Skip to content

Commit e14e488

Browse files
forgedhallpassforgedhallpass
committed
Merge branch 'master' into jakarta
2 parents 62a6e2d + 710def7 commit e14e488

File tree

13 files changed

+232
-127
lines changed

13 files changed

+232
-127
lines changed

‎assets/images/credentials_included.png‎

-172 KB
Binary file not shown.

‎assets/images/csrfguard_3.1.0.png‎ renamed to ‎assets/images/csrfguard.png‎

File renamed without changes.

‎csrfguard-extensions/csrfguard-jsp-tags/src/main/resources/META-INF/tags/csrfguard.tld‎ renamed to ‎csrfguard-extensions/csrfguard-jsp-tags/src/main/resources/META-INF/csrfguard.tld‎

File renamed without changes.

‎csrfguard-test/csrfguard-test-jsp/src/main/webapp/WEB-INF/classes/Owasp.CsrfGuard.properties‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,6 @@ org.owasp.csrfguard.Config.Print = true
328328

329329
##################################################################
330330
## Javascript servlet settings if not set in web.xml ##
331-
## https://wiki.owasp.org/index.php/CSRFGuard_3_Token_Injection ##
332331
##################################################################
333332

334333
# This property denotes the location of the JavaScript template file that should be consumed and dynamically

‎csrfguard/src/main/java/org/owasp/csrfguard/servlet/JavaScriptServlet.java‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,10 @@ public final class JavaScriptServlet extends HttpServlet {
106106
JS_REPLACEMENT_MAP.put(SERVLET_PATH_IDENTIFIER, (csrfGuard, request) -> StringUtils.defaultString(request.getContextPath() + request.getServletPath()));
107107
JS_REPLACEMENT_MAP.put(X_REQUESTED_WITH_IDENTIFIER, (csrfGuard, request) -> StringUtils.defaultString(csrfGuard.getJavascriptXrequestedWith()));
108108
JS_REPLACEMENT_MAP.put(DYNAMIC_NODE_CREATION_EVENT_NAME_IDENTIFIER, (csrfGuard, request) -> StringUtils.defaultString(csrfGuard.getJavascriptDynamicNodeCreationEventName()));
109-
JS_REPLACEMENT_MAP.put(DOMAIN_ORIGIN_IDENTIFIER, (csrfGuard, request) -> ObjectUtils.defaultIfNull(csrfGuard.getDomainOrigin(), StringUtils.defaultString(parseDomain(request.getRequestURL()))));
109+
JS_REPLACEMENT_MAP.put(DOMAIN_ORIGIN_IDENTIFIER, (csrfGuard, request) -> ObjectUtils.firstNonNull(
110+
csrfGuard.getDomainOrigin(),
111+
getFirstHost(request.getHeader("X-Forwarded-Host")),
112+
StringUtils.defaultString(JavaScriptServlet.parseDomain(request.getRequestURL()))));
110113
JS_REPLACEMENT_MAP.put(INJECT_INTO_FORMS_IDENTIFIER, (csrfGuard, request) -> Boolean.toString(csrfGuard.isJavascriptInjectIntoForms()));
111114
JS_REPLACEMENT_MAP.put(INJECT_GET_FORMS_IDENTIFIER, (csrfGuard, request) -> Boolean.toString(csrfGuard.isJavascriptInjectGetForms()));
112115
JS_REPLACEMENT_MAP.put(INJECT_FORM_ATTRIBUTES_IDENTIFIER, (csrfGuard, request) -> Boolean.toString(csrfGuard.isJavascriptInjectFormAttributes()));
@@ -242,6 +245,28 @@ private static String parseDomain(final StringBuffer url) {
242245
}
243246
}
244247

248+
/**
249+
* @param commaSeparatedHosts (e.g. "fox1:443, spring2:444"). Nullable
250+
* @return the first host in the list(e.g. "fox1" without port number). null if commaSeparatedHosts is invalid/null/blank
251+
*/
252+
private static String getFirstHost(String commaSeparatedHosts) {
253+
if (StringUtils.isBlank(commaSeparatedHosts)) {
254+
commaSeparatedHosts = null;
255+
}else {
256+
commaSeparatedHosts = commaSeparatedHosts.split(",")[0]; // if there are multiple proxyPass in cascade, XForwardedHost became for example : "fox1:443, spring2:444", where fox1:443 is the first proxyPass encountered
257+
if(commaSeparatedHosts.toLowerCase().startsWith("http")) {
258+
try {
259+
commaSeparatedHosts = new URL(commaSeparatedHosts).getHost();
260+
} catch (final MalformedURLException e) {
261+
commaSeparatedHosts = null;
262+
}
263+
} else {
264+
commaSeparatedHosts = commaSeparatedHosts.split(":")[0];
265+
}
266+
}
267+
return commaSeparatedHosts;
268+
}
269+
245270
private void writeJavaScript(final CsrfGuard csrfGuard, final HttpServletRequest request, final HttpServletResponse response) throws IOException {
246271
final String refererHeader = request.getHeader("referer");
247272

‎csrfguard/src/main/resources/csrfguard.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,7 @@ org.owasp.csrfguard.Config.Print = true
327327

328328
##################################################################
329329
## Javascript servlet settings if not set in web.xml ##
330-
## https://wiki.owasp.org/index.php/CSRFGuard_3_Token_Injection ##
330+
## https://owasp.org/www-project-csrfguard ##
331331
##################################################################
332332

333333
# This property denotes the location of the JavaScript template file that should be consumed and dynamically

‎index.md‎

Lines changed: 178 additions & 5 deletions
Large diffs are not rendered by default.

‎info.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,8 @@ If you have questions, would like to share or discuss ideas, please use the offi
7979

8080
## CSRFGuard 4.0 Release Notes:
8181

82-
* [Support for stateless web applications](https://github.com/aramrami/OWASP-CSRFGuard/issues/122)
83-
* [Apply "TokenPerPage" approach to AJAX](https://github.com/aramrami/OWASP-CSRFGuard/issues/123)
82+
* [Support for stateless web applications](https://github.com/OWASP/www-project-csrfguard/issues/4)
83+
* [Apply "TokenPerPage" approach to AJAX](https://github.com/OWASP/www-project-csrfguard/issues/2)
8484
* [Reduced code duplication](https://github.com/aramrami/OWASP-CSRFGuard/issues/127)
8585
* [Proper multi-module maven project structure](https://github.com/aramrami/OWASP-CSRFGuard/issues/128)
8686
* [The test JSP web application now relies on the latest development JavaScript code](https://github.com/aramrami/OWASP-CSRFGuard/issues/133)

‎pom.xml‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -119,29 +119,29 @@
119119
<jsp-api.version>3.1.1</jsp-api.version>
120120
<jstl.version>3.0.0</jstl.version>
121121

122-
<maven-surefire-plugin.version>3.1.0</maven-surefire-plugin.version>
123-
<maven-jar-plugin.version>3.3.0</maven-jar-plugin.version>
124-
<maven-source-plugin.version>3.3.0</maven-source-plugin.version>
125-
<maven-compiler-plugin.version>3.11.0</maven-compiler-plugin.version>
126-
<maven-javadoc-plugin.version>3.5.0</maven-javadoc-plugin.version>
127-
<maven-war-plugin.version>3.3.2</maven-war-plugin.version>
128-
<maven-scm-plugin.version>2.0.1</maven-scm-plugin.version>
129-
<maven-release-plugin.version>3.0.0-M7</maven-release-plugin.version>
130-
<maven-deploy-plugin.version>3.1.1</maven-deploy-plugin.version>
122+
<maven-surefire-plugin.version>3.3.0</maven-surefire-plugin.version>
123+
<maven-jar-plugin.version>3.4.2</maven-jar-plugin.version>
124+
<maven-source-plugin.version>3.3.1</maven-source-plugin.version>
125+
<maven-compiler-plugin.version>3.13.0</maven-compiler-plugin.version>
126+
<maven-javadoc-plugin.version>3.8.0</maven-javadoc-plugin.version>
127+
<maven-war-plugin.version>3.4.0</maven-war-plugin.version>
128+
<maven-scm-plugin.version>2.1.0</maven-scm-plugin.version>
129+
<maven-release-plugin.version>3.1.1</maven-release-plugin.version>
130+
<maven-deploy-plugin.version>3.1.2</maven-deploy-plugin.version>
131131

132-
<nexus-staging-maven-plugin.version>1.6.13</nexus-staging-maven-plugin.version>
133-
<maven-gpg-plugin.version>3.1.0</maven-gpg-plugin.version>
132+
<nexus-staging-maven-plugin.version>1.7.0</nexus-staging-maven-plugin.version>
133+
<maven-gpg-plugin.version>3.2.4</maven-gpg-plugin.version>
134134

135-
<commons-lang3.version>3.12.0</commons-lang3.version>
136-
<commons-io.version>2.12.0</commons-io.version>
137-
<gson.version>2.10.1</gson.version>
138-
<slf4j-api.version>2.0.6</slf4j-api.version>
135+
<commons-lang3.version>3.14.0</commons-lang3.version>
136+
<commons-io.version>2.16.1</commons-io.version>
137+
<gson.version>2.11.0</gson.version>
138+
<slf4j-api.version>2.0.13</slf4j-api.version>
139139

140-
<junit.version>5.9.3</junit.version>
140+
<junit.version>5.10.3</junit.version>
141141
<mockito.version>4.11.0</mockito.version>
142142
<logback.version>1.3.5</logback.version> <!--versions starting from 1.4.x were compiled with Java 11-->
143143

144-
<dependency-check-maven.version>8.2.1</dependency-check-maven.version>
144+
<dependency-check-maven.version>10.0.3</dependency-check-maven.version>
145145
</properties>
146146

147147
<dependencyManagement>
@@ -396,6 +396,11 @@
396396
</goals>
397397
</execution>
398398
</executions>
399+
<configuration>
400+
<excludes>
401+
<exclude>ch.qos.logback:logback-classic</exclude>
402+
</excludes>
403+
</configuration>
399404
</plugin>
400405
</plugins>
401406
</build>

‎readme.md‎

Lines changed: 1 addition & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -175,30 +175,4 @@ git push origin <tag_name>
175175
You can download pre-compiled versions from:
176176

177177
* [Maven Central repository](https://search.maven.org/search?q=csrfguard)
178-
* [OSS Sonatype Nexus repository](https://oss.sonatype.org/#nexus-search;gav~~csrfguard~~~)
179-
180-
## CSRFGuard 4.0.0 Release Notes
181-
182-
* [Support for stateless web applications](https://github.com/aramrami/OWASP-CSRFGuard/issues/122)
183-
* [Apply "TokenPerPage" approach to AJAX](https://github.com/aramrami/OWASP-CSRFGuard/issues/123)
184-
* [Reduced code duplication](https://github.com/aramrami/OWASP-CSRFGuard/issues/127)
185-
* [Proper multi-module maven project structure](https://github.com/aramrami/OWASP-CSRFGuard/issues/128)
186-
* [The test JSP web application now relies on the latest development JavaScript code](https://github.com/aramrami/OWASP-CSRFGuard/issues/133)
187-
* [Improved code quality](https://github.com/aramrami/OWASP-CSRFGuard/issues/134)
188-
* [Addressing synchronous XMLHttpRequest deprecation](https://github.com/aramrami/OWASP-CSRFGuard/issues/137)
189-
* [Approach changed for master and page token retrieval](https://github.com/aramrami/OWASP-CSRFGuard/issues/139)
190-
* [Improved test coverage](https://github.com/aramrami/OWASP-CSRFGuard/issues/140)
191-
* [Better solution for looking up page tokens in the JS](https://github.com/aramrami/OWASP-CSRFGuard/issues/141)
192-
* [The javascript template is now parsable and minifiable](https://github.com/aramrami/OWASP-CSRFGuard/issues/142)
193-
* [Short-circuit the solution logic if CSRFGuard is disabled](https://github.com/aramrami/OWASP-CSRFGuard/issues/143)
194-
* [Do not generate page tokens for pages that are not protected](https://github.com/aramrami/OWASP-CSRFGuard/issues/144)
195-
* [Page tokens generated on first use are not sent back to the client](https://github.com/aramrami/OWASP-CSRFGuard/issues/145)
196-
* [Issue with the token-per-page support for REST endpoint containing path parameters](https://github.com/aramrami/OWASP-CSRFGuard/issues/146)
197-
* [Possible race condition on first access of endpoints when token-per-page and AJAX request options are enabled](https://github.com/aramrami/OWASP-CSRFGuard/issues/147)
198-
* [Tokens are not injected into dynamically created DOM elements ](https://github.com/aramrami/OWASP-CSRFGuard/issues/148)
199-
* [Make the configuration more resilient to errors](https://github.com/aramrami/OWASP-CSRFGuard/issues/149)
200-
* [Tokens should not be injected into external links if the domainStrict property is set to true](https://github.com/aramrami/OWASP-CSRFGuard/issues/150)
201-
* [Tokens not injected in dynamic content returned from Ajax](https://github.com/aramrami/OWASP-CSRFGuard/issues/151)
202-
* Heavily refactored, improved and more optimized code-base
203-
* Documentation update and typo fixes.
204-
* Copyright update and unification.
178+
* [OSS Sonatype Nexus repository](https://oss.sonatype.org/#nexus-search;gav~~csrfguard~~~)

0 commit comments

Comments
 (0)