Produced by Araxis Merge on 7/9/2017 11:01:33 PM Eastern Daylight Time. See www.araxis.com for information about Merge. This report uses XHTML and CSS2, and is best viewed with a modern standards-compliant browser. For optimum results when printing this report, use landscape orientation and enable printing of background images and colours in your browser.
# | Location | File | Last Modified |
---|---|---|---|
1 | PPS_N_3.0_Iter2_Build_360.zip\Unredacted\PS_PPS_security\src\main\java\gov\va\med\pharmacy\peps\common\utility\security | ESAPIValidator.java | Fri Jun 30 19:11:16 2017 UTC |
2 | PPS_N_3.0_Iter2_Build_360.zip\Unredacted\PS_PPS_security\src\main\java\gov\va\med\pharmacy\peps\common\utility\security | ESAPIValidator.java | Fri Jul 7 17:51:44 2017 UTC |
Description | Between Files 1 and 2 |
|
---|---|---|
Text Blocks | Lines | |
Unchanged | 2 | 476 |
Changed | 1 | 2 |
Inserted | 0 | 0 |
Removed | 0 | 0 |
Whitespace | |
---|---|
Character case | Differences in character case are significant |
Line endings | Differences in line endings (CR and LF characters) are ignored |
CR/LF characters | Not shown in the comparison detail |
No regular expressions were active.
1 | package go v.va.med.p harmacy.pe ps.common. utility.se curity; | |
2 | ||
3 | import sta tic org.ow asp.esapi. ESAPI.vali dator; | |
4 | ||
5 | import jav a.io.File; | |
6 | import jav a.nio.file .Path; | |
7 | import jav a.nio.file .Paths; | |
8 | import jav a.util.Lis t; | |
9 | ||
10 | import org .owasp.esa pi.ESAPI; | |
11 | ||
12 | /** | |
13 | * ESAPI V alidator w rapper. | |
14 | * | |
15 | * @author DNS DN S
|
|
16 | * | |
17 | */ | |
18 | public fin al class E SAPIValida tor { | |
19 | pr ivate stat ic final o rg.apache. logging.lo g4j.Logger LOG = org .apache.lo gging.log4 j.LogManag er.getLogg er(ESAPIVa lidator.cl ass); | |
20 | ||
21 | /** | |
22 | * Pri vate const ructor. | |
23 | */ | |
24 | privat e ESAPIVal idator() { | |
25 | } | |
26 | ||
27 | /** | |
28 | * Val idate meth od. | |
29 | * | |
30 | * @pa ram input | |
31 | * th e input st ring to va lidate | |
32 | * @pa ram type | |
33 | * th e type of validation to be per formed | |
34 | * @re turn the s crubbed ou tput strin g if able to validat e/scrub - null if un able for L og Forging . | |
35 | * | |
36 | */ | |
37 | public static St ring valid ateStringI nput(Strin g input, E SAPIValida tionType t ype) { | |
38 | ||
39 | // Exit imme diately if input is null | |
40 | if (input == null) { | |
41 | return n ull; | |
42 | } | |
43 | ||
44 | // Exit imme diately if input is Empty | |
45 | if (input.le ngth() < 1 ) { | |
46 | return " "; | |
47 | } | |
48 | ||
49 | sw itch (type ) { | |
50 | ||
51 | ca se ACCESS_ CONTROL_DB : | |
52 | try { | |
53 | retu rn validat or().getVa lidInput(" accessCont rolDb", in put, "acce ssControlD b", Intege r.MAX_VALU E, false, false); | |
54 | } catch (Exception e) { | |
55 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. Access Con trol: DB v iolation." ); | |
56 | } | |
57 | ||
58 | ca se COMMAND _INJECTION : | |
59 | try { | |
60 | ||
61 | retu rn validat or() | |
62 | .getVa lidInput(" commandInj ection", i nput, "com mandInject ion", Inte ger.MAX_VA LUE, false , false); | |
63 | ||
64 | } catch (Exception e) { | |
65 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. Command In jection vi olation.") ; | |
66 | } | |
67 | ||
68 | ca se CROSS_S ITE_SCRIPT ING_PERSIS TENT: | |
69 | try { | |
70 | retu rn validat or().getVa lidInput(" crossSiteS criptingPe rsistent", input, "c rossSiteSc riptingPer sistent", | |
71 | Intege r.MAX_VALU E, false, false); | |
72 | } catch (Exception e) { | |
73 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. Cross Site Scripting : Persiste nt violati on."); | |
74 | } | |
75 | ||
76 | ca se CROSS_S ITE_SCRIPT ING_REFLEC TED: | |
77 | try { | |
78 | retur n validato r().getVal idInput("c rossSiteSc riptingRef lected", i nput, "cro ssSiteScri ptingRefle cted", | |
79 | Intege r.MAX_VALU E, false, false); | |
80 | } catch (Exception e) { | |
81 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. Cross Site Scripting : Reflect ed violati on."); | |
82 | } | |
83 | ||
84 | ca se DENIAL_ OF_SERVICE _REG_EXP: | |
85 | try { | |
86 | retu rn validat or().getVa lidInput(" denialOfSe rviceRegEx p", input, "denialOf ServiceReg Exp", Inte ger.MAX_VA LUE, | |
87 | false, false); | |
88 | } catch (Exception e) { | |
89 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. " | |
90 | + "Den ial Of Ser vice: Regu lar Expres sion viola tion."); | |
91 | } | |
92 | ||
93 | ca se JSON_IN JECTION: | |
94 | try { | |
95 | retu rn validat or().getVa lidInput(" jsonInject ion", inpu t, "jsonIn jection", Integer.MA X_VALUE, f alse, fals e); | |
96 | } catch (Exception e) { | |
97 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. JSON Injec tion viola tion."); | |
98 | } | |
99 | ||
100 | ca se LOG_FOR GING: | |
101 | // scrub out cr/lf | |
102 | input = input.repl ace('\n', ' ').repla ce('\r', ' '); | |
103 | try { | |
104 | retu rn validat or().getVa lidInput(" logForging ", input, "logForgin g", Intege r.MAX_VALU E, false, false); | |
105 | } catch (Exception e) { | |
106 | retu rn null; | |
107 | } | |
108 | ||
109 | ca se OPEN_RE DIRECT: | |
110 | try { | |
111 | retu rn validat or().getVa lidInput(" openRedire ct", input , "openRed irect", In teger.MAX_ VALUE, fal se, false) ; | |
112 | } catch (Exception e) { | |
113 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. Open Redir ect violat ion."); | |
114 | } | |
115 | ||
116 | ca se PATH_MA NIPULATION : | |
117 | try { | |
118 | retu rn validat or() | |
119 | .getVa lidInput(" pathManipu lation", i nput, "pat hManipulat ion", Inte ger.MAX_VA LUE, false , false); | |
120 | } catch (Exception e) { | |
121 | LOG. error("Str ing failed ESAPI PAT H_MANIPULA TION valid ation: " + input, e) ; | |
122 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. P ath Manipu lation vio lation."); | |
123 | } | |
124 | ||
125 | ca se PORTABI LITY_FLAW_ FILE_SEPAR ATOR: | |
126 | try { | |
127 | inpu t = input. replace('\ \', File.s eparator.t oCharArray ()[0]).rep lace('/', File.separ ator.toCha rArray()[0 ]); | |
128 | retu rn validat or().getVa lidInput(" portabilit yFlawFileS eparator", input, "p ortability FlawFileSe parator", | |
129 | Intege r.MAX_VALU E, false, false); | |
130 | } catch (Exception e) { | |
131 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. P ortability Flaw File Separator violation ."); | |
132 | } | |
133 | ||
134 | ca se PORTABI LITY_FLAW_ LOCALE: | |
135 | try { | |
136 | retu rn validat or().getVa lidInput(" portabilit yFlawLocal e", input, "portabil ityFlawLoc ale", Inte ger.MAX_VA LUE, | |
137 | false, false); | |
138 | } catch (Exception e) { | |
139 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. P ortability Flaw Loca le violati on."); | |
140 | } | |
141 | ||
142 | ca se PRIVACY _VIOLATION : | |
143 | // scrub out cr/lf | |
144 | input = input.repl ace('\n', ' ').repla ce('\r', ' '); | |
145 | try { | |
146 | retu rn validat or() | |
147 | .getVa lidInput(" privacyVio lation", i nput, "pri vacyViolat ion", Inte ger.MAX_VA LUE, false , false); | |
148 | } catch (Exception e) { | |
149 | retu rn null; | |
150 | } | |
151 | ||
152 | ca se SYSTEM_ INFORMATIO N_LEAK_EXT ERNAL: | |
153 | try { | |
154 | retu rn validat or().getVa lidInput(" systemInfo rmationLea kExternal" , input, " systemInfo rmationLea kExternal" , | |
155 | Intege r.MAX_VALU E, false, false); | |
156 | } catch (Exception e) { | |
157 | retu rn null; | |
158 | } | |
159 | ||
160 | ca se XML_EXT _ENTITY_IN J: | |
161 | try { | |
162 | retu rn validat or().getVa lidInput(" xmlExtEnti tyInj", in put, "xmlE xtEntityIn j", Intege r.MAX_VALU E, false, false); | |
163 | } catch (Exception e) { | |
164 | thro w new Runt imeExcepti on("Invali d characte rs found i n input. Open Redir ect violat ion."); | |
165 | } | |
166 | ||
167 | de fault: | |
168 | return n ull; | |
169 | } | |
170 | } | |
171 | ||
172 | /** | |
173 | * Val idate long method. | |
174 | * | |
175 | * @pa ram input | |
176 | * th e input st ring to va lidate | |
177 | * @re turn the l ong value if able to validate - -1 if un able. | |
178 | */ | |
179 | public static lo ng validat eLongInput (String in put) { | |
180 | tr y { | |
181 | return E SAPI.valid ator().get ValidNumbe r("validat eLong", in put, 0, Lo ng.MAX_VAL UE, false) .longValue (); | |
182 | } catch (Exc eption e) { | |
183 | throw ne w RuntimeE xception(" Invalid lo ng value f ound in in put."); | |
184 | } | |
185 | } | |
186 | ||
187 | /** | |
188 | * Val idate doub le input m ethod. | |
189 | * | |
190 | * @pa ram input the input string to validate | |
191 | * @re turn the d ouble valu e if able to validat e | |
192 | */ | |
193 | public static do uble valid ateDoubleI nput(Strin g input) { | |
194 | tr y { | |
195 | return E SAPI.valid ator().get ValidDoubl e("validat eDouble", input, 0, Double.MAX _VALUE, fa lse).doubl eValue(); | |
196 | } catch (Exc eption e) { | |
197 | throw ne w RuntimeE xception(" Invalid do uble value found in input."); | |
198 | } | |
199 | } | |
200 | ||
201 | /** | |
202 | * Val idate file name meth od. | |
203 | * | |
204 | * @pa ram input | |
205 | * th e input fi le name st ring to va lidate | |
206 | * @pa ram allowe dExtension s | |
207 | * Li st of allo wable file extension s in strin g format | |
208 | * @re turn a can onicalized and valid ated file name as a String. | |
209 | */ | |
210 | public static St ring valid ateFileNam eInput(Str ing input, List<Stri ng> allowe dExtension s) { | |
211 | tr y { | |
212 | return E SAPI.valid ator().get ValidFileN ame("valid ateFileNam eInput", i nput, allo wedExtensi ons, false ); | |
213 | } catch (Exc eption e) { | |
214 | throw ne w RuntimeE xception(" Invalid fi le name va lue found in input." ); | |
215 | } | |
216 | } | |
217 | ||
218 | ||
219 | ||
220 | /** | |
221 | * Val idate file name meth od. | |
222 | * | |
223 | * @pa ram input | |
224 | * th e input fi le name st ring to va lidate | |
225 | * @pa ram allowe dExtension s | |
226 | * Li st of allo wable file extension s in strin g format | |
227 | * @re turn a can onicalized and valid ated file name as a String. | |
228 | */ | |
229 | public static St ring valid ateFileNam eInputWith Path(Strin g input, L ist<String > allowedE xtensions) { | |
230 | Pa th path = Paths.get( validateSt ringInput( input, ESA PIValidati onType.LOG _FORGING)) ; | |
231 | St ring fileN ame = path .getFileNa me().toStr ing(); | |
232 | if (validate FileNameIn put(fileNa me, allowe dExtension s).equals( fileName)) { | |
233 | return v alidateStr ingInput(i nput, ESAP IValidatio nType.LOG_ FORGING); | |
234 | } else { | |
235 | throw ne w RuntimeE xception(" Invalid fi le name va lue found in input." ); | |
236 | } | |
237 | ||
238 | } | |
239 | } |
Araxis Merge (but not the data content of this report) is Copyright © 1993-2016 Araxis Ltd (www.araxis.com). All rights reserved.