Skip to content

Commit b7e9a55

Browse files
kwwallkwwall
authored
Address latent confusion caused by obsolete / deprecated ESAPI methods related to Issue #593 (#603)
* Code clean-up related to closing issue #593. 1) Removed following methods from SecurityConfiguration and its implementations: a. getLogLevel() b. getLogFileName() c. getMaxLogFileSize() 2. Removed the following properties from the various ESAPI.properties files: a. Logger.LogFileName b. Logger.MaxLogFileSize [Oddly, there was no Logger.LogLevel.] * Next version is only minor patch release so 2.2.3.0 instead of 2.3.0.0.
1 parent 5dc43c6 commit b7e9a55

13 files changed

+6
-228
lines changed

‎configuration/esapi/ESAPI.properties‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -387,11 +387,6 @@ Logger.LogEncodingRequired=false
387387
Logger.LogApplicationName=true
388388
# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
389389
Logger.LogServerIP=true
390-
# LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you
391-
# want to place it in a specific directory.
392-
Logger.LogFileName=ESAPI_logging_file
393-
# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)
394-
Logger.MaxLogFileSize=10000000
395390
# Determines whether ESAPI should log the user info.
396391
Logger.UserInfo=true
397392
# Determines whether ESAPI should log the session id and client IP.
@@ -487,7 +482,7 @@ Validator.HTTPJSESSIONID=^[A-Z0-9]{10,32}$
487482
# Contributed by [email protected]
488483
# Github Issue 126 https://github.com/ESAPI/esapi-java-legacy/issues/126
489484
Validator.HTTPParameterName=^[a-zA-Z0-9_\\-]{1,32}$
490-
Validator.HTTPParameterValue=^[\\p{L}\\p{N}.\\-/+=_ !$*?@]{0,1000}$
485+
Validator.HTTPParameterValue=^[-\\p{L}\\p{N}./+=_ !$*?@]{0,1000}$
491486
Validator.HTTPContextPath=^/[a-zA-Z0-9.\\-_]*$
492487
Validator.HTTPQueryString=^([a-zA-Z0-9_\\-]{1,32}=[\\p{L}\\p{N}.\\-/+=_ !$*?@%]*&?)*$
493488
Validator.HTTPURI=^/([a-zA-Z0-9.\\-_]*/?)*$

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<modelVersion>4.0.0</modelVersion>
44
<groupId>org.owasp.esapi</groupId>
55
<artifactId>esapi</artifactId>
6-
<version>2.3.0.0-SNAPSHOT</version>
6+
<version>2.2.3.0-SNAPSHOT</version>
77
<packaging>jar</packaging>
88

99
<distributionManagement>

‎src/main/java/org/owasp/esapi/SecurityConfiguration.java‎

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -730,34 +730,6 @@ public interface SecurityConfiguration extends EsapiPropertyLoader {
730730
@Deprecated
731731
boolean getLogServerIP();
732732

733-
/**
734-
* Returns the current log level.
735-
* @return An integer representing the current log level.
736-
* @deprecated Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
737-
*/
738-
@Deprecated
739-
int getLogLevel();
740-
741-
/**
742-
* Get the name of the log file specified in the ESAPI configuration properties file. Return a default value
743-
* if it is not specified.
744-
*
745-
* @return the log file name defined in the properties file.
746-
* @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
747-
*/
748-
@Deprecated
749-
String getLogFileName();
750-
751-
/**
752-
* Get the maximum size of a single log file from the ESAPI configuration properties file. Return a default value
753-
* if it is not specified. Once the log hits this file size, it will roll over into a new log.
754-
*
755-
* @return the maximum size of a single log file (in bytes).
756-
* @deprecated Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
757-
*/
758-
@Deprecated
759-
int getMaxLogFileSize();
760-
761733
/**
762734
* Models a simple threshold as a count and an interval, along with a set of actions to take if
763735
* the threshold is exceeded. These thresholds are used to define when the accumulation of a particular event

‎src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java‎

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -147,9 +147,6 @@ public static SecurityConfiguration getInstance() {
147147
public static final String HTTP_SESSION_ID_NAME = "HttpUtilities.HttpSessionIdName";
148148

149149
public static final String APPLICATION_NAME = "Logger.ApplicationName";
150-
public static final String LOG_LEVEL = "Logger.LogLevel";
151-
public static final String LOG_FILE_NAME = "Logger.LogFileName";
152-
public static final String MAX_LOG_FILE_SIZE = "Logger.MaxLogFileSize";
153150
public static final String LOG_ENCODING_REQUIRED = "Logger.LogEncodingRequired";
154151
public static final String LOG_APPLICATION_NAME = "Logger.LogApplicationName";
155152
public static final String LOG_SERVER_IP = "Logger.LogServerIP";
@@ -174,13 +171,6 @@ public static SecurityConfiguration getInstance() {
174171
private static final String logSpecialValue = System.getProperty(DISCARD_LOGSPECIAL, "false");
175172

176173

177-
/**
178-
* The default max log file size is set to 10,000,000 bytes (10 Meg). If the current log file exceeds the current
179-
* max log file size, the logger will move the old log data into another log file. There currently is a max of
180-
* 1000 log files of the same name. If that is exceeded it will presumably start discarding the oldest logs.
181-
*/
182-
public static final int DEFAULT_MAX_LOG_FILE_SIZE = 10000000;
183-
184174
protected final int MAX_REDIRECT_LOCATION = 1000;
185175

186176
/*
@@ -1019,49 +1009,6 @@ public Threshold getQuota(String eventName) {
10191009
return null;
10201010
}
10211011

1022-
/**
1023-
* {@inheritDoc}
1024-
*/
1025-
public int getLogLevel() {
1026-
String level = getESAPIProperty(LOG_LEVEL, "WARNING" );
1027-
1028-
if (level.equalsIgnoreCase("OFF"))
1029-
return Logger.OFF;
1030-
if (level.equalsIgnoreCase("FATAL"))
1031-
return Logger.FATAL;
1032-
if (level.equalsIgnoreCase("ERROR"))
1033-
return Logger.ERROR ;
1034-
if (level.equalsIgnoreCase("WARNING"))
1035-
return Logger.WARNING;
1036-
if (level.equalsIgnoreCase("INFO"))
1037-
return Logger.INFO;
1038-
if (level.equalsIgnoreCase("DEBUG"))
1039-
return Logger.DEBUG;
1040-
if (level.equalsIgnoreCase("TRACE"))
1041-
return Logger.TRACE;
1042-
if (level.equalsIgnoreCase("ALL"))
1043-
return Logger.ALL;
1044-
1045-
// This error is NOT logged the normal way because the logger constructor calls getLogLevel() and if this error occurred it would cause
1046-
// an infinite loop.
1047-
logSpecial("The LOG-LEVEL property in the ESAPI properties file has the unrecognized value: " + level + ". Using default: WARNING", null);
1048-
return Logger.WARNING; // Note: The default logging level is WARNING.
1049-
}
1050-
1051-
/**
1052-
* {@inheritDoc}
1053-
*/
1054-
public String getLogFileName() {
1055-
return getESAPIProperty( LOG_FILE_NAME, "ESAPI_logging_file" );
1056-
}
1057-
1058-
/**
1059-
* {@inheritDoc}
1060-
*/
1061-
public int getMaxLogFileSize() {
1062-
return getESAPIProperty( MAX_LOG_FILE_SIZE, DEFAULT_MAX_LOG_FILE_SIZE );
1063-
}
1064-
10651012
/**
10661013
* {@inheritDoc}
10671014
*/

‎src/main/java/org/owasp/esapi/waf/configuration/AppGuardianConfiguration.java‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -111,32 +111,6 @@ public AppGuardianConfiguration() {
111111
cookieRules = new ArrayList<Rule>();
112112
}
113113

114-
/*
115-
* The following methods are all deprecated because
116-
* we use ESAPI logging structures now.
117-
*/
118-
@Deprecated
119-
public Level getLogLevel() {
120-
return logLevel;
121-
}
122-
123-
@Deprecated
124-
public void setLogLevel(Level level) {
125-
LOG_LEVEL = level;
126-
this.logLevel = level;
127-
}
128-
129-
@Deprecated
130-
public void setLogDirectory(String dir) {
131-
LOG_DIRECTORY = dir;
132-
this.logDirectory = dir;
133-
}
134-
135-
@Deprecated
136-
public String getLogDirectory() {
137-
return logDirectory;
138-
}
139-
140114
public String getDefaultErrorPage() {
141115
return defaultErrorPage;
142116
}

‎src/main/java/org/owasp/esapi/waf/configuration/ConfigurationParser.java‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
import nu.xom.ParsingException;
3131
import nu.xom.ValidityException;
3232

33-
import org.apache.log4j.Level;
3433
import org.owasp.esapi.ESAPI;
3534
import org.owasp.esapi.waf.ConfigurationException;
3635
import org.owasp.esapi.waf.rules.AddHTTPOnlyFlagRule;
@@ -143,16 +142,6 @@ public static AppGuardianConfiguration readConfigurationFile(InputStream stream,
143142
}
144143
}
145144

146-
/*
147-
* The WAF separate logging is going to be merged in the 2.0
148-
* release, so this is deprecated.
149-
*/
150-
Element loggingRoot = settingsRoot.getFirstChildElement("logging");
151-
if ( loggingRoot != null ) {
152-
config.setLogDirectory(loggingRoot.getFirstChildElement("log-directory").getValue());
153-
config.setLogLevel(Level.toLevel(loggingRoot.getFirstChildElement("log-level").getValue()));
154-
}
155-
156145
/**
157146
* Parse the 'authentication-rules' section if they have one.
158147
*/

‎src/test/java/org/owasp/esapi/SecurityConfigurationWrapper.java‎

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -551,33 +551,6 @@ public boolean getLogServerIP()
551551
return wrapped.getLogServerIP();
552552
}
553553

554-
/**
555-
* {@inheritDoc}
556-
*/
557-
// @Override
558-
public int getLogLevel()
559-
{
560-
return wrapped.getLogLevel();
561-
}
562-
563-
/**
564-
* {@inheritDoc}
565-
*/
566-
// @Override
567-
public String getLogFileName()
568-
{
569-
return wrapped.getLogFileName();
570-
}
571-
572-
/**
573-
* {@inheritDoc}
574-
*/
575-
// @Override
576-
public int getMaxLogFileSize()
577-
{
578-
return wrapped.getMaxLogFileSize();
579-
}
580-
581554
@Override
582555
public int getIntProp(String propertyName) throws ConfigurationException {
583556
return wrapped.getIntProp(propertyName);

‎src/test/java/org/owasp/esapi/reference/DefaultSecurityConfigurationTest.java‎

Lines changed: 0 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -352,49 +352,6 @@ public void testGetDisableIntrusionDetection() {
352352
assertFalse(secConf.getDisableIntrusionDetection());
353353
}
354354

355-
@Test
356-
public void testGetLogLevel() {
357-
DefaultSecurityConfiguration secConf = new DefaultSecurityConfiguration(new java.util.Properties());
358-
assertEquals(Logger.WARNING, secConf.getLogLevel());
359-
360-
secConf = this.createWithProperty(DefaultSecurityConfiguration.LOG_LEVEL, "trace");
361-
assertEquals(Logger.TRACE, secConf.getLogLevel());
362-
363-
secConf = this.createWithProperty(DefaultSecurityConfiguration.LOG_LEVEL, "Off");
364-
assertEquals(Logger.OFF, secConf.getLogLevel());
365-
366-
secConf = this.createWithProperty(DefaultSecurityConfiguration.LOG_LEVEL, "all");
367-
assertEquals(Logger.ALL, secConf.getLogLevel());
368-
369-
secConf = this.createWithProperty(DefaultSecurityConfiguration.LOG_LEVEL, "DEBUG");
370-
assertEquals(Logger.DEBUG, secConf.getLogLevel());
371-
372-
secConf = this.createWithProperty(DefaultSecurityConfiguration.LOG_LEVEL, "info");
373-
assertEquals(Logger.INFO, secConf.getLogLevel());
374-
375-
secConf = this.createWithProperty(DefaultSecurityConfiguration.LOG_LEVEL, "ERROR");
376-
assertEquals(Logger.ERROR, secConf.getLogLevel());
377-
}
378-
379-
@Test
380-
public void testGetLogFileName() {
381-
DefaultSecurityConfiguration secConf = new DefaultSecurityConfiguration(new java.util.Properties());
382-
assertEquals("ESAPI_logging_file", secConf.getLogFileName());
383-
384-
secConf = this.createWithProperty(DefaultSecurityConfiguration.LOG_FILE_NAME, "log.txt");
385-
assertEquals("log.txt", secConf.getLogFileName());
386-
}
387-
388-
@Test
389-
public void testGetMaxLogFileSize() {
390-
DefaultSecurityConfiguration secConf = new DefaultSecurityConfiguration(new java.util.Properties());
391-
assertEquals(DefaultSecurityConfiguration.DEFAULT_MAX_LOG_FILE_SIZE, secConf.getMaxLogFileSize());
392-
393-
int maxLogSize = (1024 * 1000);
394-
secConf = this.createWithProperty(DefaultSecurityConfiguration.MAX_LOG_FILE_SIZE, String.valueOf(maxLogSize));
395-
assertEquals(maxLogSize, secConf.getMaxLogFileSize());
396-
}
397-
398355
@Test
399356
public void testNoSuchPropFile(){
400357
try {

‎src/test/resources/esapi/ESAPI-CommaValidatorFileChecker.properties‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -397,12 +397,6 @@ Logger.LogEncodingRequired=false
397397
Logger.LogApplicationName=true
398398
# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
399399
Logger.LogServerIP=true
400-
# LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you
401-
# want to place it in a specific directory.
402-
Logger.LogFileName=ESAPI_logging_file
403-
# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)
404-
Logger.MaxLogFileSize=10000000
405-
406400

407401
#===========================================================================
408402
# ESAPI Intrusion Detection
@@ -485,7 +479,7 @@ Validator.HTTPJSESSIONID=^[A-Z0-9]{10,30}$
485479
# Contributed by [email protected]
486480
# Googlecode Issue 116 (http://code.google.com/p/owasp-esapi-java/issues/detail?id=116)
487481
Validator.HTTPParameterName=^[a-zA-Z0-9_\\-]{1,32}$
488-
Validator.HTTPParameterValue=^[\\p{L}\\p{N}.\\-/+=_ !$*?@]{0,1000}$
482+
Validator.HTTPParameterValue=^[-\\p{L}\\p{N}./+=_ !$*?@]{0,1000}$
489483
Validator.HTTPContextPath=^/[a-zA-Z0-9.\\-_]*$
490484
Validator.HTTPQueryString=^([a-zA-Z0-9_\\-]{1,32}=[\\p{L}\\p{N}.\\-/+=_ !$*?@%]*&?)*$
491485
Validator.HTTPURI=^/([a-zA-Z0-9.\\-_]*/?)*$

‎src/test/resources/esapi/ESAPI-DualValidatorFileChecker.properties‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -398,12 +398,6 @@ Logger.LogEncodingRequired=false
398398
Logger.LogApplicationName=true
399399
# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
400400
Logger.LogServerIP=true
401-
# LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you
402-
# want to place it in a specific directory.
403-
Logger.LogFileName=ESAPI_logging_file
404-
# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)
405-
Logger.MaxLogFileSize=10000000
406-
407401

408402
#===========================================================================
409403
# ESAPI Intrusion Detection
@@ -486,7 +480,7 @@ Validator.HTTPJSESSIONID=^[A-Z0-9]{10,30}$
486480
# Contributed by [email protected]
487481
# Googlecode Issue 116 (http://code.google.com/p/owasp-esapi-java/issues/detail?id=116)
488482
Validator.HTTPParameterName=^[a-zA-Z0-9_\\-]{1,32}$
489-
Validator.HTTPParameterValue=^[\\p{L}\\p{N}.\\-/+=_ !$*?@]{0,1000}$
483+
Validator.HTTPParameterValue=^[-\\p{L}\\p{N}./+=_ !$*?@]{0,1000}$
490484
Validator.HTTPContextPath=^/[a-zA-Z0-9.\\-_]*$
491485
Validator.HTTPQueryString=^([a-zA-Z0-9_\\-]{1,32}=[\\p{L}\\p{N}.\\-/+=_ !$*?@%]*&?)*$
492486
Validator.HTTPURI=^/([a-zA-Z0-9.\\-_]*/?)*$

0 commit comments

Comments
 (0)