Skip to content

Issue 620 - Move public static final Strings and enum from DefaultSecurityConfiguration to PropNames #707

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jun 5, 2022
Merged

Issue 620 - Move public static final Strings and enum from DefaultSecurityConfiguration to PropNames #707

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
bc3bd83
Delete unneed log4j import.
kwwall May 28, 2022
5ae8135
Mark 2 public static variables as deprecated as they are not used.
kwwall May 29, 2022
85ce010
Update versions of 3 plugins.
kwwall May 30, 2022
26a4994
Issue #620. Reorganize source to get stuff out of implementatiopn class.
kwwall May 30, 2022
0123aa2
Reorganized by moving public stuff from this implementation class to …
kwwall May 30, 2022
acae408
Issue #620 - changed DefaultSecurityConfiguration refs to PropNames.
kwwall May 30, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,7 +140,7 @@
<version.powermock>2.0.9</version.powermock>
<version.spotbugs>4.7.0</version.spotbugs>
<version.findsecbugs>1.12.0</version.findsecbugs>
<version.spotbugs.maven>4.6.0.0</version.spotbugs.maven>
<version.spotbugs.maven>4.7.0.0</version.spotbugs.maven>
<version.surefire>3.0.0-M6</version.surefire>
<project.java.target>1.8</project.java.target>
<!-- TODO: Be sure to update. Should be date of previous official release -->
Expand Down Expand Up @@ -426,7 +426,7 @@
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>versions-maven-plugin</artifactId>
<version>2.10.0</version>
<version>2.11.0</version>
<configuration>
<rulesUri>file:${project.basedir}/versionRuleset.xml</rulesUri>
</configuration>
Expand All @@ -439,7 +439,7 @@
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>2.6.1</version>
<version>2.7.0</version>
<executions>
<execution>
<phase>package</phase>
Expand Down
1 change: 0 additions & 1 deletion src/examples/java/PersistedEncryptedData.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
import org.owasp.esapi.errors.*;
import org.owasp.esapi.codecs.*;
import javax.servlet.ServletRequest;
import org.apache.log4j.Logger;

/** A slightly more complex example showing encoding encrypted data and writing
* it out to a file. This is very similar to the example in the ESAPI User
Expand Down
201 changes: 201 additions & 0 deletions src/main/java/org/owasp/esapi/PropNames.java
View file
Open in desktop

Large diffs are not rendered by default.

7 changes: 3 additions & 4 deletions src/main/java/org/owasp/esapi/crypto/KeyDerivationFunction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
import org.owasp.esapi.Logger;
import org.owasp.esapi.errors.ConfigurationException;
import org.owasp.esapi.errors.EncryptionException;
import org.owasp.esapi.reference.DefaultSecurityConfiguration;
import static org.owasp.esapi.PropNames.KDF_PRF_ALG;
import org.owasp.esapi.util.ByteConversionUtil;

/**
Expand Down Expand Up @@ -133,7 +133,7 @@ public KeyDerivationFunction() {
if ( ! KeyDerivationFunction.isValidPRF(prfName) ) {
throw new ConfigurationException("Algorithm name " + prfName +
" not a valid algorithm name for property " +
DefaultSecurityConfiguration.KDF_PRF_ALG);
KDF_PRF_ALG);
}
prfAlg_ = prfName;
}
Expand All @@ -159,8 +159,7 @@ static int getDefaultPRFSelection() {
}
}
throw new ConfigurationException("Algorithm name " + prfName +
" not a valid algorithm name for property " +
DefaultSecurityConfiguration.KDF_PRF_ALG);
" not a valid algorithm name for property " + KDF_PRF_ALG);
}

/**
Expand Down
7 changes: 1 addition & 6 deletions src/main/java/org/owasp/esapi/errors/EnterpriseSecurityException.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,7 @@
import org.owasp.esapi.ESAPI;
import org.owasp.esapi.Logger;

// At some point, all these property names will be moved to a new class named
// org.owasp.esapi.PropNames
// but until then, while this is an ugly kludge, we are importing it via a
// reference implementation class until we have a chance to clean it up.
// (Note: kwwall's Bitbucket code already has that class.)
import static org.owasp.esapi.reference.DefaultSecurityConfiguration.DISABLE_INTRUSION_DETECTION;
import static org.owasp.esapi.PropNames.DISABLE_INTRUSION_DETECTION;


/**
Expand Down
21 changes: 14 additions & 7 deletions src/main/java/org/owasp/esapi/logging/java/JavaLogFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,14 @@
import org.owasp.esapi.logging.cleaning.CompositeLogScrubber;
import org.owasp.esapi.logging.cleaning.LogScrubber;
import org.owasp.esapi.logging.cleaning.NewlineLogScrubber;
import org.owasp.esapi.reference.DefaultSecurityConfiguration;

import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;

/**
* LogFactory implementation which creates JAVA supporting Loggers.
*
Expand All @@ -55,15 +62,15 @@ public class JavaLogFactory implements LogFactory {
private static JavaLogBridge LOG_BRIDGE;

static {
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED);
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(LOG_ENCODING_REQUIRED);
JAVA_LOG_SCRUBBER = createLogScrubber(encodeLog);


boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_USER_INFO);
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_CLIENT_INFO);
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_APPLICATION_NAME);
String appName = ESAPI.securityConfiguration().getStringProp(DefaultSecurityConfiguration.APPLICATION_NAME);
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_SERVER_IP);
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_USER_INFO);
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_CLIENT_INFO);
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
JAVA_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);

Map<Integer, JavaLogLevelHandler> levelLookup = new HashMap<>();
Expand Down
21 changes: 14 additions & 7 deletions src/main/java/org/owasp/esapi/logging/log4j/Log4JLogFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,14 @@
import org.owasp.esapi.logging.cleaning.CompositeLogScrubber;
import org.owasp.esapi.logging.cleaning.LogScrubber;
import org.owasp.esapi.logging.cleaning.NewlineLogScrubber;
import org.owasp.esapi.reference.DefaultSecurityConfiguration;

import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;

/**
* LogFactory implementation which creates Log4J supporting Loggers.
*
Expand All @@ -48,15 +55,15 @@ public class Log4JLogFactory implements LogFactory {
private static Log4JLogBridge LOG_BRIDGE;

static {
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED);
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(LOG_ENCODING_REQUIRED);
Log4J_LOG_SCRUBBER = createLogScrubber(encodeLog);


boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_USER_INFO);
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_CLIENT_INFO);
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_APPLICATION_NAME);
String appName = ESAPI.securityConfiguration().getStringProp(DefaultSecurityConfiguration.APPLICATION_NAME);
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_SERVER_IP);
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_USER_INFO);
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_CLIENT_INFO);
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
Log4J_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);

Map<Integer, Log4JLogLevelHandler> levelLookup = new HashMap<>();
Expand Down
20 changes: 13 additions & 7 deletions src/main/java/org/owasp/esapi/logging/log4j/Log4JLoggerFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,13 @@
import org.owasp.esapi.ESAPI;
import org.owasp.esapi.logging.appender.LogAppender;
import org.owasp.esapi.logging.cleaning.LogScrubber;
import org.owasp.esapi.reference.DefaultSecurityConfiguration;

import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;

/**
* Service Provider Interface implementation that can be provided as the org.apache.log4j.spi.LoggerFactory reference in a Log4J configuration.
Expand All @@ -37,14 +43,14 @@ public class Log4JLoggerFactory implements LoggerFactory {
private static LogScrubber LOG4J_LOG_SCRUBBER;

static {
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED);
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(LOG_ENCODING_REQUIRED);
LOG4J_LOG_SCRUBBER = Log4JLogFactory.createLogScrubber(encodeLog);

boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_USER_INFO);
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_CLIENT_INFO);
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_APPLICATION_NAME);
String appName = ESAPI.securityConfiguration().getStringProp(DefaultSecurityConfiguration.APPLICATION_NAME);
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_SERVER_IP);
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_USER_INFO);
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_CLIENT_INFO);
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
LOG4J_LOG_APPENDER = Log4JLogFactory.createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);
}

Expand Down
20 changes: 13 additions & 7 deletions src/main/java/org/owasp/esapi/logging/slf4j/Slf4JLogFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,13 @@
import org.owasp.esapi.logging.cleaning.CompositeLogScrubber;
import org.owasp.esapi.logging.cleaning.LogScrubber;
import org.owasp.esapi.logging.cleaning.NewlineLogScrubber;
import org.owasp.esapi.reference.DefaultSecurityConfiguration;

import static org.owasp.esapi.PropNames.LOG_ENCODING_REQUIRED;
import static org.owasp.esapi.PropNames.LOG_USER_INFO;
import static org.owasp.esapi.PropNames.LOG_CLIENT_INFO;
import static org.owasp.esapi.PropNames.LOG_APPLICATION_NAME;
import static org.owasp.esapi.PropNames.APPLICATION_NAME;
import static org.owasp.esapi.PropNames.LOG_SERVER_IP;
import org.slf4j.LoggerFactory;
/**
* LogFactory implementation which creates SLF4J supporting Loggers.
Expand All @@ -54,15 +60,15 @@ public class Slf4JLogFactory implements LogFactory {
private static Slf4JLogBridge LOG_BRIDGE;

static {
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_ENCODING_REQUIRED);
boolean encodeLog = ESAPI.securityConfiguration().getBooleanProp(LOG_ENCODING_REQUIRED);
SLF4J_LOG_SCRUBBER = createLogScrubber(encodeLog);


boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_USER_INFO);
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_CLIENT_INFO);
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_APPLICATION_NAME);
String appName = ESAPI.securityConfiguration().getStringProp(DefaultSecurityConfiguration.APPLICATION_NAME);
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(DefaultSecurityConfiguration.LOG_SERVER_IP);
boolean logUserInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_USER_INFO);
boolean logClientInfo = ESAPI.securityConfiguration().getBooleanProp(LOG_CLIENT_INFO);
boolean logApplicationName = ESAPI.securityConfiguration().getBooleanProp(LOG_APPLICATION_NAME);
String appName = ESAPI.securityConfiguration().getStringProp(APPLICATION_NAME);
boolean logServerIp = ESAPI.securityConfiguration().getBooleanProp(LOG_SERVER_IP);
SLF4J_LOG_APPENDER = createLogAppender(logUserInfo, logClientInfo, logServerIp, logApplicationName, appName);

Map<Integer, Slf4JLogLevelHandler> levelLookup = new HashMap<>();
Expand Down
Loading