Skip to content

Commit b1eb84d

Browse files
author
manico.james
committed
added canonicalize validation option
1 parent 2a4c515 commit b1eb84d

3 files changed

Lines changed: 103 additions & 15 deletions

File tree

‎src/main/java/org/owasp/esapi/Validator.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ public interface Validator {
5757
* Calls isValidInput and returns true if no exceptions are thrown.
5858
*/
5959
boolean isValidInput(String context, String input, String type, int maxLength, boolean allowNull) throws IntrusionException;
60+
61+
/**
62+
* Calls isValidInput and returns true if no exceptions are thrown.
63+
*/
64+
boolean isValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize) throws IntrusionException;
6065

6166
/**
6267
* Returns canonicalized and validated input as a String. Invalid input will generate a descriptive ValidationException,
@@ -80,11 +85,40 @@ public interface Validator {
8085
*/
8186
String getValidInput(String context, String input, String type, int maxLength, boolean allowNull) throws ValidationException, IntrusionException;
8287

88+
/**
89+
* Returns validated input as a String with optional canonicalization. Invalid input will generate a descriptive ValidationException,
90+
* and input that is clearly an attack will generate a descriptive IntrusionException.
91+
*
92+
* @param context
93+
* A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.
94+
* @param input
95+
* The actual user input data to validate.
96+
* @param type
97+
* The regular expression name that maps to the actual regular expression from "ESAPI.properties".
98+
* @param maxLength
99+
* The maximum post-canonicalized String length allowed.
100+
* @param allowNull
101+
* If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.
102+
* @param canonicalize
103+
* If canonicalize is true then input will be canonicalized before validation
104+
*
105+
* @return The canonicalized user input.
106+
*
107+
* @throws ValidationException
108+
* @throws IntrusionException
109+
*/
110+
String getValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize) throws ValidationException, IntrusionException;
111+
83112
/**
84113
* Calls getValidInput with the supplied errorList to capture ValidationExceptions
85114
*/
86115
String getValidInput(String context, String input, String type, int maxLength, boolean allowNull, ValidationErrorList errorList) throws IntrusionException;
87116

117+
/**
118+
* Calls getValidInput with the supplied errorList to capture ValidationExceptions
119+
*/
120+
String getValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize, ValidationErrorList errorList) throws IntrusionException;
121+
88122
/**
89123
* Calls isValidDate and returns true if no exceptions are thrown.
90124
*/

‎src/main/java/org/owasp/esapi/reference/DefaultValidator.java‎

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -146,10 +146,20 @@ public boolean isValidInput(String context, String input, String type, int maxLe
146146
return false;
147147
}
148148
}
149+
150+
public boolean isValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize) throws IntrusionException {
151+
try {
152+
getValidInput( context, input, type, maxLength, allowNull, canonicalize);
153+
return true;
154+
} catch( Exception e ) {
155+
return false;
156+
}
157+
}
149158

150159
/**
151160
* Validates data received from the browser and returns a safe version. Only
152-
* URL encoding is supported. Double encoding is treated as an attack.
161+
* URL encoding is supported. Double encoding is treated as an attack. Input
162+
* is canonicalized by default before validation.
153163
*
154164
* @param context A descriptive name for the field to validate. This is used for error facing validation messages and element identification.
155165
* @param input The actual user input data to validate.
@@ -161,6 +171,24 @@ public boolean isValidInput(String context, String input, String type, int maxLe
161171
* @throws IntrusionException
162172
*/
163173
public String getValidInput(String context, String input, String type, int maxLength, boolean allowNull) throws ValidationException {
174+
return getValidInput(context, input, type, maxLength, allowNull, true);
175+
}
176+
177+
/**
178+
* Validates data received from the browser and returns a safe version. Only
179+
* URL encoding is supported. Double encoding is treated as an attack.
180+
*
181+
* @param context A descriptive name for the field to validate. This is used for error facing validation messages and element identification.
182+
* @param input The actual user input data to validate.
183+
* @param type The regular expression name which maps to the actual regular expression from "ESAPI.properties".
184+
* @param maxLength The maximum String length allowed. If input is canonicalized per the canonicalize argument, then maxLength must be verified after canonicalization
185+
* @param allowNull If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.
186+
* @param canonicalize If canonicalize is true then input will be canonicalized before validation
187+
* @return The user input, may be canonicalized if canonicalize argument is true
188+
* @throws ValidationException
189+
* @throws IntrusionException
190+
*/
191+
public String getValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize) throws ValidationException {
164192
StringValidationRule rvr = new StringValidationRule( type, encoder );
165193
Pattern p = ESAPI.securityConfiguration().getValidationPattern( type );
166194
if ( p != null ) {
@@ -170,25 +198,45 @@ public String getValidInput(String context, String input, String type, int maxLe
170198
}
171199
rvr.setMaximumLength(maxLength);
172200
rvr.setAllowNull(allowNull);
201+
rvr.setValidateInputAndCanonical(canonicalize);
173202
return rvr.getValid(context, input);
174203
}
175204

176205
/**
177206
* Validates data received from the browser and returns a safe version. Only
178-
* URL encoding is supported. Double encoding is treated as an attack.
207+
* URL encoding is supported. Double encoding is treated as an attack. Input
208+
* is canonicalized by default before validation.
179209
*
180210
* @param context A descriptive name for the field to validate. This is used for error facing validation messages and element identification.
181211
* @param input The actual user input data to validate.
182212
* @param type The regular expression name while maps to the actual regular expression from "ESAPI.properties".
183-
* @param maxLength The maximum post-canonicalized String length allowed.
213+
* @param maxLength The maximum String length allowed. If input is canonicalized per the canonicalize argument, then maxLength must be verified after canonicalization
184214
* @param allowNull If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.
185215
* @param errors If ValidationException is thrown, then add to error list instead of throwing out to caller
186216
* @return The canonicalized user input.
187217
* @throws IntrusionException
188218
*/
189219
public String getValidInput(String context, String input, String type, int maxLength, boolean allowNull, ValidationErrorList errors) throws IntrusionException {
220+
return getValidInput(context, input, type, maxLength, allowNull, true, errors);
221+
}
222+
223+
/**
224+
* Validates data received from the browser and returns a safe version. Only
225+
* URL encoding is supported. Double encoding is treated as an attack.
226+
*
227+
* @param context A descriptive name for the field to validate. This is used for error facing validation messages and element identification.
228+
* @param input The actual user input data to validate.
229+
* @param type The regular expression name while maps to the actual regular expression from "ESAPI.properties".
230+
* @param maxLength The maximum post-canonicalized String length allowed
231+
* @param allowNull If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.
232+
* @param canonicalize If canonicalize is true then input will be canonicalized before validation
233+
* @param errors If ValidationException is thrown, then add to error list instead of throwing out to caller
234+
* @return The user input, may be canonicalized if canonicalize argument is true
235+
* @throws IntrusionException
236+
*/
237+
public String getValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize, ValidationErrorList errors) throws IntrusionException {
190238
try {
191-
return getValidInput(context, input, type, maxLength, allowNull);
239+
return getValidInput(context, input, type, maxLength, allowNull, canonicalize);
192240
} catch (ValidationException e) {
193241
errors.addError(context, e);
194242
}

‎src/main/java/org/owasp/esapi/reference/validation/StringValidationRule.java‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
import org.owasp.esapi.Encoder;
2424
import org.owasp.esapi.EncoderConstants;
2525
import org.owasp.esapi.StringUtilities;
26-
import org.owasp.esapi.errors.EncodingException;
2726
import org.owasp.esapi.errors.ValidationException;
2827
import org.owasp.esapi.util.NullSafe;
2928

@@ -266,16 +265,18 @@ private String checkEmpty(String context, String input) throws ValidationExcepti
266265
*/
267266
public String getValid( String context, String input ) throws ValidationException
268267
{
269-
String canonical = null;
268+
String data = null;
270269

271270
// checks on input itself
272271

273272
// check for empty/null
274273
if(checkEmpty(context, input) == null)
275274
return null;
276275

277-
if(validateInputAndCanonical)
276+
if (validateInputAndCanonical)
278277
{
278+
//first validate pre-canonicalized data
279+
279280
// check length
280281
checkLength(context, input);
281282

@@ -284,26 +285,31 @@ public String getValid( String context, String input ) throws ValidationExceptio
284285

285286
// check blacklist patterns
286287
checkBlacklist(context, input);
288+
289+
// canonicalize
290+
data = encoder.canonicalize( input );
291+
292+
} else {
293+
294+
//skip canonicalization
295+
data = input;
287296
}
288297

289-
// canonicalize
290-
canonical = encoder.canonicalize( input );
291-
292298
// check for empty/null
293-
if(checkEmpty(context, canonical, input) == null)
299+
if(checkEmpty(context, data, input) == null)
294300
return null;
295301

296302
// check length
297-
checkLength(context, canonical, input);
303+
checkLength(context, data, input);
298304

299305
// check whitelist patterns
300-
checkWhitelist(context, canonical, input);
306+
checkWhitelist(context, data, input);
301307

302308
// check blacklist patterns
303-
checkBlacklist(context, canonical, input);
309+
checkBlacklist(context, data, input);
304310

305311
// validation passed
306-
return canonical;
312+
return data;
307313
}
308314

309315
/**

0 commit comments

Comments
 (0)