Skip to content

Commit 4ce3e96

Browse files
author
arshan.dabirsiaghi@gmail.com
committed
- changed usage to InterceptingHTTPServletRequest in rules
- changed name of outbound content detection and virtual patch classes to be more intuitive
1 parent cfcc3dc commit 4ce3e96

7 files changed

Lines changed: 25 additions & 12 deletions

File tree

‎src/main/java/org/owasp/esapi/filters/waf/rules/AuthenticatedRule.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44
import javax.servlet.http.HttpServletResponse;
55
import javax.servlet.http.HttpSession;
66

7+
import org.owasp.esapi.filters.waf.internal.InterceptingHTTPServletRequest;
8+
79
public class AuthenticatedRule extends Rule {
810

911
private String sessionAttribute;
@@ -12,7 +14,7 @@ public AuthenticatedRule(String sessionAttribute) {
1214
this.sessionAttribute = sessionAttribute;
1315
}
1416

15-
public boolean check(HttpServletRequest request,
17+
public boolean check(InterceptingHTTPServletRequest request,
1618
HttpServletResponse response) {
1719

1820
HttpSession session = request.getSession();

src/main/java/org/owasp/esapi/filters/waf/rules/DetectContentRule.java renamed to src/main/java/org/owasp/esapi/filters/waf/rules/DetectOutboundContentRule.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,14 @@
66
import javax.servlet.http.HttpServletRequest;
77
import javax.servlet.http.HttpServletResponse;
88

9+
import org.owasp.esapi.filters.waf.internal.InterceptingHTTPServletRequest;
910
import org.owasp.esapi.filters.waf.internal.InterceptingHTTPServletResponse;
1011

11-
public class DetectContentRule extends Rule {
12+
public class DetectOutboundContentRule extends Rule {
1213

1314
private List<Pattern> patterns;
1415

15-
public boolean check(HttpServletRequest request,
16+
public boolean check(InterceptingHTTPServletRequest request,
1617
HttpServletResponse response) {
1718

1819
byte[] bytes = ((InterceptingHTTPServletResponse)response).getInterceptingServletOutputStream().getResponseBytes();

‎src/main/java/org/owasp/esapi/filters/waf/rules/GeneralAttackSignatureRule.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
import javax.servlet.http.HttpServletRequest;
77
import javax.servlet.http.HttpServletResponse;
88

9+
import org.owasp.esapi.filters.waf.internal.InterceptingHTTPServletRequest;
10+
911
public class GeneralAttackSignatureRule extends Rule {
1012

1113
private Pattern signature;
@@ -14,14 +16,14 @@ public GeneralAttackSignatureRule(Pattern signature) {
1416
this.signature = signature;
1517
}
1618

17-
public boolean check(HttpServletRequest request,
19+
public boolean check(InterceptingHTTPServletRequest request,
1820
HttpServletResponse response) {
1921

2022
Enumeration e = request.getParameterNames();
2123

2224
while(e.hasMoreElements()) {
2325
String param = (String)e.nextElement();
24-
if ( signature.matcher(request.getParameter(param)).matches() ) {
26+
if ( signature.matcher(request.getDictionaryParameter(param)).matches() ) {
2527
return false;
2628
}
2729
}

‎src/main/java/org/owasp/esapi/filters/waf/rules/IPRule.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
import javax.servlet.http.HttpServletRequest;
66
import javax.servlet.http.HttpServletResponse;
77

8+
import org.owasp.esapi.filters.waf.internal.InterceptingHTTPServletRequest;
9+
810
public class IPRule extends Rule {
911

1012
private Pattern ip;
@@ -15,7 +17,7 @@ public IPRule(Pattern ip, Pattern pathPattern) {
1517
this.pathPattern = pathPattern;
1618
}
1719

18-
public boolean check(HttpServletRequest request,
20+
public boolean check(InterceptingHTTPServletRequest request,
1921
HttpServletResponse response) {
2022

2123
if ( pathPattern.matcher(request.getPathInfo()).matches() ) {

‎src/main/java/org/owasp/esapi/filters/waf/rules/ReplaceContentRule.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@
33
import javax.servlet.http.HttpServletRequest;
44
import javax.servlet.http.HttpServletResponse;
55

6+
import org.owasp.esapi.filters.waf.internal.InterceptingHTTPServletRequest;
7+
68
public class ReplaceContentRule extends Rule {
79

810
@Override
9-
public boolean check(HttpServletRequest request,
11+
public boolean check(InterceptingHTTPServletRequest request,
1012
HttpServletResponse response) {
1113
// TODO Auto-generated method stub
1214
return false;

‎src/main/java/org/owasp/esapi/filters/waf/rules/Rule.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@
33
import javax.servlet.http.HttpServletRequest;
44
import javax.servlet.http.HttpServletResponse;
55

6+
import org.owasp.esapi.filters.waf.internal.InterceptingHTTPServletRequest;
7+
68
public abstract class Rule {
79

810
public abstract boolean check(
9-
HttpServletRequest request,
11+
InterceptingHTTPServletRequest request,
1012
HttpServletResponse response);
1113

1214
private int guid;

src/main/java/org/owasp/esapi/filters/waf/rules/VirtualPatchRule.java renamed to src/main/java/org/owasp/esapi/filters/waf/rules/SimpleVirtualPatchRule.java

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,23 @@
66
import javax.servlet.http.HttpServletRequest;
77
import javax.servlet.http.HttpServletResponse;
88

9-
public class VirtualPatchRule extends Rule {
9+
import org.owasp.esapi.filters.waf.internal.InterceptingHTTPServletRequest;
10+
11+
public class SimpleVirtualPatchRule extends Rule {
1012

1113
private Pattern path;
1214
private Pattern parameters;
1315
private Pattern exceptions;
1416
private Pattern signature;
1517

16-
public VirtualPatchRule(Pattern path, Pattern parameters, Pattern exceptions, Pattern signature) {
18+
public SimpleVirtualPatchRule(Pattern path, Pattern parameters, Pattern exceptions, Pattern signature) {
1719
this.path = path;
1820
this.parameters = parameters;
1921
this.exceptions = exceptions;
2022
this.signature = signature;
2123
}
2224

23-
public boolean check(HttpServletRequest request,
25+
public boolean check(InterceptingHTTPServletRequest request,
2426
HttpServletResponse response) {
2527

2628
if ( path.matcher(request.getRequestURI()).matches() ) {
@@ -35,7 +37,7 @@ public boolean check(HttpServletRequest request,
3537
String param = (String)e.nextElement();
3638
if ( parameters.matcher(param).matches() ) {
3739
if ( exceptions == null || ! exceptions.matcher(param).matches() ) {
38-
if ( signature.matcher(request.getParameter(param)).matches() ) {
40+
if ( signature.matcher(request.getDictionaryParameter(param)).matches() ) {
3941
return false;
4042
}
4143
}

0 commit comments

Comments
 (0)