From 70ce36592b023c40d41f2908c9c6d2986adf272b Mon Sep 17 00:00:00 2001 From: kwwall Date: Wed, 29 Jul 2020 23:23:28 -0400 Subject: [PATCH 1/4] Bump min ESAPI dependency from 2.0 to 2.2. --- esapi/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/esapi/pom.xml b/esapi/pom.xml index 260f0f5..637012a 100644 --- a/esapi/pom.xml +++ b/esapi/pom.xml @@ -63,7 +63,7 @@ org.owasp.esapi esapi - [2.0,3) + [2.2,3) From 7086f40624f8da97e08544804bd287b10dbde954 Mon Sep 17 00:00:00 2001 From: kwwall Date: Wed, 29 Jul 2020 23:24:42 -0400 Subject: [PATCH 2/4] Bring ESAPIEncoder in compliance with ESAPI 2.2.0.0 and later Encoder interface which added new methods. --- .../java/org/owasp/encoder/esapi/ESAPIEncoder.java | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/esapi/src/main/java/org/owasp/encoder/esapi/ESAPIEncoder.java b/esapi/src/main/java/org/owasp/encoder/esapi/ESAPIEncoder.java index 0f00de0..2363d44 100644 --- a/esapi/src/main/java/org/owasp/encoder/esapi/ESAPIEncoder.java +++ b/esapi/src/main/java/org/owasp/encoder/esapi/ESAPIEncoder.java @@ -35,6 +35,7 @@ package org.owasp.encoder.esapi; import java.io.IOException; +import java.net.URI; import org.owasp.encoder.Encode; import org.owasp.esapi.Encoder; import org.owasp.esapi.codecs.Codec; @@ -63,6 +64,7 @@ * {@link org.owasp.esapi.Encoder#canonicalize(String)}, * {@link org.owasp.esapi.Encoder#canonicalize(String, boolean)}, * {@link org.owasp.esapi.Encoder#canonicalize(String, boolean, boolean)} + * {@link org.owasp.esapi.Encoder#getCanonicalizedURI(URI)} * *

Decoding methods: * {@link org.owasp.esapi.Encoder#decodeForHTML(String)}, @@ -80,6 +82,7 @@ *

Rarely-used or alternate compatible encoding: * {@link org.owasp.esapi.Encoder#encodeForVBScript(String)}, * {@link org.owasp.esapi.Encoder#encodeForLDAP(String)}, + * {@link org.owasp.esapi.Encoder#encodeForLDAP(String, boolean)}, * {@link org.owasp.esapi.Encoder#encodeForDN(String)}

* * @@ -152,6 +155,11 @@ public String canonicalize(String s, boolean restrictMultiple, boolean restrictM return _referenceEncoder.canonicalize(s, restrictMultiple, restrictMixed); } + /** {@inheritDoc} */ + public String getCanonicalizedURI(URI dirtyUri) { + return _referenceEncoder.getCanonicalizedURI(dirtyUri); + } + /** {@inheritDoc} */ public String encodeForCSS(String s) { return Encode.forCssString(s); @@ -197,6 +205,11 @@ public String encodeForLDAP(String s) { return _referenceEncoder.encodeForLDAP(s); } + /** {@inheritDoc} */ + public String encodeForLDAP(String s, boolean b) { + return _referenceEncoder.encodeForLDAP(s, b); + } + /** {@inheritDoc} */ public String encodeForDN(String s) { return _referenceEncoder.encodeForDN(s); @@ -236,5 +249,6 @@ public String encodeForBase64(byte[] bytes, boolean wrap) { public byte[] decodeFromBase64(String s) throws IOException { return _referenceEncoder.decodeFromBase64(s); } + } } From b28c534c99d26e93d4b3ec0caac0ab847ebedb0f Mon Sep 17 00:00:00 2001 From: kwwall Date: Wed, 29 Jul 2020 23:30:11 -0400 Subject: [PATCH 3/4] Minimal properties to get JUnit tests working for ESAPIEncoderTest. --- .../test/resources/.esapi/ESAPI.properties | 39 ++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/esapi/src/test/resources/.esapi/ESAPI.properties b/esapi/src/test/resources/.esapi/ESAPI.properties index bdffd2a..b92f991 100644 --- a/esapi/src/test/resources/.esapi/ESAPI.properties +++ b/esapi/src/test/resources/.esapi/ESAPI.properties @@ -1 +1,38 @@ -ESAPI.Encoder=org.owasp.encoder.esapi.ESAPIEncoder \ No newline at end of file +# Properties based on ESAPI 2.2.1.1's configuration/esapi/ESAPI.properties file. + +ESAPI.Encoder=org.owasp.encoder.esapi.ESAPIEncoder + +# Log4JFactory Requires log4j.xml or log4j.properties in classpath - http://www.laliluna.de/log4j-tutorial.html +# Note that this is now considered deprecated! +#ESAPI.Logger=org.owasp.esapi.logging.log4j.Log4JLogFactory + +# To use JUL, you need to obtain ESAPI's esapi-java-logging.properties and drop +# it somewhere into your class path. You can get it from the ESAPI configuration +# jar. (See Release 2.2.1.1 under GitHub for ESAPI/esapi-java-legacy.) + +#ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory +# To use the new SLF4J logger in ESAPI (see GitHub issue #129), set +ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory +# and do whatever other normal SLF4J configuration that you normally would do for your application. + +# Note: The uncommented out ones are those needed for SLF4J. Others may be +# needed if you change the ESAPI logger. +#=========================================================================== +# ESAPI Logging +# Set the application name if these logs are combined with other applications +Logger.ApplicationName=ESAPI-Shim-Test +# If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true +Logger.LogEncodingRequired=false +# Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments. +Logger.LogApplicationName=true +# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments. +Logger.LogServerIP=false +# LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you +# want to place it in a specific directory. +#Logger.LogFileName=ESAPI_logging_file +# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000) +#Logger.MaxLogFileSize=10000000 +# Determines whether ESAPI should log the user info. +Logger.UserInfo=false +# Determines whether ESAPI should log the session id and client IP +Logger.ClientInfo=false From d816d12b4f06c091fd998afe43f4b98f90f13b81 Mon Sep 17 00:00:00 2001 From: kwwall Date: Sun, 2 Aug 2020 13:51:14 -0400 Subject: [PATCH 4/4] Change from using SLF4J to JUL for logging. --- esapi/src/test/resources/.esapi/ESAPI.properties | 4 ++-- esapi/src/test/resources/esapi-java-logging.properties | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) create mode 100644 esapi/src/test/resources/esapi-java-logging.properties diff --git a/esapi/src/test/resources/.esapi/ESAPI.properties b/esapi/src/test/resources/.esapi/ESAPI.properties index b92f991..d1d5f41 100644 --- a/esapi/src/test/resources/.esapi/ESAPI.properties +++ b/esapi/src/test/resources/.esapi/ESAPI.properties @@ -9,10 +9,10 @@ ESAPI.Encoder=org.owasp.encoder.esapi.ESAPIEncoder # To use JUL, you need to obtain ESAPI's esapi-java-logging.properties and drop # it somewhere into your class path. You can get it from the ESAPI configuration # jar. (See Release 2.2.1.1 under GitHub for ESAPI/esapi-java-legacy.) +ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory -#ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory # To use the new SLF4J logger in ESAPI (see GitHub issue #129), set -ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory +#ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory # and do whatever other normal SLF4J configuration that you normally would do for your application. # Note: The uncommented out ones are those needed for SLF4J. Others may be diff --git a/esapi/src/test/resources/esapi-java-logging.properties b/esapi/src/test/resources/esapi-java-logging.properties new file mode 100644 index 0000000..71011ac --- /dev/null +++ b/esapi/src/test/resources/esapi-java-logging.properties @@ -0,0 +1,6 @@ +handlers= java.util.logging.ConsoleHandler +.level= INFO +java.util.logging.ConsoleHandler.level = INFO +java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter +java.util.logging.SimpleFormatter.format=[%1$tF %1$tT] [%3$-7s] %5$s %n +#https://www.logicbig.com/tutorials/core-java-tutorial/logging/customizing-default-format.html \ No newline at end of file