Produced by Araxis Merge on 11/14/2017 6:57:21 AM Central Standard Time. See www.araxis.com for information about Merge. This report uses XHTML and CSS2, and is best viewed with a modern standards-compliant browser. For optimum results when printing this report, use landscape orientation and enable printing of background images and colours in your browser.
| # | Location | File | Last Modified |
|---|---|---|---|
| 1 | cbs.zip\cbs\cbs\src\main\resources\env | ESAPI.properties | Thu Nov 9 14:19:36 2017 UTC |
| 2 | cbs.zip\cbs\cbs\src\main\resources\env | ESAPI.properties | Tue Nov 14 12:41:48 2017 UTC |
| Description | Between Files 1 and 2 |
|
|---|---|---|
| Text Blocks | Lines | |
| Unchanged | 2 | 870 |
| Changed | 1 | 2 |
| Inserted | 0 | 0 |
| Removed | 0 | 0 |
| Whitespace | |
|---|---|
| Character case | Differences in character case are significant |
| Line endings | Differences in line endings (CR and LF characters) are ignored |
| CR/LF characters | Not shown in the comparison detail |
No regular expressions were active.
| 1 | # | |
| 2 | # OWASP En terprise S ecurity AP I (ESAPI) Properties file -- T EST Versio n | |
| 3 | # | |
| 4 | # This fil e is part of the Ope n Web Appl ication Se curity Pro ject (OWAS P) | |
| 5 | # Enterpri se Securit y API (ESA PI) projec t. For det ails, plea se see | |
| 6 | # http://w ww.owasp.o rg/index.p hp/ESAPI. | |
| 7 | # | |
| 8 | # Copyrigh t (c) 2008 ,2009 - Th e OWASP Fo undation | |
| 9 | # | |
| 10 | # DISCUSS: This may cause a ma jor backwa rds compat ibility is sue, etc. but | |
| 11 | #from a na me space p erspective , we proba bly should have pref aced | |
| 12 | # all th e property names wit h ESAPI or at least OWASP. Oth erwise | |
| 13 | # there co uld be pro blems is s omeone loa ds this pr operties f ile into | |
| 14 | #the Syste m properti es. We co uld also p ut this fi le into th e | |
| 15 | #esapi.jar file (per haps as a ResourceBu ndle) and then allow an extern al | |
| 16 | # ESAPI pr operties b e defined that would overwrite these def aults. | |
| 17 | # That kee ps the app lication's propertie s relative ly simple as usually | |
| 18 | # they wil l only wan t to overr ide a few properties . If looks like we | |
| 19 | # already support mu ltiple ove rride leve ls of this in the | |
| 20 | # DefaultS ecurityCon figuration class, bu t I'm sugg esting pla cing the | |
| 21 | # defaults in the es api.jar it self. That way, if t he jar is signed, | |
| 22 | # we could detect if those pro perties ha d been tam pered with . (The | |
| 23 | #code to c heck the j ar signatu res is pre tty simple ... maybe 70-90 LOC, | |
| 24 | # but off course the re is an e xecution p enalty (si milar to t he way | |
| 25 | # that the separate sunjce.jar used to b e when a c lass from it was | |
| 26 | #first loa ded). Thou ghts? | |
| 27 | ########## ########## ########## ########## ########## ########## ########## ######### | |
| 28 | # | |
| 29 | # WARNING: Operating system pr otection s hould be u sed to loc k down the .esapi | |
| 30 | # resource s director y and all the files inside and all the d irectories all the | |
| 31 | # way up t o the root directory of the fi le system. Note tha t if you a re using | |
| 32 | # file-bas ed impleme ntations, that some files may need to be read-writ e as they | |
| 33 | # get upda ted dynami cally. | |
| 34 | # | |
| 35 | # Before u sing, be s ure to upd ate the Ma sterKey an d MasterSa lt as desc ribed belo w. | |
| 36 | # N.B.: If you had s tored data that you have previ ously encr ypted with ESAPI 1.4 , | |
| 37 | #you *must * FIRST de crypt it u sing ESAPI 1.4 and t hen (if so desired) | |
| 38 | #re-encryp t it with ESAPI 2.0. If you fa il to do t his, you w ill NOT be | |
| 39 | #able to d ecrypt you r data wit h ESAPI 2. 0. | |
| 40 | # | |
| 41 | #YOU HAVE BEEN WARNE D!!! More details ar e in the E SAPI 2.0 R elease Not es. | |
| 42 | # | |
| 43 | #========= ========== ========== ========== ========== ========== ========== ====== | |
| 44 | # ESAPI Co nfiguratio n | |
| 45 | # | |
| 46 | # If true, then prin t all the ESAPI prop erties set here when they are loaded. | |
| 47 | # If false , they are not print ed. Useful to reduce output wh en running JUnit tes ts. | |
| 48 | # If you n eed to tro ubleshoot a properti es related problem, turning th is on may help, | |
| 49 | # but we l eave it of f for runn ing JUnit tests. (It will be ' true' in t he one del ivered | |
| 50 | # as part of product ion ESAPI, mostly fo r backward compatibi lity.) | |
| 51 | ESAPI.prin tPropertie s=false | |
| 52 | ||
| 53 | # ESAPI is designed to be easi ly extensi ble. You c an use the reference implement ation | |
| 54 | # or imple ment your own provid ers to tak e advantag e of your enterprise 's securit y | |
| 55 | # infrastr ucture. Th e function s in ESAPI are refer enced usin g the ESAP I locator, like: | |
| 56 | # | |
| 57 | # Strin g cipherte xt = | |
| 58 | #ESAPI.enc ryptor().e ncrypt("Se cret messa ge"); // Deprecate d in 2.0 | |
| 59 | # Ciphe rText ciph erText = | |
| 60 | #ESAPI.enc ryptor().e ncrypt(new PlainText ("Secret m essage")); // Prefer red | |
| 61 | # | |
| 62 | # Below yo u can spec ify the cl assname fo r the prov ider that you wish t o use in y our | |
| 63 | # applicat ion. The o nly requir ement is t hat it imp lement the appropria te ESAPI i nterface. | |
| 64 | # This all ows you to switch se curity imp lementatio ns in the future wit hout rewri ting the | |
| 65 | # entire a pplication . | |
| 66 | # | |
| 67 | # Experime ntalAccess Controller requires ESAPI-Acce ssControlP olicy.xml in .esapi directory | |
| 68 | ESAPI.Acce ssControl= org.owasp. esapi.refe rence.Defa ultAccessC ontroller | |
| 69 | # FileBase dAuthentic ator requi res users. txt file i n .esapi d irectory | |
| 70 | ESAPI.Auth enticator= org.owasp. esapi.refe rence.File BasedAuthe nticator | |
| 71 | ESAPI.Enco der=org.ow asp.esapi. reference. DefaultEnc oder | |
| 72 | ESAPI.Encr yptor=org. owasp.esap i.referenc e.crypto.J avaEncrypt or | |
| 73 | ||
| 74 | ESAPI.Exec utor=org.o wasp.esapi .reference .DefaultEx ecutor | |
| 75 | ESAPI.HTTP Utilities= org.owasp. esapi.refe rence.Defa ultHTTPUti lities | |
| 76 | ESAPI.Intr usionDetec tor=org.ow asp.esapi. reference. DefaultInt rusionDete ctor | |
| 77 | # Log4JFac tory Requi res log4j. xml or log 4j.propert ies in cla sspath - h ttp://www. laliluna.d e/log4j-tu torial.htm l | |
| 78 | #ESAPI.Log ger=org.ow asp.esapi. reference. Log4JLogFa ctory | |
| 79 | ESAPI.Logg er=org.owa sp.esapi.r eference.J avaLogFact ory | |
| 80 | #ESAPI.Log ger=org.ow asp.esapi. reference. ExampleExt endedLog4J LogFactory | |
| 81 | ESAPI.Rand omizer=org .owasp.esa pi.referen ce.Default Randomizer | |
| 82 | ESAPI.Vali dator=org. owasp.esap i.referenc e.DefaultV alidator | |
| 83 | ||
| 84 | #========= ========== ========== ========== ========== ========== ========== ====== | |
| 85 | # ESAPI En coder | |
| 86 | # | |
| 87 | # ESAPI ca nonicalize s input be fore valid ation to p revent byp assing fil ters with encoded at tacks. | |
| 88 | # Failure to canonic alize inpu t is a ver y common m istake whe n implemen ting valid ation sche mes. | |
| 89 | # Canonica lization i s automati c when usi ng the ESA PI Validat or, but yo u can also use the | |
| 90 | # followin g code to canonicali ze data. | |
| 91 | # | |
| 92 | # ESA PI.Encoder ().canonic alize( "%2 2hello wor ld"" ); | |
| 93 | # | |
| 94 | # Multiple encoding is when a single enc oding form at is appl ied multip le times. Allowing | |
| 95 | # multiple encoding is strongl y discoura ged. | |
| 96 | Encoder.Al lowMultipl eEncoding= false | |
| 97 | ||
| 98 | # Mixed en coding is when multi ple differ ent encodi ng formats are appli ed, or whe n | |
| 99 | # multiple formats a re nested. Allowing multiple e ncoding is strongly discourage d. | |
| 100 | Encoder.Al lowMixedEn coding=fal se | |
| 101 | ||
| 102 | # The defa ult list o f codecs t o apply wh en canonic alizing un trusted da ta. The li st should include th e codecs | |
| 103 | # for all downstream interpret ers or dec oders. For example, if the dat a is likel y to end u p in a URL , HTML, or | |
| 104 | # inside J avaScript, then the list of co decs below is approp riate. The order of the list i s not terr ibly impor tant. | |
| 105 | Encoder.De faultCodec List=HTMLE ntityCodec ,PercentCo dec,JavaSc riptCodec | |
| 106 | ||
| 107 | ||
| 108 | #========= ========== ========== ========== ========== ========== ========== ====== | |
| 109 | # ESAPI En cryption | |
| 110 | # | |
| 111 | # The ESAP I Encrypto r provides basic cry ptographic functions with a si mplified A PI. | |
| 112 | # To get s tarted, ge nerate a n ew key usi ng java -c lasspath e sapi.jar o rg.owasp.e sapi.refer ence.crypt o.JavaEncr yptor | |
| 113 | # There is not curre ntly any s upport for key rotat ion, so be careful w hen changi ng your ke y and salt as it | |
| 114 | # will inv alidate al l signed, encrypted, and hashe d data. | |
| 115 | # | |
| 116 | # WARNING: Not all c ombination s of algor ithms and key length s are supp orted. | |
| 117 | # If you c hoose to u se a key l ength grea ter than 1 28, you MU ST downloa d the | |
| 118 | # unlimite d strength policy fi les and in stall in t he lib dir ectory of your JRE/J DK. | |
| 119 | # See http ://java.su n.com/java se/downloa ds/index.j sp for mor e informat ion. | |
| 120 | # | |
| 121 | # Backward compatibi lity with ESAPI Java 1.4 is su pported by the two d eprecated API | |
| 122 | # methods, Encryptor .encrypt(S tring) and Encryptor .decrypt(S tring). Ho wever, whe never | |
| 123 | # possible , these me thods shou ld be avoi ded as the y use ECB cipher mod e, which i n almost | |
| 124 | # all circ umstances a poor cho ice becaus e of it's weakness. CBC cipher mode is t he default | |
| 125 | # for the new Encryp tor encryp t / decryp t methods for ESAPI Java 2.0. In genera l, you | |
| 126 | # should o nly use th is compati bility set ting if yo u have per sistent da ta encrypt ed with | |
| 127 | # version 1.4 and ev en then, y ou should ONLY set t his compat ibility mo de UNTIL | |
| 128 | # you have decrypted all of yo ur old enc rypted dat a and then re-encryp ted it wit h | |
| 129 | # ESAPI 2. 0 using CB C mode. If you have some reaso n to mix t he depreca ted 1.4 mo de | |
| 130 | # with the new 2.0 m ethods, ma ke sure th at you use the same cipher alg orithm for both | |
| 131 | # (256-bit AES was t he default for 1.4; 128-bit is the defau lt for 2.0 ; see belo w for | |
| 132 | # more det ails.) Oth erwise, yo u will hav e to use t he new 2.0 encrypt / decrypt m ethods | |
| 133 | # where yo u can spec ify a Secr etKey. (No te that if you are u sing the 2 56-bit AES , | |
| 134 | # that req uires down loading th e special jurisdicti on policy files ment ioned abov e.) | |
| 135 | # | |
| 136 | #***** IMP ORTANT: Th ese are fo r JUnit te sting. Tes t files ma y have bee n | |
| 137 | # encrypte d using th ese values so do not change th ese or | |
| 138 | #those tes ts will fa il. The ve rsion unde r | |
| 139 | #src/main/ resources/ .esapi/ESA PI.propert ies | |
| 140 | #will be d elivered w ith Encryp tor.Master Key and | |
| 141 | #Encryptor .MasterSal t set to t he empty s tring. | |
| 142 | # | |
| 143 | # FINAL NO TE: | |
| 144 | # If Maven cha nges these when run, that need s to be fi xed. | |
| 145 | # 25 6-bit key. .. require s unlimite d strength jurisdict ion policy files | |
| 146 | ### Encryp tor.Master Key=pJhlri 8JbuFYDgkq tHmm9s0Ziu g2PE7ovZDy EPm4j14= | |
| 147 | # 12 8-bit key | |
| 148 | Encryptor. MasterKey= a6H9is3hEV GKB4Jut+lO VA== | |
| 149 | Encryptor. MasterSalt =SbftnvmEW D5ZHHP+pX3 fqugNysc= | |
| 150 | # Encrypto r.MasterSa lt= | |
| 151 | ||
| 152 | # Provides the defau lt JCE pro vider that ESAPI wil l "prefer" for its s ymmetric | |
| 153 | # encrypti on and has hing. (Tha t is it wi ll look to this prov ider first , but it | |
| 154 | # will def er to othe r provider s if the r equested a lgorithm i s not impl emented | |
| 155 | # by this provider.) If left u nset, ESAP I will jus t use your Java VM's current | |
| 156 | # preferre d JCE prov ider, whic h is gener ally set i n the file | |
| 157 | # "$JAVA_H OME/jre/li b/security /java.secu rity". | |
| 158 | # | |
| 159 | # The main intent of this is t o allow ES API symmet ric encryp tion to be | |
| 160 | # used wit h a FIPS 1 40-2 compl iant crypt o-module. For detail s, see the section | |
| 161 | # "Using E SAPI Symme tric Encry ption with FIPS 140- 2 Cryptogr aphic Modu les" in | |
| 162 | # the ESAP I 2.0 Symm etric Encr yption Use r Guide, a t: | |
| 163 | # http://o wasp-esapi -java.goog lecode.com /svn/trunk /documenta tion/esapi 4java-core -2.0-symme tric-crypt o-user-gui de.html | |
| 164 | # However, this prop erty also allows you to easily use an al ternate JC E provider | |
| 165 | # such as "Bouncy Ca stle" with out having to make c hanges to "java.secu rity". | |
| 166 | # See Java doc for Se curityProv iderLoader for furth er details . If you w ish to use | |
| 167 | # a provid er that is not known to Securi tyProvider Loader, yo u may spec ify the | |
| 168 | # fully-qu alified cl ass name o f the JCE provider c lass that implements | |
| 169 | # java.sec urity.Prov ider. If t he name co ntains a ' .', this i s interpre ted as | |
| 170 | # a fully- qualified class name that impl ements jav a.security .Provider. | |
| 171 | # | |
| 172 | # NOTE: Se tting this property has the si de-effect of changin g it in yo ur applica tion | |
| 173 | # as well, so if you are using JCE in your a pplication directly rather tha n | |
| 174 | # th rough ESAP I (you wou ldn't do t hat, would you? ;-), it will c hange the | |
| 175 | # pr eferred JC E provider there as well. | |
| 176 | # | |
| 177 | # Default: Keeps the JCE provi der set to whatever JVM sets i t to. | |
| 178 | Encryptor. PreferredJ CEProvider = | |
| 179 | ||
| 180 | # Applies to ESAPI 2 .0 and lat er only! | |
| 181 | # Comma-se parated li st of ciph er modes t hat provid e *BOTH* | |
| 182 | # confiden tiality *A ND* messag e authenti city. (NIS T refers t o such cip her | |
| 183 | # modes as "combined modes" so that's wh at we shal l call the m.) If any of these | |
| 184 | # cipher m odes are u sed then n o MAC is c alculated and stored | |
| 185 | # in the C ipherText upon encry ption. Lik ewise, if one of the se | |
| 186 | # cipher m odes is us ed with de cryption, no attempt will be m ade | |
| 187 | # to valid ate the MA C containe d in the C ipherText object reg ardless | |
| 188 | # of wheth er it cont ains one o r not. Sin ce the exp ectation i s that | |
| 189 | # these ci pher modes support s upport mes sage authe nticity al ready, | |
| 190 | # injectin g a MAC in the Ciphe rText obje ct would b e at best redundant. | |
| 191 | # | |
| 192 | # Note tha t as of JD K 1.5, the SunJCE pr ovider doe s not supp ort *any* | |
| 193 | # of these cipher mo des. Of th ese listed , only GCM and CCM a re current ly | |
| 194 | # NIST app roved. YMM V for othe r JCE prov iders. E.g ., Bouncy Castle sup ports | |
| 195 | # GCM and CCM with " NoPadding" mode, but not with "PKCS5Padd ing" or ot her | |
| 196 | # padding modes. | |
| 197 | Encryptor. cipher_mod es.combine d_modes=GC M,CCM,IAPM ,EAX,OCB,C WC | |
| 198 | ||
| 199 | # Applies to ESAPI 2 .0 and lat er only! | |
| 200 | # Addition al cipher modes allo wed for ES API 2.0 en cryption. These | |
| 201 | # cipher m odes are i n _additio n_ to thos e specifie d by the p roperty | |
| 202 | # 'Encrypt or.cipher_ modes.comb ined_modes '. | |
| 203 | # Note: We will add support fo r streamin g modes li ke CFB & O FB once | |
| 204 | # we add s upport for 'specifie d' to the property ' Encryptor. ChooseIVMe thod' | |
| 205 | # (probabl y in ESAPI 2.1). | |
| 206 | # | |
| 207 | #IMPORTANT NOTE:In t he officia l ESAPI.pr operties w e do *NOT* include E CB | |
| 208 | #here as t his is an extremely weak mode. However, we *must* | |
| 209 | #allow it here so we can test ECB mode. That is im portant | |
| 210 | #since the logic is somewhat d ifferent ( i.e., ECB mode does | |
| 211 | #not use a n IV). | |
| 212 | # DISCUSS: Better na me? | |
| 213 | #NOTE: ECB added onl y for test ing purpos es. Don't try this a t home! | |
| 214 | Encryptor. cipher_mod es.additio nal_allowe d=CBC,ECB | |
| 215 | ||
| 216 | # 128-bit is almost always suf ficient an d appears to be more resistant to | |
| 217 | # related key attack s than is 256-bit AE S. Use '_' to use de fault key size | |
| 218 | # for ciph er algorit hms (where it makes sense beca use the al gorithm su pports | |
| 219 | # a variab le key siz e). Key le ngth must agree to w hat's prov ided as th e | |
| 220 | # cipher t ransformat ion, other wise this will be ig nored afte r logging a | |
| 221 | # warning. | |
| 222 | # | |
| 223 | # NOTE: Th is is what applies B OTH ESAPI 1.4 and 2. 0. See war ning above about mix ing! | |
| 224 | Encryptor. Encryption KeyLength= 128 | |
| 225 | ||
| 226 | # Because 2.0 uses C BC mode by default, it require s an initi alization vector (IV ). | |
| 227 | # (All cip her modes except ECB require a n IV.) The re are two choices: we can eit her | |
| 228 | # use a fi xed IV kno wn to both parties o r allow ES API to cho ose a rand om IV. Whi le | |
| 229 | # the IV d oes not ne ed to be h idden from adversari es, it is important that the | |
| 230 | # adversar y not be a llowed to choose it. Also, ran dom IVs ar e generall y much mor e | |
| 231 | # secure t han fixed IVs. (In f act, it is essential that feed -back ciph er modes | |
| 232 | # such as CFB and OF B use a di fferent IV for each encryption with a gi ven key so | |
| 233 | # in such cases, ran dom IVs ar e much pre ferred. By default, ESAPI 2.0 uses rando m | |
| 234 | # IVs. If you wish t o use 'fix ed' IVs, s et 'Encryp tor.Choose IVMethod=f ixed' and | |
| 235 | # uncommen t the Encr yptor.fixe dIV. | |
| 236 | # | |
| 237 | # Valid va lues:rando m|fixed|sp ecified 's pecified' not yet im plemented; planned f or 2.1 | |
| 238 | Encryptor. ChooseIVMe thod=rando m | |
| 239 | # If you c hoose to u se a fixed IV, then you must p lace a fix ed IV here that | |
| 240 | # is known to all ot hers who a re sharing your secr et key. Th e format s hould | |
| 241 | # be a hex string th at is the same lengt h as the c ipher bloc k size for the | |
| 242 | # cipher a lgorithm t hat you ar e using. T he followi ng is an e xample for AES | |
| 243 | # from an AES test v ector for AES-128/CB C as descr ibed in: | |
| 244 | # NIST Spe cial Publi cation 800 -38A (2001 Edition) | |
| 245 | # "Recomme ndation fo r Block Ci pher Modes of Operat ion". | |
| 246 | # (Note th at the blo ck size fo r AES is 1 6 bytes == 128 bits. ) | |
| 247 | # | |
| 248 | Encryptor. fixedIV=RE DACTED | |
| 249 | ||
| 250 | # Whether or not Cip herText sh ould use a message a uthenticat ion code ( MAC) with it. | |
| 251 | # This pre vents an a dversary f rom alteri ng the IV as well as allowing a more | |
| 252 | # fool-pro of way of determinin g the decr yption fai led becaus e of an in correct | |
| 253 | # key bein g supplied . This ref ers to the "separate " MAC calc ulated and stored | |
| 254 | # in Ciphe rText, not part of a ny MAC tha t is calcu lated as a result of a | |
| 255 | # "combine d mode" ci pher mode. | |
| 256 | # | |
| 257 | # If you a re using E SAPI with a FIPS 140 -2 cryptog raphic mod ule, you * must* also | |
| 258 | # set this property to false. | |
| 259 | Encryptor. CipherText .useMAC=tr ue | |
| 260 | ||
| 261 | # Whether or not the PlainText object ma y be overw ritten and then mark ed | |
| 262 | # eligible for garba ge collect ion. If no t set, thi s is still treated a s 'true'. | |
| 263 | Encryptor. PlainText. overwrite= true | |
| 264 | ||
| 265 | # Do not u se DES exc ept in a l egacy situ ations. 56 -bit is wa y too smal l key size . | |
| 266 | #Encryptor .Encryptio nKeyLength =56 | |
| 267 | #Encryptor .Encryptio nAlgorithm =DES | |
| 268 | ||
| 269 | # TripleDE S is consi dered stro ng enough for most p urposes. | |
| 270 | #Note:Ther e is also a 112-bit version of DESede. U sing the 1 68-bit ver sion | |
| 271 | #requires downloadin g the spec ial jurisd iction pol icy from S un. | |
| 272 | #Encryptor .Encryptio nKeyLength =168 | |
| 273 | #Encryptor .Encryptio nAlgorithm =DESede | |
| 274 | ||
| 275 | Encryptor. HashAlgori thm=SHA-51 2 | |
| 276 | Encryptor. HashIterat ions=1024 | |
| 277 | Encryptor. DigitalSig natureAlgo rithm=SHA1 withDSA | |
| 278 | Encryptor. DigitalSig natureKeyL ength=1024 | |
| 279 | Encryptor. RandomAlgo rithm=SHA1 PRNG | |
| 280 | Encryptor. CharacterE ncoding=UT F-8 | |
| 281 | # Currentl y supporte d choices for JDK 1. 5 and 1.6 are: | |
| 282 | #HmacSHA1 (160 bits) , HmacSHA2 56 (256 bi ts), HmacS HA384 (384 bits), an d | |
| 283 | #HmacSHA51 2 (512 bit s). | |
| 284 | # Note tha t HmacMD5 is *not* s upported f or the PRF used by t he KDF eve n though | |
| 285 | # these JD Ks support it. | |
| 286 | Encryptor. KDF.PRF=Hm acSHA256 | |
| 287 | ||
| 288 | #========= ========== ========== ========== ========== ========== ========== ====== | |
| 289 | # ESAPI Ht tpUtilties | |
| 290 | # | |
| 291 | # The Http Utilities provide ba sic protec tions to H TTP reques ts and res ponses. Pr imarily th ese method s | |
| 292 | # protect against ma licious da ta from at tackers, s uch as unp rintable c haracters, escaped c haracters, | |
| 293 | # and othe r simple a ttacks. Th e HttpUtil ities also provides utility me thods for dealing wi th cookies , | |
| 294 | # headers, and CSRF tokens. | |
| 295 | # | |
| 296 | # Default file uploa d location (remember to escape backslash es with \\ ) | |
| 297 | HttpUtilit ies.Upload Dir=C:\\ES API\\testU pload | |
| 298 | # let this default t o java.io. tmpdir for testing | |
| 299 | #HttpUtili ties.Uploa dTempDir=C :\\temp | |
| 300 | # Force fl ags on coo kies, if y ou use Htt pUtilities to set co okies | |
| 301 | HttpUtilit ies.ForceH ttpOnlySes sion=false | |
| 302 | HttpUtilit ies.ForceS ecureSessi on=false | |
| 303 | HttpUtilit ies.ForceH ttpOnlyCoo kies=true | |
| 304 | HttpUtilit ies.ForceS ecureCooki es=true | |
| 305 | # Maximum size of HT TP headers | |
| 306 | HttpUtilit ies.MaxHea derSize=40 96 | |
| 307 | # File upl oad config uration | |
| 308 | HttpUtilit ies.Approv edUploadEx tensions=. zip,.pdf,. doc,.docx, .ppt,.pptx ,.tar,.gz, .tgz,.rar, .war,.jar, .ear,.xls, .rtf,.prop erties,.ja va,.class, .txt,.xml, .jsp,.jsf, .exe,.dll | |
| 309 | HttpUtilit ies.MaxUpl oadFileByt es=5000000 00 | |
| 310 | # Using UT F-8 throug hout your stack is h ighly reco mmended. T hat includ es your da tabase dri ver, | |
| 311 | # containe r, and any other tec hnologies you may be using. Fa ilure to d o this may expose yo u | |
| 312 | # to Unico de transco ding injec tion attac ks. Use of UTF-8 doe s not hind er interna tionalizat ion. | |
| 313 | HttpUtilit ies.Respon seContentT ype=text/h tml; chars et=UTF-8 | |
| 314 | # This is the name o f the cook ie used to represent the HTTP session | |
| 315 | # Typicall y this wil l be the d efault "JS ESSIONID" | |
| 316 | HttpUtilit ies.HttpSe ssionIdNam e=JSESSION ID | |
| 317 | ||
| 318 | ||
| 319 | ||
| 320 | #========= ========== ========== ========== ========== ========== ========== ====== | |
| 321 | # ESAPI Ex ecutor | |
| 322 | # CHECKME - Not sure what this is used f or, but su rely it sh ould be ma de OS inde pendent. | |
| 323 | Executor.W orkingDire ctory=C:\\ Windows\\T emp | |
| 324 | Executor.A pprovedExe cutables=C :\\Windows \\System32 \\cmd.exe, C:\\Window s\\System3 2\\runas.e xe | |
| 325 | ||
| 326 | ||
| 327 | #========= ========== ========== ========== ========== ========== ========== ====== | |
| 328 | # ESAPI Lo gging | |
| 329 | # Set the applicatio n name if these logs are combi ned with o ther appli cations | |
| 330 | Logger.App licationNa me=Example Applicatio n | |
| 331 | # If you u se an HTML log viewe r that doe s not prop erly HTML escape log data, you can set L ogEncoding Required t o true | |
| 332 | Logger.Log EncodingRe quired=fal se | |
| 333 | # Determin es whether ESAPI sho uld log th e applicat ion name. This might be clutte r in some single-ser ver/single -app envir onments. | |
| 334 | Logger.Log Applicatio nName=true | |
| 335 | # Determin es whether ESAPI sho uld log th e server I P and port . This mig ht be clut ter in som e single-s erver envi ronments. | |
| 336 | Logger.Log ServerIP=t rue | |
| 337 | # LogFileN ame, the n ame of the logging f ile. Provi de a full directory path (e.g. , C:\\ESAP I\\ESAPI_l ogging_fil e) if you | |
| 338 | # want to place it i n a specif ic directo ry. | |
| 339 | Logger.Log FileName=E SAPI_loggi ng_file | |
| 340 | # MaxLogFi leSize, th e max size (in bytes ) of a sin gle log fi le before it cuts ov er to a ne w one (def ault is 10 ,000,000) | |
| 341 | Logger.Max LogFileSiz e=10000000 | |
| 342 | ||
| 343 | ||
| 344 | #========= ========== ========== ========== ========== ========== ========== ====== | |
| 345 | # ESAPI In trusion De tection | |
| 346 | # | |
| 347 | # Each eve nt has a b ase to whi ch .count, .interval , and .act ion are ad ded | |
| 348 | # The Intr usionExcep tion will fire if we receive " count" eve nts within "interval " seconds | |
| 349 | # The Intr usionDetec tor is con figurable to take th e followin g actions: log, logo ut, and di sable | |
| 350 | # (multip le actions separated by commas are allow ed e.g. ev ent.test.a ctions=log ,disable | |
| 351 | # | |
| 352 | # Custom E vents | |
| 353 | # Names mu st start w ith "event ." as the base | |
| 354 | # Use Intr usionDetec tor.addEve nt( "test" ) in your code to t rigger "ev ent.test" here | |
| 355 | # You can also disab le intrusi on detecti on complet ely by cha nging | |
| 356 | # the foll owing para meter to t rue | |
| 357 | # | |
| 358 | IntrusionD etector.Di sable=fals e | |
| 359 | # | |
| 360 | IntrusionD etector.ev ent.test.c ount=2 | |
| 361 | IntrusionD etector.ev ent.test.i nterval=10 | |
| 362 | IntrusionD etector.ev ent.test.a ctions=dis able,log | |
| 363 | ||
| 364 | # Exceptio n Events | |
| 365 | # All Ente rpriseSecu rityExcept ions are r egistered automatica lly | |
| 366 | # Call Int rusionDete ctor.getIn stance().a ddExceptio n(e) for E xceptions that do no t extend E nterpriseS ecurityExc eption | |
| 367 | # Use the fully qual ified clas sname of t he excepti on as the base | |
| 368 | ||
| 369 | # any intr usion is a n attack | |
| 370 | IntrusionD etector.or g.owasp.es api.errors .Intrusion Exception. count=1 | |
| 371 | IntrusionD etector.or g.owasp.es api.errors .Intrusion Exception. interval=1 | |
| 372 | IntrusionD etector.or g.owasp.es api.errors .Intrusion Exception. actions=lo g,disable, logout | |
| 373 | ||
| 374 | # for test purposes | |
| 375 | # CHECKME: Shouldn't there be something in the pro perty name itself th at designa tes | |
| 376 | # that t hese are f or testing ??? | |
| 377 | IntrusionD etector.or g.owasp.es api.errors .Integrity Exception. count=10 | |
| 378 | IntrusionD etector.or g.owasp.es api.errors .Integrity Exception. interval=5 | |
| 379 | IntrusionD etector.or g.owasp.es api.errors .Integrity Exception. actions=lo g,disable, logout | |
| 380 | ||
| 381 | # rapid va lidation e rrors indi cate scans or attack s in progr ess | |
| 382 | # org.owas p.esapi.er rors.Valid ationExcep tion.count =10 | |
| 383 | # org.owas p.esapi.er rors.Valid ationExcep tion.inter val=10 | |
| 384 | # org.owas p.esapi.er rors.Valid ationExcep tion.actio ns=log,log out | |
| 385 | ||
| 386 | # sessions jumping b etween hos ts indicat es session hijacking | |
| 387 | IntrusionD etector.or g.owasp.es api.errors .Authentic ationHostE xception.c ount=2 | |
| 388 | IntrusionD etector.or g.owasp.es api.errors .Authentic ationHostE xception.i nterval=10 | |
| 389 | IntrusionD etector.or g.owasp.es api.errors .Authentic ationHostE xception.a ctions=log ,logout | |
| 390 | ||
| 391 | ||
| 392 | #========= ========== ========== ========== ========== ========== ========== ====== | |
| 393 | # ESAPI Va lidation | |
| 394 | # | |
| 395 | # The ESAP I Validato r works on regular e xpressions with defi ned names. You can d efine name s | |
| 396 | # either h ere, or yo u may defi ne applica tion speci fic patter ns in a se parate fil e defined below. | |
| 397 | # This all ows enterp rises to s pecify bot h organiza tional sta ndards as well as ap plication specific | |
| 398 | # validati on rules. | |
| 399 | # | |
| 400 | Validator. Configurat ionFile=va lidation.p roperties | |
| 401 | ||
| 402 | # Validato rs used by ESAPI | |
| 403 | Validator. AccountNam e=^[a-zA-Z 0-9]{3,20} $ | |
| 404 | Validator. SystemComm and=^[a-zA -Z\\-\\/]{ 1,64}$ | |
| 405 | Validator. RoleName=^ [a-z]{1,20 }$ | |
| 406 | Validator. Redirect=^ \\/test.*$ | |
| 407 | ||
| 408 | # Global H TTP Valida tion Rules | |
| 409 | # Values w ith Base64 encoded d ata (e.g. encrypted state) wil l need at least [a-z A-Z0-9\/+= ] | |
| 410 | Validator. HTTPScheme =^(http|ht tps)$ | |
| 411 | Validator. HTTPServer Name=^[a-z A-Z0-9_.\\ -]*$ | |
| 412 | Validator. HTTPCookie Name=^[a-z A-Z0-9\\-_ ]{1,32}$ | |
| 413 | Validator. HTTPCookie Value=^[a- zA-Z0-9\\- \\/+=_ ]*$ | |
| 414 | Validator. HTTPHeader Name=^[a-z A-Z0-9\\-_ ]{1,32}$ | |
| 415 | Validator. HTTPHeader Value=^[a- zA-Z0-9()\ \-=\\*\\.\ \?;,+\\/:& _ ]*$ | |
| 416 | Validator. HTTPServle tPath=^[a- zA-Z0-9.\\ -\\/_]*$ | |
| 417 | Validator. HTTPPath=^ [a-zA-Z0-9 .\\-_]*$ | |
| 418 | Validator. HTTPURL=^. *$ | |
| 419 | Validator. HTTPJSESSI ONID=^[A-Z 0-9]{10,30 }$ | |
| 420 | ||
| 421 | # Contribu ted by Fra enku@gmx.c h | |
| 422 | # Googleco de Issue 1 16 (http:/ /code.goog le.com/p/o wasp-esapi -java/issu es/detail? id=116) | |
| 423 | Validator. HTTPParame terName=^[ a-zA-Z0-9_ \\-]{1,32} $ | |
| 424 | Validator. HTTPParame terValue=^ [\\p{L}\\p {N}.\\-/+= _ !$*?@]{0 ,1000}$ | |
| 425 | Validator. HTTPContex tPath=^/[a -zA-Z0-9.\ \-_]*$ | |
| 426 | Validator. HTTPQueryS tring=^([a -zA-Z0-9_\ \-]{1,32}= [\\p{L}\\p {N}.\\-/+= _ !$*?@%]* &?)*$ | |
| 427 | Validator. HTTPURI=^/ ([a-zA-Z0- 9.\\-_]*/? )*$ | |
| 428 | ||
| 429 | ||
| 430 | # Validati on of file related i nput | |
| 431 | Validator. FileName=^ [a-zA-Z0-9 !@#$%^&{}\ \[\\]()_+\ \-=,.~'` ] {1,255}$ | |
| 432 | Validator. DirectoryN ame=^[a-zA -Z0-9:/\\\ \!@#$%^&{} \\[\\]()_+ \\-=,.~'` ]{1,255}$ | |
| 433 | ||
| 434 | # Validati on of date s. Control s whether or not 'le nient' dat es are acc epted. | |
| 435 | # See Data Format.set Lenient(bo olean flag ) for furt her detail s. | |
| 436 | Validator. AcceptLeni entDates=f alse |
Araxis Merge (but not the data content of this report) is Copyright © 1993-2016 Araxis Ltd (www.araxis.com). All rights reserved.