Skip to content

Commit 409caac

Browse files
author
planetlevel
committed
Make threadlocals non-static - minor non-security relevant change
1 parent bb46acb commit 409caac

6 files changed

Lines changed: 24 additions & 17 deletions

File tree

‎.classpath‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,6 @@
2020
<classpathentry kind="lib" path="lib/servlet-api.jar" sourcepath="C:/Users/jwilliams/Workbench/codereview/libraries/j2ee-1_4_1-src-scsl.zip"/>
2121
<classpathentry kind="con" path="org.eclipse.jdt.junit.JUNIT_CONTAINER/3"/>
2222
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/jdk1.4.2_16"/>
23+
<classpathentry kind="lib" path="lib/jsp-api.jar"/>
2324
<classpathentry kind="output" path="build"/>
2425
</classpath>

‎build.number‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#Build Number for ANT. Do not edit!
2+
#Fri Mar 14 18:23:40 EDT 2008
3+
build.number=92

‎resources/ESAPI.properties‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ Validator.HTTPHeaderName=^[a-zA-Z0-9\\-]{0,32}$
5555
Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:& ]*$
5656

5757
# Validation of file related input
58-
Validator.FileName=^[a-zA-Z0-9.-_ ]{0,255}$
59-
Validator.DirectoryName=^[a-zA-Z0-9.-_ ]{0,255}$
58+
Validator.FileName=^[a-zA-Z0-9.\\-_ ]{0,255}$
59+
Validator.DirectoryName=^[a-zA-Z0-9.-\\_ ]{0,255}$
6060

6161
# File upload configuration
6262
ValidExtensions=.zip,.pdf,.doc,.docx,.ppt,.pptx,.tar,.gz,.tgz,.rar,.war,.jar,.ear,.xls,.rtf,.properties,.java,.class,.txt,.xml,.jsp,.jsf,.exe,.dll

‎src/org/owasp/esapi/Authenticator.java‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -143,9 +143,9 @@ public static void main(String[] args) throws Exception {
143143
* the ThreadLocal approach simplifies things greatly. <P> As a possible extension, one could create a delegation
144144
* framework by adding another ThreadLocal to hold the delegating user identity.
145145
*/
146-
private static ThreadLocalUser currentUser = new ThreadLocalUser();
146+
private ThreadLocalUser currentUser = new ThreadLocalUser();
147147

148-
private static class ThreadLocalUser extends InheritableThreadLocal {
148+
private class ThreadLocalUser extends InheritableThreadLocal {
149149

150150
public Object initialValue() {
151151
return anonymous;
@@ -166,9 +166,9 @@ public void setUser(IUser newUser) {
166166
* application. This enables API's for actions that require the request to be much simpler. For example, the logout()
167167
* method in the Authenticator class requires the currentRequest to get the session in order to invalidate it.
168168
*/
169-
private static ThreadLocalRequest currentRequest = new ThreadLocalRequest();
169+
private ThreadLocalRequest currentRequest = new ThreadLocalRequest();
170170

171-
private static class ThreadLocalRequest extends InheritableThreadLocal {
171+
private class ThreadLocalRequest extends InheritableThreadLocal {
172172

173173
public Object initialValue() {
174174
return null;
@@ -188,9 +188,9 @@ public void setUser(HttpServletRequest newRequest) {
188188
* application. This enables API's for actions that require the response to be much simpler. For example, the logout()
189189
* method in the Authenticator class requires the currentResponse to kill the JSESSIONID cookie.
190190
*/
191-
private static ThreadLocalResponse currentResponse = new ThreadLocalResponse();
191+
private ThreadLocalResponse currentResponse = new ThreadLocalResponse();
192192

193-
private static class ThreadLocalResponse extends InheritableThreadLocal {
193+
private class ThreadLocalResponse extends InheritableThreadLocal {
194194

195195
public Object initialValue() {
196196
return null;
@@ -550,9 +550,6 @@ public User login(HttpServletRequest request, HttpServletResponse response) thro
550550
// save the current request and response in the threadlocal variables
551551
setCurrentHTTP(request, response);
552552

553-
if ( !ESAPI.httpUtilities().isSecureChannel() ) {
554-
new AuthenticationCredentialsException( "Session exposed", "Authentication attempt made over non-SSL connection. Check web.xml and server configuration" );
555-
}
556553
User user = null;
557554

558555
// if there's a user in the session then use that
@@ -567,31 +564,36 @@ public User login(HttpServletRequest request, HttpServletResponse response) thro
567564
user.setFirstRequest(true);
568565
}
569566

567+
// warn if this authentication request came over a non-SSL connection, exposing credentials or session id
568+
if ( !ESAPI.httpUtilities().isSecureChannel() ) {
569+
new AuthenticationCredentialsException( "Session or credentials exposed", "Authentication attempt made over non-SSL connection. Check web.xml and server configuration. User: " + user.getAccountName() );
570+
}
571+
570572
// don't let anonymous user log in
571573
if (user.isAnonymous()) {
572574
user.logout();
573-
throw new AuthenticationLoginException("Login failed", "Anonymous user cannot be set to current user");
575+
throw new AuthenticationLoginException("Login failed", "Anonymous user cannot be set to current user. User: " + user.getAccountName() );
574576
}
575577

576578
// don't let disabled users log in
577579
if (!user.isEnabled()) {
578580
user.logout();
579581
user.setLastFailedLoginTime(new Date());
580-
throw new AuthenticationLoginException("Login failed", "Disabled user cannot be set to current user: " + user.getAccountName());
582+
throw new AuthenticationLoginException("Login failed", "Disabled user cannot be set to current user. User: " + user.getAccountName() );
581583
}
582584

583585
// don't let locked users log in
584586
if (user.isLocked()) {
585587
user.logout();
586588
user.setLastFailedLoginTime(new Date());
587-
throw new AuthenticationLoginException("Login failed", "Locked user cannot be set to current user: " + user.getAccountName());
589+
throw new AuthenticationLoginException("Login failed", "Locked user cannot be set to current user. User: " + user.getAccountName() );
588590
}
589591

590592
// don't let expired users log in
591593
if (user.isExpired()) {
592594
user.logout();
593595
user.setLastFailedLoginTime(new Date());
594-
throw new AuthenticationLoginException("Login failed", "Expired user cannot be set to current user: " + user.getAccountName());
596+
throw new AuthenticationLoginException("Login failed", "Expired user cannot be set to current user. User: " + user.getAccountName() );
595597
}
596598

597599
setCurrentUser(user);

‎src/org/owasp/esapi/HTTPUtilities.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -529,5 +529,6 @@ public void setNoCacheHeaders() {
529529
response.setHeader("Pragma","no-cache");
530530
response.setDateHeader("Expires", -1);
531531
}
532+
532533

533534
}

‎test/testresources/ESAPI.properties‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ Validator.HTTPHeaderName=^[a-zA-Z0-9\\-]{0,32}$
5555
Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:& ]*$
5656

5757
# Validation of file related input
58-
Validator.FileName=^[a-zA-Z0-9.-_ ]{0,255}$
59-
Validator.DirectoryName=^[a-zA-Z0-9.-_ ]{0,255}$
58+
Validator.FileName=^[a-zA-Z0-9.\\-_ ]{0,255}$
59+
Validator.DirectoryName=^[a-zA-Z0-9.-\\_ ]{0,255}$
6060

6161
# File upload configuration
6262
ValidExtensions=.zip,.pdf,.doc,.docx,.ppt,.pptx,.tar,.gz,.tgz,.rar,.war,.jar,.ear,.xls,.rtf,.properties,.java,.class,.txt,.xml,.jsp,.jsf,.exe,.dll

0 commit comments

Comments
 (0)