Skip to content

Commit 030e869

Browse files
author
planetlevel
committed
Add configuration for file upload temp directory to ESAPI.properties.
1 parent 6e02c64 commit 030e869

7 files changed

Lines changed: 57 additions & 50 deletions

File tree

‎.settings/org.eclipse.jdt.core.prefs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#Tue Jun 30 16:06:03 EDT 2009
2+
eclipse.preferences.version=1
3+
org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
4+
org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5
5+
org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve
6+
org.eclipse.jdt.core.compiler.compliance=1.5
7+
org.eclipse.jdt.core.compiler.debug.lineNumber=generate
8+
org.eclipse.jdt.core.compiler.debug.localVariable=generate
9+
org.eclipse.jdt.core.compiler.debug.sourceFile=generate
10+
org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
11+
org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
12+
org.eclipse.jdt.core.compiler.source=1.5

‎src/main/java/org/owasp/esapi/HTTPUtilities.java‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,6 @@
3131
import org.owasp.esapi.errors.EncryptionException;
3232
import org.owasp.esapi.errors.IntrusionException;
3333
import org.owasp.esapi.errors.ValidationException;
34-
import org.owasp.esapi.filters.ESAPIRequest;
35-
import org.owasp.esapi.filters.ESAPIResponse;
3634

3735

3836
/**
@@ -208,17 +206,14 @@ public interface HTTPUtilities {
208206
* This method uses {@link HTTPUtilities#getCurrentRequest()} to obtain the {@link HttpServletRequest} object
209207
*
210208
* @param request
211-
* @param tempDir
212-
* the temporary directory
213-
* @param finalDir
214-
* the final directory
209+
* @param destination directory
215210
*
216211
* @return List of new File objects from upload
217212
*
218213
* @throws ValidationException
219214
* if the file fails validation
220215
*/
221-
List getSafeFileUploads(HttpServletRequest request, File tempDir, File finalDir) throws ValidationException;
216+
List getSafeFileUploads(HttpServletRequest request, File destinationDir) throws ValidationException;
222217

223218
/**
224219
* Retrieves a map of data from a cookie encrypted with encryptStateInCookie().
@@ -347,14 +342,14 @@ public interface HTTPUtilities {
347342
*
348343
* @return the current request
349344
*/
350-
ESAPIRequest getCurrentRequest();
345+
HttpServletRequest getCurrentRequest();
351346

352347
/**
353348
* Retrieves the current HttpServletResponse
354349
*
355350
* @return the current response
356351
*/
357-
ESAPIResponse getCurrentResponse();
352+
HttpServletResponse getCurrentResponse();
358353

359354
/**
360355
* Format the Source IP address, URL, URL parameters, and all form
@@ -386,6 +381,9 @@ public interface HTTPUtilities {
386381
void logHTTPRequest(HttpServletRequest request, Logger logger, List parameterNamesToObfuscate);
387382

388383

389-
List getSafeFileUploads(HttpServletRequest request, File tempDir) throws ValidationException;
384+
/**
385+
* Parse a multipart HTTP request and extract any files therein.
386+
*/
387+
List getSafeFileUploads(HttpServletRequest request) throws ValidationException;
390388

391389
}

‎src/main/java/org/owasp/esapi/SecurityConfiguration.java‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,12 +118,17 @@ public interface SecurityConfiguration {
118118
public byte[] getMasterKey();
119119

120120
/**
121-
* Retrieves the default upload directory declared in the ESAPI properties file.
122-
*
123-
* @return the default upload directory declared in the ESAPI properties file
121+
* Retrieves the upload directory as specified in the ESAPI.properties file.
122+
* @return the upload directory
124123
*/
125124
public File getUploadDirectory();
126125

126+
/**
127+
* Retrieves the temp directory to use when uploading files, as specified in ESAPI.properties.
128+
* @return the temp directory
129+
*/
130+
public File getUploadTempDirectory();
131+
127132
/**
128133
* Gets the key length to use in cryptographic operations declared in the ESAPI properties file.
129134
*

‎src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java‎

Lines changed: 16 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,6 @@
4747
import org.owasp.esapi.errors.IntrusionException;
4848
import org.owasp.esapi.errors.ValidationException;
4949
import org.owasp.esapi.errors.ValidationUploadException;
50-
import org.owasp.esapi.filters.ESAPIRequest;
51-
import org.owasp.esapi.filters.ESAPIResponse;
5250

5351
/**
5452
* Reference implementation of the HTTPUtilities interface. This implementation
@@ -365,8 +363,8 @@ public void encryptStateInCookie(HttpServletResponse response, Map cleartext) th
365363
* @param request
366364
* @return list of File objects for new files in final directory
367365
*/
368-
public List getSafeFileUploads(HttpServletRequest request, File tempDir) throws ValidationException {
369-
return getSafeFileUploads(request, tempDir, ESAPI.securityConfiguration().getUploadDirectory());
366+
public List getSafeFileUploads(HttpServletRequest request) throws ValidationException {
367+
return getSafeFileUploads(request, ESAPI.securityConfiguration().getUploadDirectory());
370368
}
371369

372370
/**
@@ -379,7 +377,8 @@ public List getSafeFileUploads(HttpServletRequest request, File tempDir) throws
379377
* @param request
380378
* @return list of File objects for new files in final directory
381379
*/
382-
public List getSafeFileUploads(HttpServletRequest request, File tempDir, File finalDir) throws ValidationException {
380+
public List getSafeFileUploads(HttpServletRequest request, File finalDir) throws ValidationException {
381+
File tempDir = ESAPI.securityConfiguration().getUploadTempDirectory();
383382
if ( !tempDir.exists() ) {
384383
if ( !tempDir.mkdirs() ) throw new ValidationUploadException( "Upload failed", "Could not create temp directory: " + tempDir.getAbsolutePath() );
385384
}
@@ -586,40 +585,23 @@ public void setNoCacheHeaders(HttpServletResponse response) {
586585
/**
587586
* {@inheritDoc}
588587
*/
589-
public ESAPIRequest getCurrentRequest() {
590-
ESAPIRequest request = (ESAPIRequest)currentRequest.get();
591-
return request;
588+
public HttpServletRequest getCurrentRequest() {
589+
return (HttpServletRequest)currentRequest.get();
592590
}
593591

594592
/**
595593
* {@inheritDoc}
596594
*/
597-
public ESAPIResponse getCurrentResponse() {
598-
ESAPIResponse response = (ESAPIResponse)currentResponse.get();
599-
return response;
595+
public HttpServletResponse getCurrentResponse() {
596+
return (HttpServletResponse)currentResponse.get();
600597
}
601598

602599
/**
603600
* {@inheritDoc}
604601
*/
605602
public void setCurrentHTTP(HttpServletRequest request, HttpServletResponse response) {
606-
ESAPIRequest safeRequest = null;
607-
ESAPIResponse safeResponse = null;
608-
609-
// wrap if necessary
610-
if ( request instanceof ESAPIRequest ) {
611-
safeRequest = (ESAPIRequest)request;
612-
} else {
613-
safeRequest = new ESAPIRequest( request );
614-
}
615-
if ( response instanceof ESAPIResponse ) {
616-
safeResponse = (ESAPIResponse)response;
617-
} else {
618-
safeResponse = new ESAPIResponse( response );
619-
}
620-
621-
currentRequest.set(safeRequest);
622-
currentResponse.set(safeResponse);
603+
currentRequest.set(request);
604+
currentResponse.set(response);
623605
}
624606

625607
public void logHTTPRequest(HttpServletRequest request, Logger logger) {
@@ -676,11 +658,11 @@ public Object initialValue() {
676658
return null;
677659
}
678660

679-
public ESAPIRequest getRequest() {
680-
return (ESAPIRequest)super.get();
661+
public HttpServletRequest getRequest() {
662+
return (HttpServletRequest)super.get();
681663
}
682664

683-
public void setRequest(ESAPIRequest newRequest) {
665+
public void setRequest(HttpServletRequest newRequest) {
684666
super.set(newRequest);
685667
}
686668
};
@@ -694,11 +676,11 @@ public Object initialValue() {
694676
return null;
695677
}
696678

697-
public ESAPIResponse getResponse() {
698-
return (ESAPIResponse)super.get();
679+
public HttpServletResponse getResponse() {
680+
return (HttpServletResponse)super.get();
699681
}
700682

701-
public void setResponse(ESAPIResponse newResponse) {
683+
public void setResponse(HttpServletResponse newResponse) {
702684
super.set(newResponse);
703685
}
704686
};

‎src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ public class DefaultSecurityConfiguration implements SecurityConfiguration {
9393

9494
private static final String FORCE_HTTPONLY = "HttpUtilities.ForceHTTPOnly";
9595
private static final String UPLOAD_DIRECTORY = "HttpUtilities.UploadDir";
96+
private static final String UPLOAD_TEMP_DIRECTORY = "HttpUtilities.UploadTempDir";
9697
private static final String APPROVED_UPLOAD_EXTENSIONS = "HttpUtilities.ApprovedUploadExtensions";
9798
private static final String MAX_UPLOAD_FILE_BYTES = "HttpUtilities.MaxUploadFileBytes";
9899
private static final String RESPONSE_CONTENT_TYPE = "HttpUtilities.ResponseContentType";
@@ -586,6 +587,14 @@ public File getUploadDirectory() {
586587
return new File( dir );
587588
}
588589

590+
/**
591+
* {@inheritDoc}
592+
*/
593+
public File getUploadTempDirectory() {
594+
String dir = getESAPIProperty( UPLOAD_TEMP_DIRECTORY, "UploadTempDir");
595+
return new File( dir );
596+
}
597+
589598
/**
590599
* {@inheritDoc}
591600
*/

‎src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ public void testGetFileUploads() throws IOException {
200200
MockHttpServletResponse response = new MockHttpServletResponse();
201201
ESAPI.httpUtilities().setCurrentHTTP(request1, response);
202202
try {
203-
ESAPI.httpUtilities().getSafeFileUploads(request1, home, home);
203+
ESAPI.httpUtilities().getSafeFileUploads(request1, home);
204204
fail();
205205
} catch( ValidationException e ) {
206206
// expected
@@ -210,7 +210,7 @@ public void testGetFileUploads() throws IOException {
210210
request2.setContentType( "multipart/form-data; boundary=ridiculous");
211211
ESAPI.httpUtilities().setCurrentHTTP(request2, response);
212212
try {
213-
List list = ESAPI.httpUtilities().getSafeFileUploads(request2, home, home);
213+
List list = ESAPI.httpUtilities().getSafeFileUploads(request2, home);
214214
Iterator i = list.iterator();
215215
while ( i.hasNext() ) {
216216
File f = (File)i.next();
@@ -242,7 +242,7 @@ public void testGetFileUploads() throws IOException {
242242
request3.setContentType( "multipart/form-data; boundary=ridiculous");
243243
ESAPI.httpUtilities().setCurrentHTTP(request3, response);
244244
try {
245-
ESAPI.httpUtilities().getSafeFileUploads(request3, home, home);
245+
ESAPI.httpUtilities().getSafeFileUploads(request3, home);
246246
fail();
247247
} catch (ValidationException e) {
248248
// expected

‎src/test/resources/.esapi/ESAPI.properties‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ Encryptor.CharacterEncoding=UTF-8
118118
#
119119
# Default file upload location (remember to escape backslashes with \\)
120120
HttpUtilities.UploadDir=C:\\ESAPI\\testUpload
121+
HttpUtilities.UploadTempDir=C:\\temp
121122
# Force HTTP only on all cookies in ESAPI SafeRequest
122123
HttpUtilities.ForceHTTPOnly=false
123124
# File upload configuration

0 commit comments

Comments
 (0)