New property file for testing DefaultEncoder.encodeForSQL when it's

method is not explicitly enabled. Should result in a NotConfiguredByDefaultException being thrown.

Author: kwwall

src/test/resources/esapi/new-props.properties

@@ -0,0 +1,58 @@
+# For testing new properties part of PR# 886. Hoping these are the only
+# properties that will be needed. TBD.
+
+
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
+
+ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory
+#===========================================================================
+# ESAPI Logging
+# Set the application name if these logs are combined with other applications
+Logger.ApplicationName=ExampleApplication
+# If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true
+Logger.LogEncodingRequired=false
+# Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments.
+Logger.LogApplicationName=true
+# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
+Logger.LogServerIP=true
+# Determines whether ESAPI should log the user info.
+Logger.UserInfo=true
+# Determines whether ESAPI should log the session id and client IP.
+Logger.ClientInfo=true
+
+# Determines whether ESAPI should log the prefix of [EVENT_TYPE - APPLICATION NAME].
+# If all above Logger entries are set to false, as well as LogPrefix, then the output would be the same as if no ESAPI was used
+Logger.LogPrefix=true
+
+################## NEW PROPERTIES ################### 
+#
+#   NOTE: I still like the property name
+#       ESAPI.enableLegCannonModeAndGetMyAssFired.methodNames"
+#   and
+#       ESAPI.enableLegCannonModeAndGetMyAssFired.methodNames"
+#   better. Betcha those would be set a lot less often than this "more
+#   professional" names will be.
+#
+########################################################################################
+# The following methods are now disabled in the default configuration and must
+# be explicity enabled. If you try to invoke a method disabled by default, ESAPI
+# will thrown a NotConfiguredByDefaultException.
+#
+# The reason for this varies, but ranges from they are not really suitable for
+# enterprise scale to that are only marginally tested (if at all) versus the are
+# unsafe for general use, although them may be fine when combined with other
+# security-in-depth techiques.
+#
+# The disabled-by-default methods are:
+#   org.owasp.esapi.reference.DefaultEncoder.encodeForSQL
+#   org.owasp.esapi.ESAPI.accessController  [FUTURE; will correspond to deprecation notice]
+#
+# The format is a comma-separated list of fully.Qualified.ClassName.methodName;
+# all class names must begin with "org.owasp.esapi.".
+ESAPI.dangerouslyAllowUnsafeMethods.methodNames=
+
+# Normally you would put some text here (that will be logged) that provides some
+# justification as to why you have enabled these functions. This can be
+# anythuing such as a Jira or ServiceNow ticket number, a security exception
+# reference, etc. If it is left empty, it will just like "Justification: none".`
+ESAPI.enableLegCannonModeAndGetMyAssFired.justification=