Skip to content

Commit acae408

Browse files
kwwallkwwall
committed
Issue #620 - changed DefaultSecurityConfiguration refs to PropNames.
1 parent 0123aa2 commit acae408

14 files changed

+124
-100
lines changed

‎src/main/java/org/owasp/esapi/crypto/KeyDerivationFunction.java

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
import org.owasp.esapi.Logger;
2222
import org.owasp.esapi.errors.ConfigurationException;
2323
import org.owasp.esapi.errors.EncryptionException;
24-
import org.owasp.esapi.reference.DefaultSecurityConfiguration;
24+
import static org.owasp.esapi.PropNames.KDF_PRF_ALG;
2525
import org.owasp.esapi.util.ByteConversionUtil;
2626

2727
/**
@@ -133,7 +133,7 @@ public KeyDerivationFunction() {
133133
if ( ! KeyDerivationFunction.isValidPRF(prfName) ) {
134134
throw new ConfigurationException("Algorithm name " + prfName +
135135
" not a valid algorithm name for property " +
136-
DefaultSecurityConfiguration.KDF_PRF_ALG);
136+
KDF_PRF_ALG);
137137
}
138138
prfAlg_ = prfName;
139139
}
@@ -159,8 +159,7 @@ static int getDefaultPRFSelection() {
159159
}
160160
}
161161
throw new ConfigurationException("Algorithm name " + prfName +
162-
" not a valid algorithm name for property " +
163-
DefaultSecurityConfiguration.KDF_PRF_ALG);
162+
" not a valid algorithm name for property " + KDF_PRF_ALG);
164163
}
165164

166165
/**

‎src/main/java/org/owasp/esapi/errors/EnterpriseSecurityException.java

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,7 @@
1818
import org.owasp.esapi.ESAPI;
1919
import org.owasp.esapi.Logger;
2020

21-
// At some point, all these property names will be moved to a new class named
22-
// org.owasp.esapi.PropNames
23-
// but until then, while this is an ugly kludge, we are importing it via a
24-
// reference implementation class until we have a chance to clean it up.
25-
// (Note: kwwall's Bitbucket code already has that class.)
26-
import static org.owasp.esapi.reference.DefaultSecurityConfiguration.DISABLE_INTRUSION_DETECTION;
21+
import static org.owasp.esapi.PropNames.DISABLE_INTRUSION_DETECTION;
2722

2823

2924
/**

‎src/main/java/org/owasp/esapi/logging/java/JavaLogFactory.java

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,14 @@
3333
import org.owasp.esapi.logging.cleaning.CompositeLogScrubber;
3434
import org.owasp.esapi.logging.cleaning.LogScrubber;
3535
import org.owasp.esapi.logging.cleaning.NewlineLogScrubber;
36-
import org.owasp.esapi.reference.DefaultSecurityConfiguration;
36+
37+
import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
38+
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
39+
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
40+
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
41+
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
42+
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
43+
3744
/**
3845
* LogFactory implementation which creates JAVA supporting Loggers.
3946
*
@@ -55,15 +62,15 @@ public class JavaLogFactory implements LogFactory {
5562
private static JavaLogBridge LOG_BRIDGE;
5663

5764
static {
58-
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED);
65+
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(LOG_ENCODING_REQUIRED);
5966
JAVA_LOG_SCRUBBER = createLogScrubber(encodeLog);
6067

6168

62-
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_USER_INFO);
63-
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_CLIENT_INFO);
64-
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_APPLICATION_NAME);
65-
String appName = ESAPI.securityConfiguration().getStringProp(DefaultSecurityConfiguration.APPLICATION_NAME);
66-
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_SERVER_IP);
69+
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_USER_INFO);
70+
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_CLIENT_INFO);
71+
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
72+
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
73+
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
6774
JAVA_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
6875

6976
Map<Integer, JavaLogLevelHandler> levelLookup = new HashMap<>();

‎src/main/java/org/owasp/esapi/logging/log4j/Log4JLogFactory.java

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,14 @@
2929
import org.owasp.esapi.logging.cleaning.CompositeLogScrubber;
3030
import org.owasp.esapi.logging.cleaning.LogScrubber;
3131
import org.owasp.esapi.logging.cleaning.NewlineLogScrubber;
32-
import org.owasp.esapi.reference.DefaultSecurityConfiguration;
32+
33+
import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
34+
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
35+
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
36+
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
37+
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
38+
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
39+
3340
/**
3441
* LogFactory implementation which creates Log4J supporting Loggers.
3542
*
@@ -48,15 +55,15 @@ public class Log4JLogFactory implements LogFactory {
4855
private static Log4JLogBridge LOG_BRIDGE;
4956

5057
static {
51-
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED);
58+
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(LOG_ENCODING_REQUIRED);
5259
Log4J_LOG_SCRUBBER = createLogScrubber(encodeLog);
5360

5461

55-
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_USER_INFO);
56-
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_CLIENT_INFO);
57-
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_APPLICATION_NAME);
58-
String appName = ESAPI.securityConfiguration().getStringProp(DefaultSecurityConfiguration.APPLICATION_NAME);
59-
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_SERVER_IP);
62+
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_USER_INFO);
63+
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_CLIENT_INFO);
64+
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
65+
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
66+
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
6067
Log4J_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
6168

6269
Map<Integer, Log4JLogLevelHandler> levelLookup = new HashMap<>();

‎src/main/java/org/owasp/esapi/logging/log4j/Log4JLoggerFactory.java

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,13 @@
2020
import org.owasp.esapi.ESAPI;
2121
import org.owasp.esapi.logging.appender.LogAppender;
2222
import org.owasp.esapi.logging.cleaning.LogScrubber;
23-
import org.owasp.esapi.reference.DefaultSecurityConfiguration;
23+
24+
import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
25+
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
26+
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
27+
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
28+
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
29+
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
2430

2531
/**
2632
* Service Provider Interface implementation that can be provided as the org.apache.log4j.spi.LoggerFactory reference in a Log4J configuration.
@@ -37,14 +43,14 @@ public class Log4JLoggerFactory implements LoggerFactory {
3743
private static LogScrubber LOG4J_LOG_SCRUBBER;
3844

3945
static {
40-
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED);
46+
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(LOG_ENCODING_REQUIRED);
4147
LOG4J_LOG_SCRUBBER = Log4JLogFactory.createLogScrubber(encodeLog);
4248

43-
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_USER_INFO);
44-
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_CLIENT_INFO);
45-
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_APPLICATION_NAME);
46-
String appName = ESAPI.securityConfiguration().getStringProp(DefaultSecurityConfiguration.APPLICATION_NAME);
47-
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_SERVER_IP);
49+
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_USER_INFO);
50+
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_CLIENT_INFO);
51+
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
52+
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
53+
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
4854
LOG4J_LOG_APPENDER = Log4JLogFactory.createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
4955
}
5056

‎src/main/java/org/owasp/esapi/logging/slf4j/Slf4JLogFactory.java

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,13 @@
2929
import org.owasp.esapi.logging.cleaning.CompositeLogScrubber;
3030
import org.owasp.esapi.logging.cleaning.LogScrubber;
3131
import org.owasp.esapi.logging.cleaning.NewlineLogScrubber;
32-
import org.owasp.esapi.reference.DefaultSecurityConfiguration;
32+
33+
import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
34+
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
35+
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
36+
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
37+
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
38+
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
3339
import org.slf4j.LoggerFactory;
3440
/**
3541
* LogFactory implementation which creates SLF4J supporting Loggers.
@@ -54,15 +60,15 @@ public class Slf4JLogFactory implements LogFactory {
5460
private static Slf4JLogBridge LOG_BRIDGE;
5561

5662
static {
57-
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED);
63+
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(LOG_ENCODING_REQUIRED);
5864
SLF4J_LOG_SCRUBBER = createLogScrubber(encodeLog);
5965

6066

61-
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_USER_INFO);
62-
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_CLIENT_INFO);
63-
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_APPLICATION_NAME);
64-
String appName = ESAPI.securityConfiguration().getStringProp(DefaultSecurityConfiguration.APPLICATION_NAME);
65-
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_SERVER_IP);
67+
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_USER_INFO);
68+
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_CLIENT_INFO);
69+
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
70+
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
71+
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
6672
SLF4J_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
6773

6874
Map<Integer, Slf4JLogLevelHandler> levelLookup = new HashMap<>();

‎src/main/java/org/owasp/esapi/reference/validation/HTMLValidationRule.java

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,10 @@
3030
import org.owasp.esapi.StringUtilities;
3131
import org.owasp.esapi.errors.ConfigurationException;
3232
import org.owasp.esapi.errors.ValidationException;
33-
import org.owasp.esapi.reference.DefaultSecurityConfiguration.DefaultSearchPath;
33+
import org.owasp.esapi.PropNames.DefaultSearchPath;
34+
import static org.owasp.esapi.PropNames.VALIDATOR_HTML_VALIDATION_ACTION;
35+
import static org.owasp.esapi.PropNames.VALIDATOR_HTML_VALIDATION_CONFIGURATION_FILE;
36+
3437
import org.owasp.validator.html.AntiSamy;
3538
import org.owasp.validator.html.CleanResults;
3639
import org.owasp.validator.html.Policy;
@@ -106,13 +109,11 @@ public class HTMLValidationRule extends StringValidationRule {
106109
/*package */ static String resolveAntisamyFilename() {
107110
String antisamyPolicyFilename = ANTISAMYPOLICY_FILENAME;
108111
try {
109-
antisamyPolicyFilename = ESAPI.securityConfiguration().getStringProp(
110-
// Future: This will be moved to a new PropNames class
111-
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATOR_HTML_VALIDATION_CONFIGURATION_FILE );
112+
antisamyPolicyFilename = ESAPI.securityConfiguration().getStringProp( VALIDATOR_HTML_VALIDATION_CONFIGURATION_FILE );
112113
} catch (ConfigurationException cex) {
113114

114115
LOGGER.info(Logger.EVENT_FAILURE, "ESAPI property " +
115-
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATOR_HTML_VALIDATION_CONFIGURATION_FILE +
116+
VALIDATOR_HTML_VALIDATION_CONFIGURATION_FILE +
116117
" not set, using default value: " + ANTISAMYPOLICY_FILENAME);
117118
}
118119
return antisamyPolicyFilename;
@@ -197,9 +198,7 @@ private boolean legacyHtmlValidation() {
197198
// Hindsight: maybe we should have getBooleanProp(), getStringProp(),
198199
// getIntProp() methods that take a default arg as well?
199200
// At least for ESAPI 3.x.
200-
propValue = ESAPI.securityConfiguration().getStringProp(
201-
// Future: This will be moved to a new PropNames class
202-
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATOR_HTML_VALIDATION_ACTION );
201+
propValue = ESAPI.securityConfiguration().getStringProp( VALIDATOR_HTML_VALIDATION_ACTION );
203202
switch ( propValue.toLowerCase() ) {
204203
case "throw":
205204
legacy = false; // New, presumably correct behavior, as addressed by GitHub issue 509
@@ -209,7 +208,7 @@ private boolean legacyHtmlValidation() {
209208
break;
210209
default:
211210
LOGGER.warning(Logger.EVENT_FAILURE, "ESAPI property " +
212-
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATOR_HTML_VALIDATION_ACTION +
211+
VALIDATOR_HTML_VALIDATION_ACTION +
213212
" was set to \"" + propValue + "\". Must be set to either \"clean\"" +
214213
" (the default for legacy support) or \"throw\"; assuming \"clean\" for legacy behavior.");
215214
legacy = true;
@@ -219,7 +218,7 @@ private boolean legacyHtmlValidation() {
219218
// OPEN ISSUE: Should we log this? I think so. Convince me otherwise. But maybe
220219
// we should only log it once or every Nth time??
221220
LOGGER.warning(Logger.EVENT_FAILURE, "ESAPI property " +
222-
org.owasp.esapi.reference.DefaultSecurityConfiguration.VALIDATOR_HTML_VALIDATION_ACTION +
221+
VALIDATOR_HTML_VALIDATION_ACTION +
223222
" must be set to either \"clean\" (the default for legacy support) or \"throw\"; assuming \"clean\"",
224223
cex);
225224
}

‎src/test/java/org/owasp/esapi/filters/SecurityWrapperRequestTest.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,7 @@
2222
import static org.mockito.ArgumentMatchers.eq;
2323
import static org.mockito.Mockito.times;
2424
import static org.mockito.Mockito.verify;
25-
// A hack for now; eventually, I plan to move this into a new org.owasp.esapi.PropNames class. -kww
26-
import static org.owasp.esapi.reference.DefaultSecurityConfiguration.DISABLE_INTRUSION_DETECTION;
25+
import static org.owasp.esapi.PropNames.DISABLE_INTRUSION_DETECTION;
2726

2827
import javax.servlet.http.Cookie;
2928
import javax.servlet.http.HttpServletRequest;

‎src/test/java/org/owasp/esapi/filters/SecurityWrapperResponseTest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
import static org.mockito.Mockito.spy;
77
import static org.mockito.Mockito.times;
88
import static org.mockito.Mockito.verify;
9-
import static org.owasp.esapi.reference.DefaultSecurityConfiguration.DISABLE_INTRUSION_DETECTION;
9+
import static org.owasp.esapi.PropNames.DISABLE_INTRUSION_DETECTION;
1010

1111
import javax.servlet.http.Cookie;
1212
import javax.servlet.http.HttpServletResponse;

0 commit comments

Comments
 (0)