Skip to content

Commit 41586f4

Browse files
dschadowdschadow
committed
Refactoring, added logging
1 parent 72fec0a commit 41586f4

File tree

13 files changed

+271
-142
lines changed

13 files changed

+271
-142
lines changed

‎Ch08_CSRF/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ Open the web application in your browser at http://localhost:8080/Ch08_CSRF</des
2222
<groupId>org.owasp.esapi</groupId>
2323
<artifactId>esapi</artifactId>
2424
</dependency>
25+
<dependency>
26+
<groupId>log4j</groupId>
27+
<artifactId>log4j</artifactId>
28+
</dependency>
2529
</dependencies>
2630

2731
<build>

Ch08_CSRF/src/main/java/de/dominikschadow/webappsecurity/CSRFServlet.java renamed to Ch08_CSRF/src/main/java/de/dominikschadow/webappsecurity/servlets/CSRFServlet.java

Lines changed: 34 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -16,64 +16,78 @@
1616
* See the License for the specific language governing permissions and
1717
* limitations under the License.
1818
*/
19-
package de.dominikschadow.webappsecurity;
19+
package de.dominikschadow.webappsecurity.servlets;
2020

21-
import java.io.IOException;
22-
import java.io.PrintWriter;
21+
import org.apache.log4j.Logger;
2322

2423
import javax.servlet.ServletException;
2524
import javax.servlet.annotation.WebServlet;
2625
import javax.servlet.http.HttpServlet;
2726
import javax.servlet.http.HttpServletRequest;
2827
import javax.servlet.http.HttpServletResponse;
28+
import java.io.IOException;
29+
import java.io.PrintWriter;
2930

3031
/**
32+
* Basic unprotected servlet for GET and POST requests. Prints out all information to standard out
33+
* and returns the received parameter as response.
34+
*
3135
* @author Dominik Schadow
3236
*/
3337
@WebServlet(name = "CSRFServlet", urlPatterns = {"/CSRFServlet"})
3438
public class CSRFServlet extends HttpServlet {
3539
private static final long serialVersionUID = 1L;
36-
37-
/**
38-
* @see HttpServlet#HttpServlet()
39-
*/
40-
public CSRFServlet() {
41-
super();
42-
}
40+
private static final Logger LOGGER = Logger.getLogger(CSRFServlet.class);
4341

4442
/**
4543
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
4644
*/
4745
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException {
48-
System.out.println("Processing unprotected GET request");
49-
5046
String name = request.getParameter("name");
51-
System.out.println("Unprotected: Received " + name + " as GET parameter");
47+
LOGGER.info("Processing unprotected GET request: Received " + name + " as parameter");
5248

5349
response.setContentType("text/html");
5450

5551
try (PrintWriter out = response.getWriter()) {
56-
out.println("Received " + name + " as GET parameter");
52+
out.println("<html>");
53+
out.println("<head>");
54+
out.println("<title>Ch08_CSRF</title>");
55+
out.println("<link rel=\"stylesheet\" type=\"text/css\" href=\"styles.css\" />");
56+
out.println("</head>");
57+
out.println("<body>");
58+
out.println("<h1>Ch08_CSRF</h1>");
59+
out.println("<p>Received <b>" + name + "</b> as GET parameter.</p>");
60+
out.println("<p><a href=\"requests-unprotected.jsp\">Back</a></p>");
61+
out.println("</body>");
62+
out.println("</html>");
5763
} catch (IOException ex) {
58-
ex.printStackTrace();
64+
LOGGER.error(ex.getMessage(), ex);
5965
}
6066
}
6167

6268
/**
6369
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
6470
*/
6571
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException {
66-
System.out.println("Processing unprotected POST request");
67-
6872
String name = request.getParameter("name");
69-
System.out.println("Unprotected: Received " + name + " as POST parameter");
73+
LOGGER.info("Processing unprotected POST request: Received " + name + " as parameter");
7074

7175
response.setContentType("text/html");
7276

7377
try (PrintWriter out = response.getWriter()) {
74-
out.println("Received " + name + " as POST parameter");
78+
out.println("<html>");
79+
out.println("<head>");
80+
out.println("<title>Ch08_CSRF</title>");
81+
out.println("<link rel=\"stylesheet\" type=\"text/css\" href=\"styles.css\" />");
82+
out.println("</head>");
83+
out.println("<body>");
84+
out.println("<h1>Ch08_CSRF</h1>");
85+
out.println("<p>Received <b>" + name + "</b> as POST parameter.</p>");
86+
out.println("<p><a href=\"requests-unprotected.jsp\">Back</a></p>");
87+
out.println("</body>");
88+
out.println("</html>");
7589
} catch (IOException ex) {
76-
ex.printStackTrace();
90+
LOGGER.error(ex.getMessage(), ex);
7791
}
7892
}
7993
}

Ch08_CSRF/src/main/java/de/dominikschadow/webappsecurity/ProtectedServlet.java renamed to Ch08_CSRF/src/main/java/de/dominikschadow/webappsecurity/servlets/ProtectedServlet.java

Lines changed: 46 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
* See the License for the specific language governing permissions and
1717
* limitations under the License.
1818
*/
19-
package de.dominikschadow.webappsecurity;
19+
package de.dominikschadow.webappsecurity.servlets;
2020

2121
import java.io.IOException;
2222
import java.io.PrintWriter;
@@ -29,93 +29,112 @@
2929
import javax.servlet.http.HttpServletRequest;
3030
import javax.servlet.http.HttpServletResponse;
3131

32-
import de.dominikschadow.webappsecurity.csrf.CSRFTokenHandler;
32+
import de.dominikschadow.webappsecurity.token.CSRFTokenHandler;
33+
import org.apache.log4j.Logger;
3334

3435
/**
36+
* Basic protected servlet for GET and POST requests. Checks the CSRF-Token value to identify
37+
* CSRF attacks. Prints out all information to standard out and returns the received parameter
38+
* as response.
39+
*
3540
* @author Dominik Schadow
3641
*/
3742
@WebServlet(name = "ProtectedServlet", urlPatterns = {"/ProtectedServlet"})
3843
public class ProtectedServlet extends HttpServlet {
3944
private static final long serialVersionUID = 1L;
45+
private static final Logger LOGGER = Logger.getLogger(ProtectedServlet.class);
4046

41-
/**
42-
* @see HttpServlet#HttpServlet()
43-
*/
44-
public ProtectedServlet() {
45-
super();
46-
}
47-
4847
/**
4948
* @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
5049
*/
5150
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException {
52-
System.out.println("Processing protected GET request");
51+
LOGGER.info("Processing protected GET request");
5352

5453
response.setContentType("text/html");
5554

5655
try {
5756
if (!CSRFTokenHandler.isValid(request)) {
58-
System.out.println("CSRF token is invalid");
57+
LOGGER.warn("CSRF token is invalid");
5958
response.setStatus(401);
6059

6160
try (PrintWriter out = response.getWriter()) {
6261
out.println("CSRF token is invalid");
6362
} catch (IOException ex) {
64-
ex.printStackTrace();
63+
LOGGER.error(ex.getMessage(), ex);
6564
}
6665

6766
return;
6867
}
6968
} catch (NoSuchAlgorithmException | NoSuchProviderException ex) {
70-
ex.printStackTrace();
69+
LOGGER.error(ex.getMessage(), ex);
7170
}
72-
73-
System.out.println("CSRF token is valid");
71+
72+
LOGGER.info("CSRF token is valid");
7473

7574
String name = request.getParameter("name");
76-
System.out.println("Protected: Received " + name + " as GET parameter");
75+
LOGGER.info("Received " + name + " as GET parameter");
7776

7877
try (PrintWriter out = response.getWriter()) {
79-
out.println("Received " + name + " as GET parameter");
78+
out.println("<html>");
79+
out.println("<head>");
80+
out.println("<title>Ch08_CSRF</title>");
81+
out.println("<link rel=\"stylesheet\" type=\"text/css\" href=\"styles.css\" />");
82+
out.println("</head>");
83+
out.println("<body>");
84+
out.println("<h1>Ch08_CSRF</h1>");
85+
out.println("<p>Received <b>" + name + "</b> as GET parameter.</p>");
86+
out.println("<p><a href=\"requests-protected.jsp\">Back</a></p>");
87+
out.println("</body>");
88+
out.println("</html>");
8089
} catch (IOException ex) {
81-
ex.printStackTrace();
90+
LOGGER.error(ex.getMessage(), ex);
8291
}
8392
}
8493

8594
/**
8695
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
8796
*/
8897
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException {
89-
System.out.println("Processing protected POST request");
98+
LOGGER.info("Processing protected POST request");
9099

91100
response.setContentType("text/html");
92101

93102
try {
94103
if (!CSRFTokenHandler.isValid(request)) {
95-
System.out.println("CSRF token is invalid");
104+
LOGGER.warn("CSRF token is invalid");
96105
response.setStatus(401);
97106

98107
try (PrintWriter out = response.getWriter()) {
99108
out.println("CSRF token is invalid");
100109
} catch (IOException ex) {
101-
ex.printStackTrace();
110+
LOGGER.error(ex.getMessage(), ex);
102111
}
103112

104113
return;
105114
}
106115
} catch (NoSuchAlgorithmException | NoSuchProviderException ex) {
107-
ex.printStackTrace();
116+
LOGGER.error(ex.getMessage(), ex);
108117
}
109-
110-
System.out.println("CSRF token is valid");
118+
119+
LOGGER.info("CSRF token is valid");
111120

112121
String name = request.getParameter("name");
113-
System.out.println("Protected: Received " + name + " as POST parameter");
122+
LOGGER.info("Received " + name + " as POST parameter");
114123

115124
try (PrintWriter out = response.getWriter()) {
116-
out.println("Received " + name + " as POST parameter");
125+
out.println("<html>");
126+
out.println("<head>");
127+
out.println("<title>Ch08_CSRF</title>");
128+
out.println("<link rel=\"stylesheet\" type=\"text/css\" href=\"styles.css\" />");
129+
out.println("</head>");
130+
out.println("<body>");
131+
out.println("<h1>Ch08_CSRF</h1>");
132+
out.println("<p>Received <b>" + name + "</b> as POST parameter.</p>");
133+
out.println("<p><a href=\"requests-protected.jsp\">Back</a></p>");
134+
out.println("</body>");
135+
out.println("</html>");
117136
} catch (IOException ex) {
118-
ex.printStackTrace();
137+
LOGGER.error(ex.getMessage(), ex);
119138
}
120139
}
121140
}

Ch08_CSRF/src/main/java/de/dominikschadow/webappsecurity/csrf/CSRFTokenHandler.java renamed to Ch08_CSRF/src/main/java/de/dominikschadow/webappsecurity/token/CSRFTokenHandler.java

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,19 +16,21 @@
1616
* See the License for the specific language governing permissions and
1717
* limitations under the License.
1818
*/
19-
package de.dominikschadow.webappsecurity.csrf;
19+
package de.dominikschadow.webappsecurity.token;
2020

21-
import java.security.NoSuchAlgorithmException;
22-
import java.security.NoSuchProviderException;
23-
import java.security.SecureRandom;
21+
import org.apache.commons.lang.StringUtils;
2422

2523
import javax.servlet.ServletException;
2624
import javax.servlet.http.HttpServletRequest;
2725
import javax.servlet.http.HttpSession;
28-
29-
import org.apache.commons.lang.StringUtils;
26+
import java.security.NoSuchAlgorithmException;
27+
import java.security.NoSuchProviderException;
28+
import java.security.SecureRandom;
3029

3130
/**
31+
* Calculates a new token and adds it to the session. Compares the session toke value with the
32+
* token value included in the request.
33+
*
3234
* @author Dominik Schadow
3335
*/
3436
public final class CSRFTokenHandler {

‎Ch08_CSRF/src/main/resources/log4j.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="UTF-8" ?>
2+
<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">
3+
<log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/">
4+
<appender name="console" class="org.apache.log4j.ConsoleAppender">
5+
<param name="Target" value="System.out"/>
6+
<layout class="org.apache.log4j.PatternLayout">
7+
<param name="ConversionPattern" value="%-5p %c{1} - %m%n"/>
8+
</layout>
9+
</appender>
10+
11+
<root>
12+
<priority value="info"/>
13+
<appender-ref ref="console"/>
14+
</root>
15+
</log4j:configuration>

‎Ch08_CSRF/src/main/webapp/image-protected.html‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,17 @@
11
<html>
22
<head>
3-
<title>Cross-Site Request Forgery</title>
3+
<title>Ch08_CSRF</title>
4+
<link rel="stylesheet" type="text/css" href="styles.css" />
45
</head>
56
<body>
6-
<h1>GET with an image</h1>
7-
8-
&lt;img src=&quot;ProtectedServlet?name=CSRF-Image&quot; width=&quot;0&quot; height=&quot;0&quot; /&gt;
9-
10-
<img src="ProtectedServlet?name=CSRF-Image" width="0" height="0" />
7+
<h1>Ch08_CSRF</h1>
8+
9+
<h2>GET request executed with a hidden image</h2>
10+
11+
<p>&lt;img src=&quot;ProtectedServlet?name=HiddenImage&quot; width=&quot;0&quot; height=&quot;0&quot; /&gt;</p>
12+
13+
<img src="ProtectedServlet?name=HiddenImage" width="0" height="0" />
14+
15+
<p><a href="requests-protected.jsp">Back</a></p>
1116
</body>
1217
</html>

‎Ch08_CSRF/src/main/webapp/image.html‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,17 @@
11
<html>
22
<head>
3-
<title>Cross-Site Request Forgery</title>
3+
<title>Ch08_CSRF</title>
4+
<link rel="stylesheet" type="text/css" href="styles.css" />
45
</head>
56
<body>
6-
<h1>GET with an image</h1>
7+
<h1>Ch08_CSRF</h1>
8+
9+
<h2>GET request executed with a hidden image</h2>
710

8-
&lt;img src=&quot;CSRFServlet?name=CSRF-Image&quot; width=&quot;0&quot; height=&quot;0&quot; /&gt;
11+
<p>&lt;img src=&quot;CSRFServlet?name=HiddenImage&quot; width=&quot;0&quot; height=&quot;0&quot; /&gt;</p>
912

10-
<img src="CSRFServlet?name=CSRF-Image" width="0" height="0" />
13+
<img src="CSRFServlet?name=HiddenImage" width="0" height="0" />
14+
15+
<p><a href="requests-unprotected.jsp">Back</a></p>
1116
</body>
1217
</html>

0 commit comments

Comments
 (0)