getHttpServletResponse().sendError(sc, getHTTPMessage(sc));
388+
}
370389
}
371390

372391
/**
@@ -379,12 +398,12 @@ public void sendError(int sc) throws IOException {
379398
* @throws IOException
380399
*/
381400
public void sendError(int sc, String msg) throws IOException {
382-
SecurityConfiguration config = ESAPI.securityConfiguration();
383-
if(config.getBooleanProp("HttpUtilities.OverwriteStatusCodes")){
384-
getHttpServletResponse().sendError(HttpServletResponse.SC_OK, ESAPI.encoder().encodeForHTML(msg));
385-
}else{
386-
getHttpServletResponse().sendError(sc, ESAPI.encoder().encodeForHTML(msg));
387-
}
401+
SecurityConfiguration config = ESAPI.securityConfiguration();
402+
if(config.getBooleanProp("HttpUtilities.OverwriteStatusCodes")){
403+
getHttpServletResponse().sendError(HttpServletResponse.SC_OK, ESAPI.encoder().encodeForHTML(msg));
404+
}else{
405+
getHttpServletResponse().sendError(sc, ESAPI.encoder().encodeForHTML(msg));
406+
}
388407
}
389408

390409
/**
@@ -418,7 +437,7 @@ public void setBufferSize(int size) {
418437
* @param charset
419438
*/
420439
public void setCharacterEncoding(String charset) {
421-
SecurityConfiguration sc = ESAPI.securityConfiguration();
440+
SecurityConfiguration sc = ESAPI.securityConfiguration();
422441
getHttpServletResponse().setCharacterEncoding(sc.getStringProp("HttpUtilities.CharacterEncoding"));
423442
}
424443

@@ -446,7 +465,7 @@ public void setContentType(String type) {
446465
*/
447466
public void setDateHeader(String name, long date) {
448467
try {
449-
SecurityConfiguration sc = ESAPI.securityConfiguration();
468+
SecurityConfiguration sc = ESAPI.securityConfiguration();
450469
String safeName = ESAPI.validator().getValidInput("safeSetDateHeader", name, "HTTPHeaderName", sc.getIntProp("HttpUtilities.MaxHeaderNameSize"), false);
451470
getHttpServletResponse().setDateHeader(safeName, date);
452471
} catch (ValidationException e) {
@@ -484,7 +503,7 @@ public void setHeader(String name, String value) {
484503
*/
485504
public void setIntHeader(String name, int value) {
486505
try {
487-
SecurityConfiguration sc = ESAPI.securityConfiguration();
506+
SecurityConfiguration sc = ESAPI.securityConfiguration();
488507
String safeName = ESAPI.validator().getValidInput("safeSetDateHeader", name, "HTTPHeaderName", sc.getIntProp("HttpUtilities.MaxHeaderNameSize"), false);
489508
getHttpServletResponse().setIntHeader(safeName, value);
490509
} catch (ValidationException e) {
@@ -507,12 +526,12 @@ public void setLocale(Locale loc) {
507526
* @param sc
508527
*/
509528
public void setStatus(int sc) {
510-
SecurityConfiguration config = ESAPI.securityConfiguration();
511-
if(config.getBooleanProp("HttpUtilities.OverwriteStatusCodes")){
512-
getHttpServletResponse().setStatus(HttpServletResponse.SC_OK);
513-
}else{
514-
getHttpServletResponse().setStatus(sc);
515-
}
529+
SecurityConfiguration config = ESAPI.securityConfiguration();
530+
if(config.getBooleanProp("HttpUtilities.OverwriteStatusCodes")){
531+
getHttpServletResponse().setStatus(HttpServletResponse.SC_OK);
532+
}else{
533+
getHttpServletResponse().setStatus(sc);
534+
}
516535

517536
}
518537

@@ -527,12 +546,12 @@ public void setStatus(int sc) {
527546
@Deprecated
528547
public void setStatus(int sc, String sm) {
529548
try {
530-
SecurityConfiguration config = ESAPI.securityConfiguration();
531-
if(config.getBooleanProp("HttpUtilities.OverwriteStatusCodes")){
532-
sendError(HttpServletResponse.SC_OK, sm);
533-
}else{
534-
sendError(sc, sm);
535-
}
549+
SecurityConfiguration config = ESAPI.securityConfiguration();
550+
if(config.getBooleanProp("HttpUtilities.OverwriteStatusCodes")){
551+
sendError(HttpServletResponse.SC_OK, sm);
552+
}else{
553+
sendError(sc, sm);
554+
}
536555
} catch (IOException e) {
537556
logger.warning(Logger.SECURITY_FAILURE, "Attempt to set response status failed", e);
538557
}

0 commit comments

Comments
 (0)