Skip to content

Commit

Permalink
Some of this appears to have been already covered in PR #663 (#670)
Browse files Browse the repository at this point in the history 
* Signed key history for MATT SEIL begins here.

* Signed key history for MATT SEIL begins here.  Fixed email typo.

* Revert "Signed key history for MATT SEIL begins here.  Fixed email typo."

This reverts commit 87c4c4e.

* created file on main.

* Deleted foo.txt

* Bump release to new patch version #.

* #661 Added ability to generate OSGi metadata with the command 'mvn org.apache.felix:maven-bundle-plugin:manifest'.

* Updated to AntiSamy 1.6.5.

* Revert "#661 Added ability to generate OSGi metadata with the command 'mvn org.apache.felix:maven-bundle-plugin:manifest'."

This reverts commit 9fa2a53.

* #656 -->  Parameterized cookie name length and value to correspond with the HTTP maxes defined in esapi.properties.

* Adjusted regex to allow for zero-length matches.

* Added per review comments for PR #663

* #656 Finished sweep looking for headername, headervalue, and header value sizes as well as the 'Cookie' versions of those statements.  Added unit tests.

* #663 Fixed a missed unit test.

* Antisamy 1.6.6, Antisamy regression test for analysis 1.  A handful of new regression tests for other purposes in validation and encoder tests.

* Attempting to fix classfile differences with antisamy dependencies.

* Fixed typo on exclusion.

* Added xerces exclusion to antisamy in the pom.xml

* Added test cases 2 & 3.

* Added test cases 2 & 3.  @ignore on test case 3 from AntiSamy as the DOS is still present.

* Forced my version to match Wichers.

* Added a pair of unit tests for canoncialization to prove out an issue opened up on github.  One of which however reminded me that we need a codec to account for UTF-8 encoding/decoding.

Co-authored-by: Matt Seil <xeno6696[at]gmail.com>
Co-authored-by: kwwall <kevin.w.wall@gmail.com>
  • Loading branch information
@xeno6696 @kwwall
xeno6696 and kwwall authored Apr 8, 2022
1 parent 086b3e8 commit 5db31cf
Show file tree
Hide file tree
Showing 6 changed files with 103 additions and 8 deletions.
3 changes: 2 additions & 1 deletion src/main/java/org/owasp/esapi/reference/AbstractAuthenticator.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,8 @@ protected User getUserFromSession() {
*/
protected DefaultUser getUserFromRememberToken() {
try {
String token = ESAPI.httpUtilities().getCookie(ESAPI.currentRequest(), HTTPUtilities.REMEMBER_TOKEN_COOKIE_NAME);
HTTPUtilities utils =ESAPI.httpUtilities();
String token = utils.getCookie(ESAPI.currentRequest(), HTTPUtilities.REMEMBER_TOKEN_COOKIE_NAME);
if (token == null) return null;

// See Google Issue 144 regarding first URLDecode the token and THEN unsealing.
Expand Down
11 changes: 7 additions & 4 deletions src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -235,11 +235,12 @@ public void addHeader(String name, String value) {
* {@inheritDoc}
*/
public void addHeader(HttpServletResponse response, String name, String value) {
SecurityConfiguration sc = ESAPI.securityConfiguration();
try {
String strippedName = StringUtilities.replaceLinearWhiteSpace(name);
String strippedValue = StringUtilities.replaceLinearWhiteSpace(value);
String safeName = ESAPI.validator().getValidInput("addHeader", strippedName, "HTTPHeaderName", 20, false);
String safeValue = ESAPI.validator().getValidInput("addHeader", strippedValue, "HTTPHeaderValue", 500, false);
String safeName = ESAPI.validator().getValidInput("addHeader", strippedName, "HTTPHeaderName", sc.getIntProp("HttpUtilities.MaxHeaderNameSize"), false);
String safeValue = ESAPI.validator().getValidInput("addHeader", strippedValue, "HTTPHeaderValue", sc.getIntProp("HttpUtilities.MaxHeaderValueSize"), false);
response.addHeader(safeName, safeValue);
} catch (ValidationException e) {
logger.warning(Logger.SECURITY_FAILURE, "Attempt to add invalid header denied", e);
Expand Down Expand Up @@ -464,9 +465,10 @@ public void encryptStateInCookie( Map<String,String> cleartext ) throws Encrypti
*/
public String getCookie( HttpServletRequest request, String name ) throws ValidationException {
Cookie c = getFirstCookie( request, name );
SecurityConfiguration sc = ESAPI.securityConfiguration();
if ( c == null ) return null;
String value = c.getValue();
return ESAPI.validator().getValidInput("HTTP cookie value: " + value, value, "HTTPCookieValue", 1000, false);
return ESAPI.validator().getValidInput("HTTP cookie value: " + value, value, "HTTPCookieValue", sc.getIntProp("HttpUtilities.MaxHeaderValueSize"), false);
}

/**
Expand Down Expand Up @@ -656,8 +658,9 @@ private Cookie getFirstCookie(HttpServletRequest request, String name) {
* {@inheritDoc}
*/
public String getHeader( HttpServletRequest request, String name ) throws ValidationException {
SecurityConfiguration sc = ESAPI.securityConfiguration();
String value = request.getHeader(name);
return ESAPI.validator().getValidInput("HTTP header value: " + value, value, "HTTPHeaderValue", 150, false);
return ESAPI.validator().getValidInput("HTTP header value: " + value, value, "HTTPHeaderValue", sc.getIntProp("HttpUtilities.MaxHeaderValueSize"), false);
}


Expand Down
21 changes: 20 additions & 1 deletion src/test/java/org/owasp/esapi/reference/EncoderTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,8 @@ public void testCanonicalize() throws EncodingException {
assertEquals( "<", instance.canonicalize("&lT;"));
assertEquals( "<", instance.canonicalize("&Lt;"));
assertEquals( "<", instance.canonicalize("&LT;"));
assertEquals( "&", instance.canonicalize("&amp"));
assertEquals( "〈", instance.canonicalize("&lang"));

assertEquals( "<script>alert(\"hello\");</script>", instance.canonicalize("%3Cscript%3Ealert%28%22hello%22%29%3B%3C%2Fscript%3E") );
assertEquals( "<script>alert(\"hello\");</script>", instance.canonicalize("%3Cscript&#x3E;alert%28%22hello&#34%29%3B%3C%2Fscript%3E", false) );
Expand Down Expand Up @@ -912,11 +914,28 @@ public void testHtmlEncodeStrSurrogatePair()

public void testHtmlDecodeHexEntititesSurrogatePair()
{
HTMLEntityCodec htmlCodec = new HTMLEntityCodec();
HTMLEntityCodec htmlCodec = new HTMLEntityCodec();
String expected = new String (new int[]{0x2f804}, 0, 1);
assertEquals( expected, htmlCodec.decode("&#194564;") );
assertEquals( expected, htmlCodec.decode("&#x2f804;") );
}

public void testUnicodeCanonicalize() {
Encoder e = ESAPI.encoder();
String input = "测试";
String expected = "测试";
String output = e.canonicalize(input);
assertEquals(expected, output);
}

public void testUnicodeCanonicalizePercentEncoding() {
//TODO: We need to find a way to specify the encoding type for percent encoding.
//I believe by default we're doing Latin-1 and we really should be doing UTF-8
Encoder e = ESAPI.encoder();
String input = "%E6%B5%8B%E8%AF%95";
String expected = "测试";
String output = e.canonicalize(input);
assertNotSame(expected, output);
}
}

22 changes: 22 additions & 0 deletions src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@
import org.owasp.esapi.http.MockHttpServletResponse;
import org.owasp.esapi.http.MockHttpSession;
import org.owasp.esapi.util.FileTestUtils;
import org.owasp.esapi.util.TestUtils;

import junit.framework.Test;
import junit.framework.TestCase;
Expand Down Expand Up @@ -372,6 +373,27 @@ public void testSetCookie() {
instance.addCookie( response, new Cookie( "test3", "tes<t3" ) );
assertTrue(response.getHeaderNames().size() == 2);
}

/**
* Test of setCookie method, of class org.owasp.esapi.HTTPUtilities.
* Validation failures should prevent cookies being added.
*/
public void testSetCookieExceedingMaxValueAndName() {
HTTPUtilities instance = ESAPI.httpUtilities();
MockHttpServletResponse response = new MockHttpServletResponse();
assertTrue(response.getHeaderNames().isEmpty());
//request.addParameter(TestUtils.generateStringOfLength(32), "pass");
instance.addCookie( response, new Cookie( TestUtils.generateStringOfLength(32), "pass" ) );
assertTrue(response.getHeaderNames().size() == 1);

instance.addCookie( response, new Cookie( "pass", TestUtils.generateStringOfLength(32) ) );
assertTrue(response.getHeaderNames().size() == 2);
instance.addCookie( response, new Cookie( TestUtils.generateStringOfLength(5000), "fail" ) );
assertTrue(response.getHeaderNames().size() == 2);
instance.addCookie( response, new Cookie( "fail", TestUtils.generateStringOfLength(5001) ) );
assertTrue(response.getHeaderNames().size() == 2);
}


/**
*
Expand Down
10 changes: 8 additions & 2 deletions src/test/java/org/owasp/esapi/reference/ValidatorTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1040,15 +1040,13 @@ public void testHeaderLengthChecks(){

@Test
public void testGetHeaderNames() {
//testing Validator.HTTPHeaderName
MockHttpServletRequest request = new MockHttpServletRequest();
SecurityWrapperRequest safeRequest = new SecurityWrapperRequest(request);
request.addHeader("d-49653-p", "pass");
request.addHeader("<img ", "fail");
// Note: Max length in ESAPI.properties as per
// Validator.HTTPHeaderName regex is 256, but upper
// bound is configurable by the property HttpUtilities.MaxHeaderNameSize
SecurityConfiguration sc = ESAPI.securityConfiguration();
request.addHeader(TestUtils.generateStringOfLength(255), "pass");
request.addHeader(TestUtils.generateStringOfLength(257), "fail");
assertEquals(2, Collections.list(safeRequest.getHeaderNames()).size());
Expand Down Expand Up @@ -1130,5 +1128,13 @@ public void testavaloqLooseSafeString(){
boolean isValid = v.isValidInput("RegexString", "&quot;test&quot;", "avaloqLooseSafeString", 2147483647, true, true);
assertFalse(isValid);
}

@Test
public void testStandardHeader() {
Validator v = ESAPI.validator();
boolean expected = false;
boolean result = v.isValidInput("HTTPHeaderValue ", "mary.poppins@gmail.com", "HTTPHeaderValue", 2147483647, true, true);
assertEquals(expected, result);
}
}

44 changes: 44 additions & 0 deletions src/test/java/org/owasp/esapi/reference/validation/HTMLValidationRuleCleanTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,14 @@
import org.owasp.esapi.ValidationErrorList;
import org.owasp.esapi.ValidationRule;
import org.owasp.esapi.Validator;
import org.owasp.esapi.errors.IntrusionException;
import org.owasp.esapi.errors.ValidationException;
import org.owasp.esapi.filters.SecurityWrapperRequest;
import org.owasp.esapi.reference.validation.HTMLValidationRule;

import org.junit.Test;
import org.junit.Before;
import org.junit.Ignore;
import org.junit.After;
import org.junit.Rule;
import org.junit.rules.ExpectedException;
Expand Down Expand Up @@ -153,4 +155,46 @@ public void testIsValidSafeHTML() {
assertTrue(errors.size() == 0);

}

@Test
public void testAntiSamyRegressionCDATAWithJavascriptURL() throws Exception {
Validator instance = ESAPI.validator();
ValidationErrorList errors = new ValidationErrorList();
String input = "<style/>b<![cdata[</style><a href=javascript:alert(1)>test";
assertTrue(instance.isValidSafeHTML("test7", input, 100, false, errors));
String expected = "b&lt;/style&gt;&lt;a href=javascript:alert(1)&gt;test";
String output = instance.getValidSafeHTML("javascript Link", input, 250, false);
assertEquals(expected, output);
assertTrue(errors.size() == 0);

}

@Test
public void testScriptTagAfterStyleClosing() throws Exception {
Validator instance = ESAPI.validator();
ValidationErrorList errors = new ValidationErrorList();
String input = "<select<style/>W<xmp<script>alert(1)</script>";
assertTrue(instance.isValidSafeHTML("test7", input, 100, false, errors));
String expected = "W&lt;script&gt;alert(1)&lt;/script&gt;";
String output = instance.getValidSafeHTML("escaping style tag attack", input, 250, false);
assertEquals(expected, output);
assertTrue(errors.size() == 0);

}

@Test
@Ignore
public void testNekoDOSWithAnHTMLComment() throws Exception {
/**
* FIXME: This unit test needs to pass before the next ESAPI release.
*/
Validator instance = ESAPI.validator();
ValidationErrorList errors = new ValidationErrorList();
String input = "<!--><?a/";
assertTrue(instance.isValidSafeHTML("test7", input, 100, false, errors));
String expected = "&#x3C;!--&#x3E;&#x3C;?a/";
String output = instance.getValidSafeHTML("escaping style tag attack", input, 250, false);
assertEquals(expected, output);
assertTrue(errors.size() == 0);
}
}

0 comments on commit 5db31cf

Please sign in to comment.