Skip to content

Commit fea010a

Browse files
kwwallkwwall
authored
Initial 2.5.2.0 release preparation (#784)
* Updates to ESAPI HTTPUtilities.getFileUploads methods to address CVE-2023-24998. * Updates to AntiSamy 1.7.3 to address CVE-2023-26119. * Fixed package level Javadoc for org.owasp.esapi package. * Update example scripts so they work for recent ESAPI releases. * Mention signed commits now required in CONTRIBUTING-TO-ESAPI.txt. * Updated plugins and dependencies to latest versions that work. * Updated date.prev_release to correctly compute CHANGELOG for 'mvn site'. * Update boilerplate in template file used for creating new release notes. * Created scripts/varrs.2.6.2.0, used to generate 2.5.2.0 release notes. * Add missing class level Javadoc to org.owasp.esapi.ValidationRule. * Created new 2.5.2.0 release notes. * Change reference of latest release from 2.5.1.0 to 2.5.2.0 in README.md. * Make ANONYMOUS user 'final' in org.owasp.esapi.User interface. * Added 2 new properties (HttpUtilities.MaxUploadFileCount & HttpUtilities.FileUploadAllowAnonymousUser) to ESAPI.properties files to address CVE-2023-24998. * Add 2 new property names to PropNames class that are used to address CVE-2023-24998: HttpUtilities.MaxUploadFileCount and HttpUtilities.FileUploadAllowAnonymousUser. * Changed start-up log message for ESAPI WAF to make it specific to the _ESAPI_ WAF. * Extensive Javadoc updates, especially to the HTTPUtilities.getFileUploads methods. * Changes to DefaultHTTPUtilities to address CVE-2023-24998. * Add new tests for getFileUploads method to test CVE-2023-24998 remediation (as much as possible). * Commented out new JUnit test, HTTPUtilitiesTest.testGetFileUploadsUnauthenticatedUser for reasons noted in code.
1 parent 3230ed9 commit fea010a

25 files changed

+755
-82
lines changed

‎CONTRIBUTING-TO-ESAPI.txt‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,15 @@ A Special Note on GitHub Authentication:
1212
Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/
1313
for details and plan accordingly.
1414

15+
A Special Note Regarding Making Commits for PRs
16+
Shortly after the 2.5.1.0 ESAPI release in late November 2022, the ESAPI
17+
team decided to lock down the 'develop' amd 'main' branches. Merges from
18+
PRs are done to the 'develop' branch. That means that if you intend to
19+
contribute to ESAPI, you must be signing your commits. Please see the
20+
GitHub instructions at
21+
https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits
22+
for details.
23+
1524

1625
Finding Something Interesting to Work on:
1726

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ Development for the "next generation" of ESAPI (starting with ESAPI 3.0), will b
4545
GitHub repository at [https://github.com/ESAPI/esapi-java](https://github.com/ESAPI/esapi-java).
4646

4747
**IMPORTANT NOTES:**
48-
* The default branch for ESAPI legacy is the 'develop' branch (rather than the 'main' (formerly 'master') branch), where future development, bug fixes, etc. are now being done. The 'main' branch is now marked as "protected"; it reflects the latest stable ESAPI release (2.5.1.0 as of this date). Note that this change of making the 'develop' branch the default may affect any pull requests that you were intending to make.
48+
* The default branch for ESAPI legacy is the 'develop' branch (rather than the 'main' (formerly 'master') branch), where future development, bug fixes, etc. are now being done. The 'main' branch is now marked as "protected"; it reflects the latest stable ESAPI release (2.5.2.0 as of this date). Note that this change of making the 'develop' branch the default may affect any pull requests that you were intending to make.
4949
* Also, the *minimal* baseline Java version to use ESAPI is now Java 8. (This was changed from Java 7 during the 2.4.0.0 release.)
5050
* Support was dropped for Log4J 1 during ESAPI 2.5.0.0 release. If you need it, configure it via SLF4J. See the
5151
[2.5.0.0 release notes](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.5.0.0-release-notes.txt)
@@ -79,7 +79,7 @@ link to the specific release notes.
7979
Starting with release 2.4.0.0, Java 8 or later is required.
8080

8181
# Locating ESAPI Jar files
82-
The [latest ESAPI release](https://github.com/ESAPI/esapi-java-legacy/releases/latest) is 2.5.1.0.
82+
The [latest ESAPI release](https://github.com/ESAPI/esapi-java-legacy/releases/latest) is 2.5.2.0.
8383
All the *regular* ESAPI jars, with the exception of the ESAPI configuration
8484
jar (i.e., esapi-2.#.#.#-configuration.jar) and its associated detached
8585
GPG signature, are available from Maven Central. The ESAPI configuration

‎configuration/esapi/ESAPI.properties‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,7 @@ Encryptor.KDF.PRF=HmacSHA256
301301
# headers, and CSRF tokens.
302302
#
303303
# Default file upload location (remember to escape backslashes with \\)
304+
#
304305
HttpUtilities.UploadDir=C:\\ESAPI\\testUpload
305306
HttpUtilities.UploadTempDir=C:\\temp
306307
# Force flags on cookies, if you use HttpUtilities to set cookies
@@ -335,6 +336,30 @@ HttpUtilities.httpQueryParamValueLength=500
335336
# File upload configuration
336337
HttpUtilities.ApprovedUploadExtensions=.pdf,.doc,.docx,.ppt,.pptx,.xls,.xlsx,.rtf,.txt,.jpg,.png
337338
HttpUtilities.MaxUploadFileBytes=500000000
339+
# Maximum # of files that can be uploaded per HTTP request.
340+
# Set to -1 for no maximum. Related to CVE-2023-24998.
341+
HttpUtilities.MaxUploadFileCount=20
342+
343+
# Allowing anonymous users to do file uploads via HTTPUtilities.getFileUploads
344+
# can make it easier for DoS attacks via uploading files easier. (See Security Bulletin #11,
345+
# https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin11.pdf
346+
# for details).
347+
#
348+
# By default, we allow anonymous users to upload files because we can only rely on
349+
# ESAPI.authenticator().getCurrentUser() to determine if a user associated
350+
# with the current HTTP session is authenticated and almost no one uses the
351+
# ESAPI Authenticator because the reference implementation is just a toy
352+
# implementation and is not enterprise scalable.
353+
#
354+
# If you are using the ESAPI Authenticator (the ESAPI reference implementation
355+
# or you've implemented your own custom one), then you can set this property value
356+
# to 'false' to disallow anonymous (i.e., unauthenticated) users to upload
357+
# files. However, if you are not using the ESAPI Authenticator, then you should
358+
# probably leave this set to 'false', otherwise you will completely prevent the
359+
# use of HTTPUtilities.getFileUploads methods.
360+
#
361+
HttpUtilities.FileUploadAllowAnonymousUser=true
362+
338363
# Using UTF-8 throughout your stack is highly recommended. That includes your database driver,
339364
# container, and any other technologies you may be using. Failure to do this may expose you
340365
# to Unicode transcoding injection attacks. Use of UTF-8 does not hinder internationalization.

‎documentation/esapi4java-core-2.5.2.0-release-notes.txt‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
Release notes for ESAPI 2.5.2.0
2+
Release date: 2023-04-12
3+
Project leaders:
4+
-Kevin W. Wall <[email protected]>
5+
-Matt Seil <[email protected]>
6+
7+
Previous release: ESAPI 2.5.1.0, 2022-11-27
8+
9+
10+
Executive Summary: Important Things to Note for this Release
11+
------------------------------------------------------------
12+
This is a patch release with the primary intent of updating some dependencies, one with a known DoS vulnerability and a more recent one with a potential RCE. From a vulnerability perspective, it addresses CVE-2023-24998 by upgrading to version 1.5 of Apache Commons File Uploads and adding the necessary call to FileBaseUpload.setFileCountMax(). It also updates to version 1.7.3 of AntiSamy to address CVE-2023-26119, a vulnerability in one of their dependencies.
13+
14+
If you are not updating from the previous ESAPI release (2.5.1.0), you should go back and FIRST read all the subsequent release notes in turn. For instance, if you are currently on release 2.3.0.0 and upgrading to this release (2.5.2.0), you should MINIMALLY
15+
read the sections "Changes Requiring Special Attention" in each of the subsequent release notes. So, going from release 2.3.0.0 to 2.5.2.0, you should in turn, read:
16+
17+
esapi4java-core-2.4.0.0-release-notes.txt
18+
esapi4java-core-2.5.0.0-release-notes.txt
19+
esapi4java-core-2.5.1.0-release-notes.txt
20+
esapi4java-core-2.5.2.0-release-notes.txt
21+
22+
in that order. YOU HAVE BEEN WARNED!!!
23+
24+
If your SCA tool is reporting any CVE from a direct or transitive dependency in ESAPI, before reporting it as an GitHub issue, please make sure that you review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md. Please email us or contact us in our GitHub Discussions page if you have questions about this. See also the SECURITY.md file to report any security issues with ESAPI.
25+
26+
27+
=================================================================================================================
28+
29+
Basic ESAPI facts
30+
-----------------
31+
32+
ESAPI 2.5.1.0 release:
33+
207 Java source files
34+
4292 JUnit tests in 131 Java source files (0 tests skipped)
35+
36+
ESAPI 2.5.2.0 release: (unchanged since previous release)
37+
207 Java source files
38+
4293 JUnit tests in 131 Java source files (0 tests skipped, 1 commented out)
39+
40+
7 GitHub Issues closed in this release, including those we've decided not to fix (marked 'wontfix' and 'falsepositive').
41+
(Reference: https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+state%3Aclosed+updated%3A%3E%3D2022-11-27)
42+
43+
Issue # GitHub Issue Title
44+
----------------------------------------------------------------------------------------------
45+
773 Esapi giving issue working with graal native image bug
46+
770 latest version of ESAPI 2.5.1.0 not working with spring boot 3.0, it gives classNotFound for javax.servlet. duplicate enhancement
47+
769 ESAPI 2.5.1.0 not working with spring boot 3.0, spring 6 bug
48+
767 Add support for Jakarta Servlet API Specification enhancement [converted to Discussion #768]
49+
764 unable to locate resource: esapi-java-logging.properties
50+
761 JavaLogFactory is not loaded from ESAPI.properties file bug
51+
760 Could not initialize class org. Owasp. Esapi. Reference. DefaultValidator bug
52+
53+
-----------------------------------------------------------------------------
54+
55+
Changes Requiring Special Attention
56+
57+
-----------------------------------------------------------------------------
58+
59+
Important JDK Support Announcement
60+
* ESAPI 2.3.0.0 was the last Java release to support Java 7. ESAPI 2.4.0 requires using Java 8 or later. See the ESAPI 2.4.0.0 release notes (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.4.0.0-release-notes.txt) for details as to the reason.
61+
- This means if your project requires Java 7, you must use ESAPI 2.3.0.0 or earlier.
62+
* We are aware that ESAPI does not support Spring Boot 3.x or later or Spring Framework 6.x or later.
63+
- This is because these projects use a version of Jakarta Servlet API that is incompatible with the the Java EE Servlet API. (The package names are different!)
64+
- See Discussion #768 for more details. Please do NOT report this as an issue.
65+
66+
Important ESAPI Logging Changes
67+
68+
* Since ESAPI 2.5.0.0, support for logging directly via Log4J 1 has been removed. (This was two years after it haveing first been deprecated.) Thus, you only choice of ESAPI logging are
69+
- java.util.logging (JUL), which as been the default since ESAPI 2.2.1.0.
70+
* Set ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory in your ESAPI.properties file.
71+
- SLF4J (which your choice of supported SLF4J logging implemmentation)
72+
* Set ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory in your ESAPI.properties file.
73+
* Logger configuration notes - If you are migrating from prior to ESAPI 2.2.1.1, you will need to update your ESAPI.properties file as logging-related configuration as per the ESAPI 2.2.1.1 release notes, which may be found at:
74+
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.2.1.1-release-notes.txt#L39-L78
75+
76+
If you use ESAPI 2.5.0.0 or later, you will get an ClassNotFoundException as the root cause if you still have your ESAPI.Logger property set to use Log4J because the org.owasp.esapi.logger.log4j.Log4JFactory class has been completely removed from the ESAPI jar. If you are dead set on continuing to use Log4J 1, you ought to be able to do so via SLF4J. The set up for Log4J 1 (which has not be tested), should be similar to configure ESAPI to use SLF4J with Log4J 2 as described here:
77+
https://github.com/ESAPI/esapi-java-legacy/wiki/Using-ESAPI-with-SLF4J#slf4j-using-log4j-2x
78+
79+
-----------------------------------------------------------------------------
80+
81+
Remaining Known Issues / Problems
82+
83+
-----------------------------------------------------------------------------
84+
None known, other than the remaining open issues on GitHub.
85+
86+
-----------------------------------------------------------------------------
87+
88+
Other changes in this release, some of which not tracked via GitHub issues
89+
90+
-----------------------------------------------------------------------------
91+
92+
* Minor updates to README.md file with respect to version information.
93+
94+
-----------------------------------------------------------------------------
95+
96+
Developer Activity Report (Changes between release 2.5.1.0 and 2.5.2.0, i.e., between 2022-11-27 and 2023-04-12)
97+
Generated manually based on merged PRs. All errors are the fault of kwwall and his inability to do simple arithmetic.
98+
99+
Developer Total Total # of Unique # Merged
100+
(GitHub ID) commits Files Changed PRs
101+
========================================================
102+
davewichers 2 4 2
103+
josephWitthuhnTR 2 2 1
104+
dependabot 1 1 1
105+
kwwall 36 31 2
106+
========================================================
107+
Total merged PRs: 6
108+
109+
-----------------------------------------------------------------------------
110+
111+
CHANGELOG: Create your own. May I suggest:
112+
113+
git log --stat --since=2022-11-27 --reverse --pretty=medium
114+
115+
which will show all the commits since just after the previous (2.5.1.0) release.
116+
117+
Alternately, you can download the most recent ESAPI source and run
118+
119+
mvn site
120+
121+
which will create a CHANGELOG file named 'target/site/changelog.html'
122+
123+
124+
-----------------------------------------------------------------------------
125+
126+
Direct and Transitive Runtime and Test Dependencies:
127+
128+
$ mvn -B dependency:tree
129+
...
130+
[INFO] --- maven-dependency-plugin:3.5.0:tree (default-cli) @ esapi ---
131+
[INFO] org.owasp.esapi:esapi:jar:2.5.2.0-SNAPSHOT
132+
[INFO] +- javax.servlet:javax.servlet-api:jar:3.1.0:provided
133+
[INFO] +- javax.servlet.jsp:javax.servlet.jsp-api:jar:2.3.3:provided
134+
[INFO] +- xom:xom:jar:1.3.8:compile
135+
[INFO] +- commons-beanutils:commons-beanutils:jar:1.9.4:compile
136+
[INFO] | +- commons-logging:commons-logging:jar:1.2:compile
137+
[INFO] | \- commons-collections:commons-collections:jar:3.2.2:compile
138+
[INFO] +- commons-configuration:commons-configuration:jar:1.10:compile
139+
[INFO] +- commons-lang:commons-lang:jar:2.6:compile
140+
[INFO] +- commons-fileupload:commons-fileupload:jar:1.5:compile
141+
[INFO] +- org.apache.commons:commons-collections4:jar:4.4:compile
142+
[INFO] +- org.apache-extras.beanshell:bsh:jar:2.0b6:compile
143+
[INFO] +- org.owasp.antisamy:antisamy:jar:1.7.2:compile
144+
[INFO] | +- net.sourceforge.htmlunit:neko-htmlunit:jar:2.66.0:compile
145+
[INFO] | +- org.apache.httpcomponents.client5:httpclient5:jar:5.2:compile
146+
[INFO] | | \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.2:compile
147+
[INFO] | +- org.apache.httpcomponents.core5:httpcore5:jar:5.2:compile
148+
[INFO] | +- org.apache.xmlgraphics:batik-css:jar:1.16:compile
149+
[INFO] | | +- org.apache.xmlgraphics:batik-shared-resources:jar:1.16:compile
150+
[INFO] | | +- org.apache.xmlgraphics:batik-util:jar:1.16:compile
151+
[INFO] | | | +- org.apache.xmlgraphics:batik-constants:jar:1.16:compile
152+
[INFO] | | | \- org.apache.xmlgraphics:batik-i18n:jar:1.16:compile
153+
[INFO] | | \- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.7:compile
154+
[INFO] | +- xerces:xercesImpl:jar:2.12.2:compile
155+
[INFO] | \- xml-apis:xml-apis-ext:jar:1.3.04:compile
156+
[INFO] +- org.slf4j:slf4j-api:jar:2.0.6:compile
157+
[INFO] +- xml-apis:xml-apis:jar:1.4.01:compile
158+
[INFO] +- commons-io:commons-io:jar:2.11.0:compile
159+
[INFO] +- com.github.spotbugs:spotbugs-annotations:jar:4.7.3:compile
160+
[INFO] | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile
161+
[INFO] +- commons-codec:commons-codec:jar:1.15:test
162+
[INFO] +- junit:junit:jar:4.13.2:test
163+
[INFO] +- org.bouncycastle:bcprov-jdk15on:jar:1.70:test
164+
[INFO] +- org.hamcrest:hamcrest-core:jar:2.2:test
165+
[INFO] | \- org.hamcrest:hamcrest:jar:2.2:test
166+
[INFO] +- org.powermock:powermock-api-mockito2:jar:2.0.9:test
167+
[INFO] | \- org.powermock:powermock-api-support:jar:2.0.9:test
168+
[INFO] +- org.mockito:mockito-core:jar:3.12.4:test
169+
[INFO] | +- net.bytebuddy:byte-buddy:jar:1.11.13:test
170+
[INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.11.13:test
171+
[INFO] | \- org.objenesis:objenesis:jar:3.2:test
172+
[INFO] +- org.powermock:powermock-core:jar:2.0.9:test
173+
[INFO] | \- org.javassist:javassist:jar:3.27.0-GA:test
174+
[INFO] +- org.powermock:powermock-module-junit4:jar:2.0.9:test
175+
[INFO] | \- org.powermock:powermock-module-junit4-common:jar:2.0.9:test
176+
[INFO] +- org.powermock:powermock-reflect:jar:2.0.9:test
177+
[INFO] \- org.openjdk.jmh:jmh-core:jar:1.36:test
178+
[INFO] +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:test
179+
[INFO] \- org.apache.commons:commons-math3:jar:3.2:test
180+
181+
-----------------------------------------------------------------------------
182+
183+
Acknowledgments:
184+
Thanks to my ESAPI co-contributors Matt Seil, Jeremiah Stacey, as well as all the ESAPI users who make our efforts worthwhile. Without you, there would be little point in maintaining this project. Lastly, a special shout-out to Joseph Witthuhn for submitting 2 PRs for this release.
185+
186+
A special thanks to the ESAPI community from the ESAPI project co-leaders:
187+
Kevin W. Wall (kwwall) <== The irresponsible party for these release notes!
188+
Matt Seil (xeno6696)

0 commit comments

Comments
 (0)