Skip to content
This repository was archived by the owner on Apr 6, 2021. It is now read-only.

Commit 0fc1694

Browse files
author
chrisisbeef
committed
changed mime-type on the file so tests could be run from repository
1 parent 921dab4 commit 0fc1694

File tree

10 files changed

+337
-54
lines changed

10 files changed

+337
-54
lines changed

‎src/main/javascript/core.js‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@ var $namespace = function(name, separator, container){
2323
return o;
2424
};
2525

26+
var $type = function( oVar, oType ) {
27+
if ( !oVar instanceof oType ) {
28+
throw new SyntaxError();
29+
}
30+
};
31+
2632
if (!$) {
2733
var $ = function( sElementID ) {
2834
return document.getElementById( sElementID );
@@ -280,21 +286,22 @@ org.owasp.esapi.ESAPI = function( oProperties ) {
280286
var _validator = null;
281287
var _logFactory = null;
282288
var _resourceBundle = null;
289+
var _httputilities = null;
283290

284291
return {
285292
properties: _properties,
286293

287294
encoder: function() {
288-
if (!_properties.encoder.Implementation) throw new RuntimeException('Configuration Error - $ESAPI.properties.encoder.Implementation object not found.');
289295
if (!_encoder) {
296+
if (!_properties.encoder.Implementation) throw new RuntimeException('Configuration Error - $ESAPI.properties.encoder.Implementation object not found.');
290297
_encoder = new _properties.encoder.Implementation();
291298
}
292299
return _encoder;
293300
},
294301

295302
logFactory: function() {
296-
if (!_properties.logging.Implementation) throw new RuntimeException('Configuration Error - $ESAPI.properties.logging.Implementation object not found.');
297303
if ( !_logFactory ) {
304+
if (!_properties.logging.Implementation) throw new RuntimeException('Configuration Error - $ESAPI.properties.logging.Implementation object not found.');
298305
_logFactory = new _properties.logging.Implementation();
299306
}
300307
return _logFactory;
@@ -310,17 +317,23 @@ org.owasp.esapi.ESAPI = function( oProperties ) {
310317

311318
resourceBundle: function() {
312319
if (!_resourceBundle) {
313-
_resourceBundle = org.owasp.esapi.i18n.ResourceBundle.getResourceBundle( _properties.localization.StandardResourceBundle, this.locale() );
320+
if(!_properties.localization.StandardResourceBundle) throw new RuntimeException("Configuration Error - $ESAPI.properties.localization.StandardResourceBundle not found.");
321+
_resourceBundle = new org.owasp.esapi.i18n.ObjectResourceBundle( _properties.localization.StandardResourceBundle );
314322
}
315323
return _resourceBundle;
316324
},
317325

318326
validator: function() {
319-
if (!_properties.validation.Implementation) throw new RuntimeException('Configuration Error - $ESAPI.properties.validation.Implementation object not found.');
320327
if (!_validator) {
328+
if (!_properties.validation.Implementation) throw new RuntimeException('Configuration Error - $ESAPI.properties.validation.Implementation object not found.');
321329
_validator = new _properties.validation.Implementation();
322330
}
323331
return _validator;
332+
},
333+
334+
httpUtilities: function() {
335+
if (!_httputilities) _httputilities = new org.owasp.esapi.HTTPUtilities();
336+
return _httputilities;
324337
}
325338
};
326339
};

‎src/main/javascript/org/owasp/esapi/HTTPUtilities.js‎

Lines changed: 105 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,110 @@
1414
$namespace('org.owasp.esapi');
1515

1616
org.owasp.esapi.HTTPUtilities = function() {
17+
var log = $ESAPI.logger("HTTPUtilities");
18+
var resourceBundle = $ESAPI.resourceBundle();
19+
var EventType = org.owasp.esapi.Logger.EventType;
20+
1721
return {
18-
addCookie: false,
19-
getSessionID: false,
20-
getCookie: false,
21-
killAllCookies: false,
22-
killCookie: false,
23-
logHTTPRequest: false,
24-
sendForward: false,
25-
getRequestParameter: false
22+
addCookie: function( oCookie ) {
23+
$type(oCookie,org.owasp.esapi.net.Cookie);
24+
25+
if ( window.top.location.protocol != 'http:' || window.top.location.protocol != 'https:' )
26+
throw new RuntimeException(resourceBundle.getString( "HTTPUtilities.Cookie.Protocol", {"protocol":window.top.location.protocol}));
27+
28+
var name = oCookie.getName(),
29+
value = oCookie.getValue(),
30+
maxAge = oCookie.getMaxAge(),
31+
domain = oCookie.getDomain(),
32+
path = oCookie.getPath(),
33+
secure = oCookie.getSecure();
34+
35+
var validationErrors = new org.owasp.esapi.ValidationErrorList();
36+
var cookieName = $ESAPI.validator().getValidInput("cookie name", name, "HttpCookieName", 50, false, validationErrors );
37+
var cookieValue = $ESAPI.validator().getValidInput("cookie value", value, "HttpCookieValue", 5000, false, validationErrors );
38+
39+
if (validationErrors.size() == 0) {
40+
var header = name+'='+escape(value);
41+
header += maxAge?";expires=" + ( new Date( ( new Date() ).getTime() + ( 1000 * maxAge ) ).toGMTString() ) : "";
42+
header += path?";path="+path:"";
43+
header += domain?";domain="+domain:"";
44+
header += secure||$ESAPI.properties.httputilities.cookies.ForceSecure?";secure":"";
45+
document.cookie=header;
46+
}
47+
else
48+
{
49+
log.warning(EventType.SECURITY_FAILURE, resourceBundle.getString("HTTPUtilities.Cookie.UnsafeData", { 'name':name, 'value':value } ) );
50+
}
51+
},
52+
53+
/**
54+
* Returns a {@link org.owasp.esapi.net.Cookie} containing the name and value of the requested cookie.
55+
*
56+
* IMPORTANT: The value of the cookie is not sanitized at this level. It is the responsibility of the calling
57+
* code to sanitize the value for proper output encoding prior to using it.
58+
*
59+
* @param sName {String} The name of the cookie to retrieve
60+
* @return {org.owasp.esapi.net.Cookie}
61+
*/
62+
getCookie: function(sName) {
63+
var cookieJar = document.cookie.split("; ");
64+
for(var i=0,len=cookieJar.length;i<len;i++) {
65+
var cookie = cookieJar[i].split("=");
66+
if (cookie[0] == escape(sName)) {
67+
return new org.owasp.esapi.net.Cookie( sName, cookie[1]?unescape(cookie[1]):'' );
68+
}
69+
}
70+
return null;
71+
},
72+
73+
/**
74+
* Will attempt to kill any cookies associated with the current request (domain,path,secure). If a cookie cannot
75+
* be deleted, a RuntimeException will be thrown.
76+
*
77+
* @throws RuntimeException if one of the cookies cannot be deleted.
78+
*/
79+
killAllCookies: function() {
80+
var cookieJar = document.cookie.split("; ");
81+
for(var i=0,len=cookieJar.length;i<len;i++) {
82+
var cookie = cookieJar[i].split("=");
83+
var name = unescape(cookie[0]);
84+
// RuntimeException will bubble through if the cookie cannot be deleted
85+
if (!this.killCookie(name)) {
86+
// Something is wrong - cookieJar contains a cookie that is inaccesible using getCookie
87+
throw new RuntimeException(resourceBundle.getString("HTTPUtilities.Cookie.CantKill", {"name":name}));
88+
}
89+
}
90+
},
91+
92+
/**
93+
* Will kill a single cookie. If that cookie cannot be deleted a RuntimeException will be thrown
94+
* @param sName {String} The name of the cookie
95+
*/
96+
killCookie: function(sName) {
97+
var c = this.getCookie(sName);
98+
if ( c ) {
99+
c.setMaxAge( -10 );
100+
this.addCookie(c);
101+
if (this.getCookie(sName)) {
102+
throw new RuntimeException(resourceBundle.getString("HTTPUtilities.Cookie.CantKill", {"name":sName}));
103+
}
104+
return true;
105+
}
106+
return false;
107+
},
108+
109+
/**
110+
* This only works for GET parameters and is meerly a convenience method for accessing that information if need be
111+
* @param sName {String} The name of the parameter to retrieve
112+
*/
113+
getRequestParameter: function( sName ) {
114+
var url = window.top.location.search.substring(1);
115+
var pIndex = url.indexOf(sName);
116+
if (pIndex<0) return null;
117+
pIndex=pIndex+sName.length;
118+
var lastIndex=url.indexOf("&",pIndex);
119+
if (lastIndex<0) lastIndex=url.length;
120+
return unescape(url.substring(pIndex,lastIndex));
121+
}
26122
};
27-
}
123+
};

‎src/main/javascript/org/owasp/esapi/i18n/ObjectResourceBundle.js‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/*
2+
* OWASP Enterprise Security API (ESAPI)
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Enterprise Security API (ESAPI) project. For details, please see
6+
* <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
7+
*
8+
* Copyright (c) 2008 - The OWASP Foundation
9+
*
10+
* The ESAPI is published by OWASP under the BSD license. You should read and accept the
11+
* LICENSE before you use, modify, and/or redistribute this software.
12+
*/
13+
14+
$namespace('org.owasp.esapi.i18n');
15+
16+
org.owasp.esapi.i18n.ObjectResourceBundle = function( oResource, oParent ) {
17+
var _super = new org.owasp.esapi.i18n.ResourceBundle( oResource.name, org.owasp.esapi.i18n.Locale.getLocale(oResource.locale), oParent );
18+
19+
var messages = oResource.messages;
20+
21+
return {
22+
getParent: _super.getParent,
23+
getLocale: _super.getLocale,
24+
getName: _super.getName,
25+
getString: _super.getString,
26+
getMessage: function(sKey) {
27+
return messages[sKey];
28+
}
29+
};
30+
};

‎src/main/javascript/org/owasp/esapi/i18n/ResourceBundle.js‎

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -87,44 +87,6 @@ org.owasp.esapi.i18n.ResourceBundle.getResourceBundle = function(sResource, oLoc
8787
};
8888

8989
with(org.owasp.esapi.i18n) {
90-
messages = {
91-
"Test" : "This is test #{testnumber}",
92-
"CreditCard.Required.Usr" : "{context}: Input credit card required",
93-
"CreditCard.Required.Log" : "Input credit card required: context={context}, input={input}",
94-
"CreditCard.Invalid.Usr" : "{context}: Invalid credit card input",
95-
"CreditCard.Invalid.Log" : "Invalid credit card input: context={context}, input={input}",
96-
"Date.Required.Usr" : "{context}: Input date required in {format} format",
97-
"Date.Required.Log" : "Date required: context={context}, input={input}, format={format}",
98-
"Date.Invalid.Usr" : "{context}: Invalid date, please use {format} format",
99-
"Date.Invalid.Log" : "Invalid date: context={context}, input={input}, format={format}",
100-
"Integer.Required.Usr" : "{context}: Input number required",
101-
"Integer.Required.Log" : "Input number required: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
102-
"Integer.NaN.Usr" : "{context}: Invalid number",
103-
"Integer.NaN.Log" : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
104-
"Integer.MinValue.Usr" : "{context}: Invalid number - Must be greater than {minValue}",
105-
"Integer.MinValue.Log" : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
106-
"Integer.MaxValue.Usr" : "{context}: Invalid number - Must be less than {maxValue}",
107-
"Integer.MaxValue.Log" : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
108-
"Number.Required.Usr" : "{context}: Input number required",
109-
"Number.Required.Log" : "Input number required: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
110-
"Number.NaN.Usr" : "{context}: Invalid number",
111-
"Number.NaN.Log" : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
112-
"Number.MinValue.Usr" : "{context}: Invalid number - Must be greater than {minValue}",
113-
"Number.MinValue.Log" : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
114-
"Number.MaxValue.Usr" : "{context}: Invalid number - Must be less than {maxValue}",
115-
"Number.MaxValue.Log" : "Invalid number: context={context}, input={input}, minValue={minValue}, maxValue={maxValue}",
116-
"String.Required.Usr" : "{context}: Input required",
117-
"String.Required.Log" : "Input required: context={context}, input={input}, original={orig}",
118-
"String.Whitelist.Usr" : "{context}: Invalid input - Conform to regex {pattern}",
119-
"String.Whitelist.Log" : "Invalid input - Whitelist validation failed: context={context}, input={input}, original={orig}, pattern={pattern}",
120-
"String.Blacklist.Usr" : "{context}: Invalid input - Dangerous input matching {pattern} detected",
121-
"String.Blacklist.Log" : "Invalid input - Blacklist validation failed: context={context}, input={input}, original={orig}, pattern={pattern}",
122-
"String.MinLength.Usr" : "{context}: Invalid input - Minimum length is {minLength}",
123-
"String.MinLength.Log" : "Invalid input - Too short: context={context}, input={input}, original={orig}, minLength={minLength}",
124-
"String.MaxLength.Usr" : "{context}: Invalid input - Maximum length is {maxLength}",
125-
"String.MaxLength.Log" : "Invalid input - Too long: context={context}, input={input}, original={orig}, maxLength={maxLength}"
126-
};
127-
12890
ResourceBundle.ESAPI_Standard = "ESAPI_Standard";
12991
ResourceBundle.ESAPI_Standard_en_US = new ArrayResourceBundle( 'ESAPI Standard Messaging - US English', Locale.US, messages );
13092
}

‎src/main/javascript/org/owasp/esapi/net/Cookie.js‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
/*
2+
* OWASP Enterprise Security API (ESAPI)
3+
*
4+
* This file is part of the Open Web Application Security Project (OWASP)
5+
* Enterprise Security API (ESAPI) project. For details, please see
6+
* <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
7+
*
8+
* Copyright (c) 2008 - The OWASP Foundation
9+
*
10+
* The ESAPI is published by OWASP under the BSD license. You should read and accept the
11+
* LICENSE before you use, modify, and/or redistribute this software.
12+
*/
13+
14+
$namespace('org.owasp.esapi.net');
15+
16+
/**
17+
* Constructs a cookie with a specified name and value.
18+
* <p/>
19+
* The name must conform to RFC 2109. That means it can contain only ASCII alphanumeric characters and cannot contain
20+
* commas, semicolons, or white space or begin with a $ character. The cookie's name cannot be changed after creation.
21+
* <p/>
22+
* The value can be anything the server chooses to send. Its value is probably of interest only to the server. The
23+
* cookie's value can be changed after creation with the setValue method.
24+
* <p/>
25+
* By default, cookies are created according to the Netscape cookie specification. The version can be changed with the
26+
* {@link #setVersion} method.
27+
*
28+
* @constructor
29+
* @param sName {String} a <code>String</code> specifying the name of the cookie
30+
* @param sValue {String} a <code>String</code> specifying the value of the cookie
31+
* @throws IllegalArgumentException
32+
* if the cookie name contains illegal characters (for example, a comma, space, or semicolon) or it is one of
33+
* the tokens reserved for use by the cookie protocol
34+
*/
35+
org.owasp.esapi.net.Cookie = function( sName, sValue ) {
36+
var name; // NAME= ... "$Name" style is reserved
37+
var value; // value of NAME
38+
39+
var comment; // ;Comment=VALUE ... describes the cookies use
40+
var domain; // ;Domain=VALUE ... domain that sees the cookie
41+
var maxAge; // ;Max-Age=VALUE ... cookies auto-expire
42+
var path; // ;Path=VALUE ... URLs that see the cookie
43+
var secure; // ;Secure ... e.g. use SSL
44+
var version; // ;Version=1 ... means RFC-2109++ style
45+
46+
var _resourceBundle = $ESAPI.resourceBundle();
47+
48+
var tSpecials = ",; ";
49+
50+
var isToken = function(sValue) {
51+
for(var i=0,len=sValue.length;i<len;i++) {
52+
var cc = sValue.charCodeAt(i),c=sValue.charAt(i);
53+
if (cc<0x20||cc>=0x7F||tSpecials.indexOf(c)!=-1) {
54+
return false;
55+
}
56+
}
57+
return true;
58+
};
59+
60+
if ( !isToken(sName)
61+
|| sName.toLowerCase() == 'comment'
62+
|| sName.toLowerCase() == 'discard'
63+
|| sName.toLowerCase() == 'domain'
64+
|| sName.toLowerCase() == 'expires'
65+
|| sName.toLowerCase() == 'max-age'
66+
|| sName.toLowerCase() == 'path'
67+
|| sName.toLowerCase() == 'secure'
68+
|| sName.toLowerCase() == 'version'
69+
|| sName.charAt(0) == '$' ) {
70+
var errMsg = _resourceBundle.getString( "Cookie.Name", { 'name':sName } );
71+
throw new IllegalArgumentException(errMsg);
72+
}
73+
74+
name = sName;
75+
value = sValue;
76+
77+
return {
78+
setComment: function(purpose) { comment = purpose; },
79+
getComment: function() { return comment; },
80+
setDomain: function(sDomain) { domain = sDomain.toLowerCase(); },
81+
getDomain: function() { return domain; },
82+
setMaxAge: function(nExpirey) { maxAge = nExpirey; },
83+
getMaxAge: function() { return maxAge; },
84+
setPath: function(sPath) { path = sPath; },
85+
getPath: function() { return path; },
86+
setSecure: function(bSecure) { secure = bSecure; },
87+
getSecure: function() { return secure; },
88+
getName: function() { return name; },
89+
setValue: function(sValue) { value = sValue; },
90+
getValue: function() { return value; },
91+
setVersion: function(nVersion) {
92+
if(nVersion<0||nVersion>1)throw new IllegalArgumentException(_resourceBundle.getString("Cookie.Version", { 'version':nVersion } ) );
93+
version = nVersion;
94+
},
95+
getVersion: function() { return version; }
96+
};
97+
};

‎src/main/javascript/org/owasp/esapi/reference/validation/DefaultValidator.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ org.owasp.esapi.reference.validation.DefaultValidator = function( oEncoder, oLoc
3939
},
4040

4141
getValidInput: function( sContext, sInput, sType, nMaxLength, bAllowNull, oValidationErrorList ) {
42-
var rvr = new p.StringValidationRule( sType, encoder, locale );
42+
var rvr = new org.owasp.esapi.reference.validation.StringValidationRule( sType, encoder, locale );
4343
var p = new RegExp($ESAPI.properties.validation[sType]);
4444
if ( p && p instanceof RegExp ) {
4545
rvr.addWhitelistPattern( p );

0 commit comments

Comments
 (0)