Revert "AXIS2-5992, Admin page, add filtering to HTTP input variables"
This reverts commit 95870b0740b4776281188085d79d1e8016f64ca5.
diff --git a/modules/webapp/conf/ESAPI.properties b/modules/webapp/conf/ESAPI.properties
deleted file mode 100644
index abadd12..0000000
--- a/modules/webapp/conf/ESAPI.properties
+++ /dev/null
@@ -1,2932 +0,0 @@
-
-
-
-
-
-
-<!DOCTYPE html>
-<html lang="en">
- <head>
- <meta charset="utf-8">
- <link rel="dns-prefetch" href="https://github.githubassets.com">
- <link rel="dns-prefetch" href="https://avatars0.githubusercontent.com">
- <link rel="dns-prefetch" href="https://avatars1.githubusercontent.com">
- <link rel="dns-prefetch" href="https://avatars2.githubusercontent.com">
- <link rel="dns-prefetch" href="https://avatars3.githubusercontent.com">
- <link rel="dns-prefetch" href="https://github-cloud.s3.amazonaws.com">
- <link rel="dns-prefetch" href="https://user-images.githubusercontent.com/">
-
-
-
- <link crossorigin="anonymous" media="all" integrity="sha512-K+2SY5WIogVf/13vJ9BeX4zVI7sQjuctb6bSHvfTYr6EjQSM0YWKa9kCnnlZYAbPazx/aK3+IfeU2Q8m0y3ePA==" rel="stylesheet" href="https://github.githubassets.com/assets/frameworks-2bed92639588a2055fff5def27d05e5f.css" />
- <link crossorigin="anonymous" media="all" integrity="sha512-+vE1jwFyeeB/OJsQ0SNmkX8SHwOyVfTi4bH4MJbnJxuzr7BOWmOVIdKLa+UxfbVJo6tX5Uo4xzT3EEkC+tDFVw==" rel="stylesheet" href="https://github.githubassets.com/assets/site-faf1358f017279e07f389b10d1236691.css" />
- <link crossorigin="anonymous" media="all" integrity="sha512-Zxhh7C+KcFbqWUXADidvQ4JIB+REm2XgupIkCq+YhyngxKwhucQo+1FT3bjI8UbQdY7zx3IFkh/n1A1cwQwBDg==" rel="stylesheet" href="https://github.githubassets.com/assets/github-671861ec2f8a7056ea5945c00e276f43.css" />
-
-
-
-
-
- <script crossorigin="anonymous" defer="defer" integrity="sha512-8K2vvwbW+6H27Nad5ydg8PA2/aMD/LKq+EiK9s0U0hhVZxCI2tWBsYk9beAtisRw2j+Or5k2/F+6dk02nmj/PA==" type="application/javascript" src="https://github.githubassets.com/assets/environment-f0adafbf.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-YEtshRLHr+2BeE23dp5rtQdHF4emi1s7HZto12f9a1bGq+ebWp9ScLXgCuLqLJk5ZfwWxORBfBUprys3XHMLHA==" type="application/javascript" src="https://github.githubassets.com/assets/chunk-frameworks-604b6c85.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-AsYa7L3J5bYnuUNrVC1tcCifuOPAby6GuHXmS8QCRbacHT9e6b7iZenxp4Qt/TY2qeMqrdHNHnivAsEKn9e9zw==" type="application/javascript" src="https://github.githubassets.com/assets/chunk-vendor-02c61aec.js"></script>
-
- <script crossorigin="anonymous" defer="defer" integrity="sha512-m2vRq0ZwvgBf9hSv2RnRFjQxubbQeVvdnDNVz0TOIj51Iy6NYl5MKm4U9YB0Da9CqxOYPuQFP8daH2svog+Wjg==" type="application/javascript" src="https://github.githubassets.com/assets/behaviors-9b6bd1ab.js"></script>
-
- <script crossorigin="anonymous" defer="defer" integrity="sha512-P2YMkqfXJOOfxTTkNHbblY5ks3U+e9w9tiVyK9syrE5+JmlaCg1kUiuT1DfbyJXwaOLaRLT3zam2r+QrxTZ3iw==" type="application/javascript" data-module-id="./chunk-contributions-spider-graph.js" data-src="https://github.githubassets.com/assets/chunk-contributions-spider-graph-3f660c92.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-obMR8mPKx8OvqRe34LgnUcxeJ1qujiA4ND3H6UX13ExMlA/WfHLjEzXRmgGRcRvN/8J1nzc+Z+jgz/PLTFy6zg==" type="application/javascript" data-module-id="./chunk-drag-drop.js" data-src="https://github.githubassets.com/assets/chunk-drag-drop-a1b311f2.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-o95wCKfOqL8EX5reoP68bQ/mUPvLnu0T5LaPZLAv0xQALhTP0XqriKBrnmOXbo6BVVM9eNnesNYw8rA37Ta60w==" type="application/javascript" data-module-id="./chunk-jump-to.js" data-src="https://github.githubassets.com/assets/chunk-jump-to-a3de7008.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-tcH4xCRuMBAh1PruDaiwGnRIbHlF6bGLhxyCQ16uqok1cV5QFMguVPWJtN9KI0jGQOgN+Pha3+uOUXhXdfK/qw==" type="application/javascript" data-module-id="./chunk-profile-pins-element.js" data-src="https://github.githubassets.com/assets/chunk-profile-pins-element-b5c1f8c4.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-hUprZmPKGx2Ji0cJJ29yrNBTnfCQoEg+Ow0rEG6bVGXu0HcagYwfPS9a5oRdoqvkE+nSk4FkIaklkLvc7Jb5+g==" type="application/javascript" data-module-id="./chunk-randomColor.js" data-src="https://github.githubassets.com/assets/chunk-randomColor-854a6b66.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-E+H+wAtjiqutBvn2cnXzDIvmasIhYiS7i7JzOfFUwo+Ej8zT54OrJtP//RhwixnypgOpCF4JvqzYy6zOtORDmg==" type="application/javascript" data-module-id="./chunk-runner-groups.js" data-src="https://github.githubassets.com/assets/chunk-runner-groups-13e1fec0.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-pkFKgC9JFth/pgRqBLhELfLOltqYbv+r++HblYEsbFpg7rCimMCN4Q/8RvPYilY0QMGT0q9vlJj1vzzUXYk3Zw==" type="application/javascript" data-module-id="./chunk-sortable-behavior.js" data-src="https://github.githubassets.com/assets/chunk-sortable-behavior-a6414a80.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-HCEY5FUSNmHYIUILB/UYu4Q6dPhLDAtK/MCQibzObiq4PxHpAohvWEf1oTil7Z4uckwsZ8q5VgDlEHJNNJ+tNg==" type="application/javascript" data-module-id="./chunk-tweetsodium.js" data-src="https://github.githubassets.com/assets/chunk-tweetsodium-1c2118e4.js"></script>
- <script crossorigin="anonymous" defer="defer" integrity="sha512-e+30BriXsBu+fb/LGEU9gAzSwn25wRYzDDPpr2AA8jZJI9034xzRHYXjA9XhF+7ncBIGJ/uTD11G25/H0XyuZg==" type="application/javascript" data-module-id="./chunk-user-status-submit.js" data-src="https://github.githubassets.com/assets/chunk-user-status-submit-7bedf406.js"></script>
-
- <script crossorigin="anonymous" defer="defer" integrity="sha512-N0O5xJoLLdo2d6irsQsQgERIRUSntW3Z1rpjUQtKPiNMIGLLIjG3PrrRgLlFgDlAE3wMyfwOHVHzv2eHsjCOtw==" type="application/javascript" src="https://github.githubassets.com/assets/repositories-3743b9c4.js"></script>
-<script crossorigin="anonymous" defer="defer" integrity="sha512-QiBwUGhO4Jv2+dKa60P1uNnbTpouIkJHy8OW9ESCzFNPYUarubjEGJMZbprgBV9m+u6kWlAbQHId8mYadSVTOQ==" type="application/javascript" src="https://github.githubassets.com/assets/diffs-42207050.js"></script>
-
- <meta name="viewport" content="width=device-width">
-
- <title>EJSF/ESAPI.properties at master · OWASP/EJSF · GitHub</title>
- <meta name="description" content="Development of security framework based on Owasp Esapi for JSF2.0 - OWASP/EJSF">
- <link rel="search" type="application/opensearchdescription+xml" href="/opensearch.xml" title="GitHub">
- <link rel="fluid-icon" href="https://github.com/fluidicon.png" title="GitHub">
- <meta property="fb:app_id" content="1401488693436528">
- <meta name="apple-itunes-app" content="app-id=1477376905" />
- <meta name="twitter:image:src" content="https://avatars3.githubusercontent.com/u/155815?s=400&v=4" /><meta name="twitter:site" content="@github" /><meta name="twitter:card" content="summary" /><meta name="twitter:title" content="OWASP/EJSF" /><meta name="twitter:description" content="Development of security framework based on Owasp Esapi for JSF2.0 - OWASP/EJSF" />
- <meta property="og:image" content="https://avatars3.githubusercontent.com/u/155815?s=400&v=4" /><meta property="og:site_name" content="GitHub" /><meta property="og:type" content="object" /><meta property="og:title" content="OWASP/EJSF" /><meta property="og:url" content="https://github.com/OWASP/EJSF" /><meta property="og:description" content="Development of security framework based on Owasp Esapi for JSF2.0 - OWASP/EJSF" />
-
-
-
-
-
- <link rel="assets" href="https://github.githubassets.com/">
-
-
- <meta name="request-id" content="C25E:18B2:1BE4B48:272C905:5FB16322" data-pjax-transient="true"/><meta name="html-safe-nonce" content="56b420672f5595976159657d347e17a0a036b3cc0ef93f95677cef13ff94a3f2" data-pjax-transient="true"/><meta name="visitor-payload" content="eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDMjVFOjE4QjI6MUJFNEI0ODoyNzJDOTA1OjVGQjE2MzIyIiwidmlzaXRvcl9pZCI6IjM2NDI1MDcwNzc1MjQ0ODA4MDIiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==" data-pjax-transient="true"/><meta name="visitor-hmac" content="540c9f05028cda98f739ad6876534624cc744c532b9b158846f0197cd6479251" data-pjax-transient="true"/><meta name="cookie-consent-required" content="false" data-pjax-transient="true"/>
-
- <meta name="hovercard-subject-tag" content="repository:11455034" data-pjax-transient>
-
-
- <meta name="github-keyboard-shortcuts" content="repository,source-code" data-pjax-transient="true" />
-
-
-
- <meta name="selected-link" value="repo_source" data-pjax-transient>
-
- <meta name="google-site-verification" content="c1kuD-K2HIVF635lypcsWPoD4kilo5-jA_wBFyT4uMY">
- <meta name="google-site-verification" content="KT5gs8h0wvaagLKAVWq8bbeNwnZZK1r1XQysX3xurLU">
- <meta name="google-site-verification" content="ZzhVyEFwb7w3e0-uOTltm8Jsck2F5StVihD0exw2fsA">
- <meta name="google-site-verification" content="GXs5KoUUkNCoaAZn7wPN-t01Pywp9M3sEjnt_3_ZWPc">
-
- <meta name="octolytics-host" content="collector.githubapp.com" /><meta name="octolytics-app-id" content="github" /><meta name="octolytics-event-url" content="https://collector.githubapp.com/github-external/browser_event" /><meta name="octolytics-dimension-ga_id" content="" class="js-octo-ga-id" />
-
- <meta name="analytics-location" content="/<user-name>/<repo-name>/blob/show" data-pjax-transient="true" />
-
-
-
-
-
- <meta name="optimizely-datafile" content="{"version": "4", "rollouts": [], "typedAudiences": [], "anonymizeIP": true, "projectId": "16737760170", "variables": [], "featureFlags": [], "experiments": [{"status": "Running", "audienceIds": [], "variations": [{"variables": [], "id": "18630402174", "key": "launchpad"}, {"variables": [], "id": "18866331456", "key": "control"}], "id": "18651193356", "key": "_features_redesign_rollout", "layerId": "18645992876", "trafficAllocation": [{"entityId": "18630402174", "endOfRange": 500}, {"entityId": "18866331456", "endOfRange": 1000}, {"entityId": "18630402174", "endOfRange": 5000}, {"entityId": "18630402174", "endOfRange": 5500}, {"entityId": "18866331456", "endOfRange": 10000}], "forcedVariations": {"143327983.1601483920": "launchpad", "1955030087.1562868941": "launchpad", "1983887325.1550021416": "launchpad", "1947530619.1600461583": "launchpad"}}, {"status": "Running", "audienceIds": [], "variations": [{"variables": [], "id": "19157301901", "key": "launchpad"}, {"variables": [], "id": "19115494094", "key": "control"}], "id": "19139621248", "key": "signup_prompt_launchpad", "layerId": "19159450734", "trafficAllocation": [{"entityId": "19115494094", "endOfRange": 5000}, {"entityId": "19157301901", "endOfRange": 10000}], "forcedVariations": {"262350301.1605284875": "launchpad", "550830608.1557172966": "launchpad"}}], "audiences": [{"conditions": "[\"or\", {\"match\": \"exact\", \"name\": \"$opt_dummy_attribute\", \"type\": \"custom_attribute\", \"value\": \"$opt_dummy_value\"}]", "id": "$opt_dummy_audience", "name": "Optimizely-Generated Audience for Backwards Compatibility"}], "groups": [], "attributes": [{"id": "16822470375", "key": "user_id"}, {"id": "17143601254", "key": "spammy"}, {"id": "18175660309", "key": "organization_plan"}, {"id": "18813001570", "key": "is_logged_in"}, {"id": "19073851829", "key": "geo"}], "botFiltering": false, "accountId": "16737760170", "events": [{"experimentIds": [], "id": "17911811441", "key": "hydro_click.dashboard.teacher_toolbox_cta"}, {"experimentIds": [], "id": "18124116703", "key": "submit.organizations.complete_sign_up"}, {"experimentIds": [], "id": "18145892387", "key": "no_metric.tracked_outside_of_optimizely"}, {"experimentIds": [], "id": "18178755568", "key": "click.org_onboarding_checklist.add_repo"}, {"experimentIds": [], "id": "18180553241", "key": "submit.repository_imports.create"}, {"experimentIds": [], "id": "18186103728", "key": "click.help.learn_more_about_repository_creation"}, {"experimentIds": [], "id": "18188530140", "key": "test_event.do_not_use_in_production"}, {"experimentIds": [], "id": "18191963644", "key": "click.empty_org_repo_cta.transfer_repository"}, {"experimentIds": [], "id": "18195612788", "key": "click.empty_org_repo_cta.import_repository"}, {"experimentIds": [], "id": "18210945499", "key": "click.org_onboarding_checklist.invite_members"}, {"experimentIds": [], "id": "18211063248", "key": "click.empty_org_repo_cta.create_repository"}, {"experimentIds": [], "id": "18215721889", "key": "click.org_onboarding_checklist.update_profile"}, {"experimentIds": [], "id": "18224360785", "key": "click.org_onboarding_checklist.dismiss"}, {"experimentIds": [], "id": "18234832286", "key": "submit.organization_activation.complete"}, {"experimentIds": [], "id": "18252392383", "key": "submit.org_repository.create"}, {"experimentIds": [], "id": "18257551537", "key": "submit.org_member_invitation.create"}, {"experimentIds": [], "id": "18259522260", "key": "submit.organization_profile.update"}, {"experimentIds": [], "id": "18564603625", "key": "view.classroom_select_organization"}, {"experimentIds": [], "id": "18568612016", "key": "click.classroom_sign_in_click"}, {"experimentIds": [], "id": "18572592540", "key": "view.classroom_name"}, {"experimentIds": [], "id": "18574203855", "key": "click.classroom_create_organization"}, {"experimentIds": [], "id": "18582053415", "key": "click.classroom_select_organization"}, {"experimentIds": [], "id": "18589463420", "key": "click.classroom_create_classroom"}, {"experimentIds": [], "id": "18591323364", "key": "click.classroom_create_first_classroom"}, {"experimentIds": [], "id": "18591652321", "key": "click.classroom_grant_access"}, {"experimentIds": [], "id": "18607131425", "key": "view.classroom_creation"}, {"experimentIds": [], "id": "18831680583", "key": "upgrade_account_plan"}, {"experimentIds": ["19139621248"], "id": "19064064515", "key": "click.signup"}, {"experimentIds": [], "id": "19075373687", "key": "click.view_account_billing_page"}, {"experimentIds": ["19139621248"], "id": "19077355841", "key": "click.dismiss_signup_prompt"}, {"experimentIds": [], "id": "19079713938", "key": "click.contact_sales"}, {"experimentIds": [], "id": "19120963070", "key": "click.compare_account_plans"}, {"experimentIds": [], "id": "19151690317", "key": "click.upgrade_account_cta"}], "revision": "319"}" />
- <!-- To prevent page flashing, the optimizely JS needs to be loaded in the
- <head> tag before the DOM renders -->
- <script crossorigin="anonymous" defer="defer" integrity="sha512-8Chj4GzowC8vPZBr3SHdnurKHd/2c9Z32olDHaObaKiAA4TRNtQyCDsdOEngMcawNm9WmlZmhxGpjE5yaqVaDQ==" type="application/javascript" src="https://github.githubassets.com/assets/optimizely-f02863e0.js"></script>
-
-
-
-
-
- <meta name="hostname" content="github.com">
- <meta name="user-login" content="">
-
-
- <meta name="expected-hostname" content="github.com">
-
-
- <meta name="enabled-features" content="MARKETPLACE_PENDING_INSTALLATIONS">
-
- <meta http-equiv="x-pjax-version" content="cd350aa16ef661d633b69b0a2d8f6f2d0950ea7a72e47a1b1a701cbf0c11eb5c">
-
-
- <link href="https://github.com/OWASP/EJSF/commits/master.atom" rel="alternate" title="Recent Commits to EJSF:master" type="application/atom+xml">
-
- <meta name="go-import" content="github.com/OWASP/EJSF git https://github.com/OWASP/EJSF.git">
-
- <meta name="octolytics-dimension-user_id" content="155815" /><meta name="octolytics-dimension-user_login" content="OWASP" /><meta name="octolytics-dimension-repository_id" content="11455034" /><meta name="octolytics-dimension-repository_nwo" content="OWASP/EJSF" /><meta name="octolytics-dimension-repository_public" content="true" /><meta name="octolytics-dimension-repository_is_fork" content="false" /><meta name="octolytics-dimension-repository_network_root_id" content="11455034" /><meta name="octolytics-dimension-repository_network_root_nwo" content="OWASP/EJSF" /><meta name="octolytics-dimension-repository_explore_github_marketplace_ci_cta_shown" content="false" />
-
-
- <link rel="canonical" href="https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties" data-pjax-transient>
-
-
- <meta name="browser-stats-url" content="https://api.github.com/_private/browser/stats">
-
- <meta name="browser-errors-url" content="https://api.github.com/_private/browser/errors">
-
- <meta name="browser-optimizely-client-errors-url" content="https://api.github.com/_private/browser/optimizely_client/errors">
-
- <link rel="mask-icon" href="https://github.githubassets.com/pinned-octocat.svg" color="#000000">
- <link rel="alternate icon" class="js-site-favicon" type="image/png" href="https://github.githubassets.com/favicons/favicon.png">
- <link rel="icon" class="js-site-favicon" type="image/svg+xml" href="https://github.githubassets.com/favicons/favicon.svg">
-
-<meta name="theme-color" content="#1e2327">
-
-
- <link rel="manifest" href="/manifest.json" crossOrigin="use-credentials">
-
- </head>
-
- <body class="logged-out env-production page-responsive page-blob">
-
-
- <div class="position-relative js-header-wrapper ">
- <a href="#start-of-content" class="px-2 py-4 bg-blue text-white show-on-focus js-skip-to-content">Skip to content</a>
- <span class="progress-pjax-loader width-full js-pjax-loader-bar Progress position-fixed">
- <span style="background-color: #79b8ff;width: 0%;" class="Progress-item progress-pjax-loader-bar "></span>
-</span>
-
-
-
- <header class="Header-old header-logged-out js-details-container Details position-relative f4 py-2" role="banner">
- <div class="container-xl d-lg-flex flex-items-center p-responsive">
- <div class="d-flex flex-justify-between flex-items-center">
- <a class="mr-4" href="https://github.com/" aria-label="Homepage" data-ga-click="(Logged out) Header, go to homepage, icon:logo-wordmark">
- <svg height="32" class="octicon octicon-mark-github text-white" viewBox="0 0 16 16" version="1.1" width="32" aria-hidden="true"><path fill-rule="evenodd" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"></path></svg>
- </a>
-
- <div class="d-lg-none css-truncate css-truncate-target width-fit p-2">
-
-
- </div>
-
- <div class="d-flex flex-items-center">
- <a href="/join?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fblob%2Fshow&source=header-repo"
- class="d-inline-block d-lg-none f5 text-white no-underline border border-gray-dark rounded-2 px-2 py-1 mr-3 mr-sm-5"
- data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="a30b80f10ff3d11b156827ff483acb3b3d950f7896948e8a15b11a86ad1e6374"
- data-ga-click="Sign up, click to sign up for account, ref_page:/<user-name>/<repo-name>/blob/show;ref_cta:Sign up;ref_loc:header logged out">
- Sign up
- </a>
-
- <button class="btn-link d-lg-none mt-1 js-details-target" type="button" aria-label="Toggle navigation" aria-expanded="false">
- <svg height="24" class="octicon octicon-three-bars text-white" viewBox="0 0 16 16" version="1.1" width="24" aria-hidden="true"><path fill-rule="evenodd" d="M1 2.75A.75.75 0 011.75 2h12.5a.75.75 0 110 1.5H1.75A.75.75 0 011 2.75zm0 5A.75.75 0 011.75 7h12.5a.75.75 0 110 1.5H1.75A.75.75 0 011 7.75zM1.75 12a.75.75 0 100 1.5h12.5a.75.75 0 100-1.5H1.75z"></path></svg>
- </button>
- </div>
- </div>
-
- <div class="HeaderMenu HeaderMenu--logged-out position-fixed top-0 right-0 bottom-0 height-fit position-lg-relative d-lg-flex flex-justify-between flex-items-center flex-auto">
- <div class="d-flex d-lg-none flex-justify-end border-bottom bg-gray-light p-3">
- <button class="btn-link js-details-target" type="button" aria-label="Toggle navigation" aria-expanded="false">
- <svg height="24" class="octicon octicon-x text-gray" viewBox="0 0 24 24" version="1.1" width="24" aria-hidden="true"><path fill-rule="evenodd" d="M5.72 5.72a.75.75 0 011.06 0L12 10.94l5.22-5.22a.75.75 0 111.06 1.06L13.06 12l5.22 5.22a.75.75 0 11-1.06 1.06L12 13.06l-5.22 5.22a.75.75 0 01-1.06-1.06L10.94 12 5.72 6.78a.75.75 0 010-1.06z"></path></svg>
- </button>
- </div>
-
- <nav class="mt-0 px-3 px-lg-0 mb-5 mb-lg-0" aria-label="Global">
- <ul class="d-lg-flex list-style-none">
- <li class="d-block d-lg-flex flex-lg-nowrap flex-lg-items-center border-bottom border-lg-bottom-0 mr-0 mr-lg-3 edge-item-fix position-relative flex-wrap flex-justify-between d-flex flex-items-center ">
- <details class="HeaderMenu-details details-overlay details-reset width-full">
- <summary class="HeaderMenu-summary HeaderMenu-link px-0 py-3 border-0 no-wrap d-block d-lg-inline-block">
- Why GitHub?
- <svg x="0px" y="0px" viewBox="0 0 14 8" xml:space="preserve" fill="none" class="icon-chevon-down-mktg position-absolute position-lg-relative">
- <path d="M1,1l6.2,6L13,1"></path>
- </svg>
- </summary>
- <div class="dropdown-menu flex-auto rounded-1 bg-white px-0 mt-0 pb-4 p-lg-4 position-relative position-lg-absolute left-0 left-lg-n4">
- <a href="/features" class="py-2 lh-condensed-ultra d-block link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Features">Features <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a>
- <ul class="list-style-none f5 pb-3">
- <li class="edge-item-fix"><a href="/features/code-review/" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Code review">Code review</a></li>
- <li class="edge-item-fix"><a href="/features/project-management/" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Project management">Project management</a></li>
- <li class="edge-item-fix"><a href="/features/integrations" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Integrations">Integrations</a></li>
- <li class="edge-item-fix"><a href="/features/actions" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Actions">Actions</a></li>
- <li class="edge-item-fix"><a href="/features/packages" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to GitHub Packages">Packages</a></li>
- <li class="edge-item-fix"><a href="/features/security" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Security">Security</a></li>
- <li class="edge-item-fix"><a href="/features#team-management" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Team management">Team management</a></li>
- <li class="edge-item-fix"><a href="/features#hosting" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Code hosting">Hosting</a></li>
- <li class="edge-item-fix hide-xl"><a href="/mobile" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Mobile">Mobile</a></li>
- </ul>
-
- <ul class="list-style-none mb-0 border-lg-top pt-lg-3">
- <li class="edge-item-fix"><a href="/customer-stories" class="py-2 lh-condensed-ultra d-block no-underline link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Customer stories">Customer stories <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
- <li class="edge-item-fix"><a href="/security" class="py-2 lh-condensed-ultra d-block no-underline link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Security">Security <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
- </ul>
- </div>
- </details>
- </li>
- <li class="border-bottom border-lg-bottom-0 mr-0 mr-lg-3">
- <a href="/team" class="HeaderMenu-link no-underline py-3 d-block d-lg-inline-block" data-ga-click="(Logged out) Header, go to Team">Team</a>
- </li>
- <li class="border-bottom border-lg-bottom-0 mr-0 mr-lg-3">
- <a href="/enterprise" class="HeaderMenu-link no-underline py-3 d-block d-lg-inline-block" data-ga-click="(Logged out) Header, go to Enterprise">Enterprise</a>
- </li>
-
- <li class="d-block d-lg-flex flex-lg-nowrap flex-lg-items-center border-bottom border-lg-bottom-0 mr-0 mr-lg-3 edge-item-fix position-relative flex-wrap flex-justify-between d-flex flex-items-center ">
- <details class="HeaderMenu-details details-overlay details-reset width-full">
- <summary class="HeaderMenu-summary HeaderMenu-link px-0 py-3 border-0 no-wrap d-block d-lg-inline-block">
- Explore
- <svg x="0px" y="0px" viewBox="0 0 14 8" xml:space="preserve" fill="none" class="icon-chevon-down-mktg position-absolute position-lg-relative">
- <path d="M1,1l6.2,6L13,1"></path>
- </svg>
- </summary>
-
- <div class="dropdown-menu flex-auto rounded-1 bg-white px-0 pt-2 pb-0 mt-0 pb-4 p-lg-4 position-relative position-lg-absolute left-0 left-lg-n4">
- <ul class="list-style-none mb-3">
- <li class="edge-item-fix"><a href="/explore" class="py-2 lh-condensed-ultra d-block link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Explore">Explore GitHub <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
- </ul>
-
- <h4 class="text-gray-light text-normal text-mono f5 mb-2 border-lg-top pt-lg-3">Learn & contribute</h4>
- <ul class="list-style-none mb-3">
- <li class="edge-item-fix"><a href="/topics" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Topics">Topics</a></li>
- <li class="edge-item-fix"><a href="/collections" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Collections">Collections</a></li>
- <li class="edge-item-fix"><a href="/trending" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Trending">Trending</a></li>
- <li class="edge-item-fix"><a href="https://lab.github.com/" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Learning lab">Learning Lab</a></li>
- <li class="edge-item-fix"><a href="https://opensource.guide" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Open source guides">Open source guides</a></li>
- </ul>
-
- <h4 class="text-gray-light text-normal text-mono f5 mb-2 border-lg-top pt-lg-3">Connect with others</h4>
- <ul class="list-style-none mb-0">
- <li class="edge-item-fix"><a href="https://github.com/events" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Events">Events</a></li>
- <li class="edge-item-fix"><a href="https://github.community" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Community forum">Community forum</a></li>
- <li class="edge-item-fix"><a href="https://education.github.com" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to GitHub Education">GitHub Education</a></li>
- <li class="edge-item-fix"><a href="https://stars.github.com" class="py-2 pb-0 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to GitHub Stars Program">GitHub Stars program</a></li>
- </ul>
- </div>
- </details>
- </li>
-
- <li class="border-bottom border-lg-bottom-0 mr-0 mr-lg-3">
- <a href="/marketplace" class="HeaderMenu-link no-underline py-3 d-block d-lg-inline-block" data-ga-click="(Logged out) Header, go to Marketplace">Marketplace</a>
- </li>
-
- <li class="d-block d-lg-flex flex-lg-nowrap flex-lg-items-center border-bottom border-lg-bottom-0 mr-0 mr-lg-3 edge-item-fix position-relative flex-wrap flex-justify-between d-flex flex-items-center ">
- <details class="HeaderMenu-details details-overlay details-reset width-full">
- <summary class="HeaderMenu-summary HeaderMenu-link px-0 py-3 border-0 no-wrap d-block d-lg-inline-block">
- Pricing
- <svg x="0px" y="0px" viewBox="0 0 14 8" xml:space="preserve" fill="none" class="icon-chevon-down-mktg position-absolute position-lg-relative">
- <path d="M1,1l6.2,6L13,1"></path>
- </svg>
- </summary>
-
- <div class="dropdown-menu flex-auto rounded-1 bg-white px-0 pt-2 pb-4 mt-0 p-lg-4 position-relative position-lg-absolute left-0 left-lg-n4">
- <a href="/pricing" class="pb-2 lh-condensed-ultra d-block link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Pricing">Plans <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a>
-
- <ul class="list-style-none mb-3">
- <li class="edge-item-fix"><a href="/pricing#feature-comparison" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Compare plans">Compare plans</a></li>
- <li class="edge-item-fix"><a href="https://enterprise.github.com/contact" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Contact Sales">Contact Sales</a></li>
- </ul>
-
- <ul class="list-style-none mb-0 border-lg-top pt-lg-3">
- <li class="edge-item-fix"><a href="/nonprofit" class="py-2 lh-condensed-ultra d-block no-underline link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Nonprofits">Nonprofit <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
- <li class="edge-item-fix"><a href="https://education.github.com" class="py-2 pb-0 lh-condensed-ultra d-block no-underline link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Education">Education <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
- </ul>
- </div>
- </details>
- </li>
- </ul>
- </nav>
-
- <div class="d-lg-flex flex-items-center px-3 px-lg-0 text-center text-lg-left">
- <div class="d-lg-flex mb-3 mb-lg-0">
- <div class="header-search flex-auto js-site-search position-relative flex-self-stretch flex-md-self-auto mb-3 mb-md-0 mr-0 mr-md-3 scoped-search site-scoped-search js-jump-to"
- role="combobox"
- aria-owns="jump-to-results"
- aria-label="Search or jump to"
- aria-haspopup="listbox"
- aria-expanded="false"
->
- <div class="position-relative">
- <!-- '"` --><!-- </textarea></xmp> --></option></form><form class="js-site-search-form" role="search" aria-label="Site" data-scope-type="Repository" data-scope-id="11455034" data-scoped-search-url="/OWASP/EJSF/search" data-unscoped-search-url="/search" action="/OWASP/EJSF/search" accept-charset="UTF-8" method="get">
- <label class="form-control input-sm header-search-wrapper p-0 js-chromeless-input-container header-search-wrapper-jump-to position-relative d-flex flex-justify-between flex-items-center">
- <input type="text"
- class="form-control input-sm header-search-input jump-to-field js-jump-to-field js-site-search-focus js-site-search-field is-clearable"
- data-hotkey="s,/"
- name="q"
- value=""
- placeholder="Search"
- data-unscoped-placeholder="Search GitHub"
- data-scoped-placeholder="Search"
- autocapitalize="off"
- aria-autocomplete="list"
- aria-controls="jump-to-results"
- aria-label="Search"
- data-jump-to-suggestions-path="/_graphql/GetSuggestedNavigationDestinations"
- spellcheck="false"
- autocomplete="off"
- >
- <input type="hidden" data-csrf="true" class="js-data-jump-to-suggestions-path-csrf" value="yJO54Zxy6UcfJVACN2AI6qXtqaNurbX+my/pjIOEJBb/N4qc6Mu3naLT0X5Q6P/MeV6hIdchQPndioSPsqDdtA==" />
- <input type="hidden" class="js-site-search-type-field" name="type" >
- <img src="https://github.githubassets.com/images/search-key-slash.svg" alt="" class="mr-2 header-search-key-slash">
-
- <div class="Box position-absolute overflow-hidden d-none jump-to-suggestions js-jump-to-suggestions-container">
-
-<ul class="d-none js-jump-to-suggestions-template-container">
-
-
-<li class="d-flex flex-justify-start flex-items-center p-0 f5 navigation-item js-navigation-item js-jump-to-suggestion" role="option">
- <a tabindex="-1" class="no-underline d-flex flex-auto flex-items-center jump-to-suggestions-path js-jump-to-suggestion-path js-navigation-open p-2" href="">
- <div class="jump-to-octicon js-jump-to-octicon flex-shrink-0 mr-2 text-center d-none">
- <svg height="16" width="16" class="octicon octicon-repo flex-shrink-0 js-jump-to-octicon-repo d-none" title="Repository" aria-label="Repository" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M2 2.5A2.5 2.5 0 014.5 0h8.75a.75.75 0 01.75.75v12.5a.75.75 0 01-.75.75h-2.5a.75.75 0 110-1.5h1.75v-2h-8a1 1 0 00-.714 1.7.75.75 0 01-1.072 1.05A2.495 2.495 0 012 11.5v-9zm10.5-1V9h-8c-.356 0-.694.074-1 .208V2.5a1 1 0 011-1h8zM5 12.25v3.25a.25.25 0 00.4.2l1.45-1.087a.25.25 0 01.3 0L8.6 15.7a.25.25 0 00.4-.2v-3.25a.25.25 0 00-.25-.25h-3.5a.25.25 0 00-.25.25z"></path></svg>
- <svg height="16" width="16" class="octicon octicon-project flex-shrink-0 js-jump-to-octicon-project d-none" title="Project" aria-label="Project" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M1.75 0A1.75 1.75 0 000 1.75v12.5C0 15.216.784 16 1.75 16h12.5A1.75 1.75 0 0016 14.25V1.75A1.75 1.75 0 0014.25 0H1.75zM1.5 1.75a.25.25 0 01.25-.25h12.5a.25.25 0 01.25.25v12.5a.25.25 0 01-.25.25H1.75a.25.25 0 01-.25-.25V1.75zM11.75 3a.75.75 0 00-.75.75v7.5a.75.75 0 001.5 0v-7.5a.75.75 0 00-.75-.75zm-8.25.75a.75.75 0 011.5 0v5.5a.75.75 0 01-1.5 0v-5.5zM8 3a.75.75 0 00-.75.75v3.5a.75.75 0 001.5 0v-3.5A.75.75 0 008 3z"></path></svg>
- <svg height="16" width="16" class="octicon octicon-search flex-shrink-0 js-jump-to-octicon-search d-none" title="Search" aria-label="Search" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M11.5 7a4.499 4.499 0 11-8.998 0A4.499 4.499 0 0111.5 7zm-.82 4.74a6 6 0 111.06-1.06l3.04 3.04a.75.75 0 11-1.06 1.06l-3.04-3.04z"></path></svg>
- </div>
-
- <img class="avatar mr-2 flex-shrink-0 js-jump-to-suggestion-avatar d-none" alt="" aria-label="Team" src="" width="28" height="28">
-
- <div class="jump-to-suggestion-name js-jump-to-suggestion-name flex-auto overflow-hidden text-left no-wrap css-truncate css-truncate-target">
- </div>
-
- <div class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none js-jump-to-badge-search">
- <span class="js-jump-to-badge-search-text-default d-none" aria-label="in this repository">
- In this repository
- </span>
- <span class="js-jump-to-badge-search-text-global d-none" aria-label="in all of GitHub">
- All GitHub
- </span>
- <span aria-hidden="true" class="d-inline-block ml-1 v-align-middle">↵</span>
- </div>
-
- <div aria-hidden="true" class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none d-on-nav-focus js-jump-to-badge-jump">
- Jump to
- <span class="d-inline-block ml-1 v-align-middle">↵</span>
- </div>
- </a>
-</li>
-
-</ul>
-
-<ul class="d-none js-jump-to-no-results-template-container">
- <li class="d-flex flex-justify-center flex-items-center f5 d-none js-jump-to-suggestion p-2">
- <span class="text-gray">No suggested jump to results</span>
- </li>
-</ul>
-
-<ul id="jump-to-results" role="listbox" class="p-0 m-0 js-navigation-container jump-to-suggestions-results-container js-jump-to-suggestions-results-container">
-
-
-<li class="d-flex flex-justify-start flex-items-center p-0 f5 navigation-item js-navigation-item js-jump-to-scoped-search d-none" role="option">
- <a tabindex="-1" class="no-underline d-flex flex-auto flex-items-center jump-to-suggestions-path js-jump-to-suggestion-path js-navigation-open p-2" href="">
- <div class="jump-to-octicon js-jump-to-octicon flex-shrink-0 mr-2 text-center d-none">
- <svg height="16" width="16" class="octicon octicon-repo flex-shrink-0 js-jump-to-octicon-repo d-none" title="Repository" aria-label="Repository" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M2 2.5A2.5 2.5 0 014.5 0h8.75a.75.75 0 01.75.75v12.5a.75.75 0 01-.75.75h-2.5a.75.75 0 110-1.5h1.75v-2h-8a1 1 0 00-.714 1.7.75.75 0 01-1.072 1.05A2.495 2.495 0 012 11.5v-9zm10.5-1V9h-8c-.356 0-.694.074-1 .208V2.5a1 1 0 011-1h8zM5 12.25v3.25a.25.25 0 00.4.2l1.45-1.087a.25.25 0 01.3 0L8.6 15.7a.25.25 0 00.4-.2v-3.25a.25.25 0 00-.25-.25h-3.5a.25.25 0 00-.25.25z"></path></svg>
- <svg height="16" width="16" class="octicon octicon-project flex-shrink-0 js-jump-to-octicon-project d-none" title="Project" aria-label="Project" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M1.75 0A1.75 1.75 0 000 1.75v12.5C0 15.216.784 16 1.75 16h12.5A1.75 1.75 0 0016 14.25V1.75A1.75 1.75 0 0014.25 0H1.75zM1.5 1.75a.25.25 0 01.25-.25h12.5a.25.25 0 01.25.25v12.5a.25.25 0 01-.25.25H1.75a.25.25 0 01-.25-.25V1.75zM11.75 3a.75.75 0 00-.75.75v7.5a.75.75 0 001.5 0v-7.5a.75.75 0 00-.75-.75zm-8.25.75a.75.75 0 011.5 0v5.5a.75.75 0 01-1.5 0v-5.5zM8 3a.75.75 0 00-.75.75v3.5a.75.75 0 001.5 0v-3.5A.75.75 0 008 3z"></path></svg>
- <svg height="16" width="16" class="octicon octicon-search flex-shrink-0 js-jump-to-octicon-search d-none" title="Search" aria-label="Search" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M11.5 7a4.499 4.499 0 11-8.998 0A4.499 4.499 0 0111.5 7zm-.82 4.74a6 6 0 111.06-1.06l3.04 3.04a.75.75 0 11-1.06 1.06l-3.04-3.04z"></path></svg>
- </div>
-
- <img class="avatar mr-2 flex-shrink-0 js-jump-to-suggestion-avatar d-none" alt="" aria-label="Team" src="" width="28" height="28">
-
- <div class="jump-to-suggestion-name js-jump-to-suggestion-name flex-auto overflow-hidden text-left no-wrap css-truncate css-truncate-target">
- </div>
-
- <div class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none js-jump-to-badge-search">
- <span class="js-jump-to-badge-search-text-default d-none" aria-label="in this repository">
- In this repository
- </span>
- <span class="js-jump-to-badge-search-text-global d-none" aria-label="in all of GitHub">
- All GitHub
- </span>
- <span aria-hidden="true" class="d-inline-block ml-1 v-align-middle">↵</span>
- </div>
-
- <div aria-hidden="true" class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none d-on-nav-focus js-jump-to-badge-jump">
- Jump to
- <span class="d-inline-block ml-1 v-align-middle">↵</span>
- </div>
- </a>
-</li>
-
-
-
-<li class="d-flex flex-justify-start flex-items-center p-0 f5 navigation-item js-navigation-item js-jump-to-global-search d-none" role="option">
- <a tabindex="-1" class="no-underline d-flex flex-auto flex-items-center jump-to-suggestions-path js-jump-to-suggestion-path js-navigation-open p-2" href="">
- <div class="jump-to-octicon js-jump-to-octicon flex-shrink-0 mr-2 text-center d-none">
- <svg height="16" width="16" class="octicon octicon-repo flex-shrink-0 js-jump-to-octicon-repo d-none" title="Repository" aria-label="Repository" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M2 2.5A2.5 2.5 0 014.5 0h8.75a.75.75 0 01.75.75v12.5a.75.75 0 01-.75.75h-2.5a.75.75 0 110-1.5h1.75v-2h-8a1 1 0 00-.714 1.7.75.75 0 01-1.072 1.05A2.495 2.495 0 012 11.5v-9zm10.5-1V9h-8c-.356 0-.694.074-1 .208V2.5a1 1 0 011-1h8zM5 12.25v3.25a.25.25 0 00.4.2l1.45-1.087a.25.25 0 01.3 0L8.6 15.7a.25.25 0 00.4-.2v-3.25a.25.25 0 00-.25-.25h-3.5a.25.25 0 00-.25.25z"></path></svg>
- <svg height="16" width="16" class="octicon octicon-project flex-shrink-0 js-jump-to-octicon-project d-none" title="Project" aria-label="Project" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M1.75 0A1.75 1.75 0 000 1.75v12.5C0 15.216.784 16 1.75 16h12.5A1.75 1.75 0 0016 14.25V1.75A1.75 1.75 0 0014.25 0H1.75zM1.5 1.75a.25.25 0 01.25-.25h12.5a.25.25 0 01.25.25v12.5a.25.25 0 01-.25.25H1.75a.25.25 0 01-.25-.25V1.75zM11.75 3a.75.75 0 00-.75.75v7.5a.75.75 0 001.5 0v-7.5a.75.75 0 00-.75-.75zm-8.25.75a.75.75 0 011.5 0v5.5a.75.75 0 01-1.5 0v-5.5zM8 3a.75.75 0 00-.75.75v3.5a.75.75 0 001.5 0v-3.5A.75.75 0 008 3z"></path></svg>
- <svg height="16" width="16" class="octicon octicon-search flex-shrink-0 js-jump-to-octicon-search d-none" title="Search" aria-label="Search" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M11.5 7a4.499 4.499 0 11-8.998 0A4.499 4.499 0 0111.5 7zm-.82 4.74a6 6 0 111.06-1.06l3.04 3.04a.75.75 0 11-1.06 1.06l-3.04-3.04z"></path></svg>
- </div>
-
- <img class="avatar mr-2 flex-shrink-0 js-jump-to-suggestion-avatar d-none" alt="" aria-label="Team" src="" width="28" height="28">
-
- <div class="jump-to-suggestion-name js-jump-to-suggestion-name flex-auto overflow-hidden text-left no-wrap css-truncate css-truncate-target">
- </div>
-
- <div class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none js-jump-to-badge-search">
- <span class="js-jump-to-badge-search-text-default d-none" aria-label="in this repository">
- In this repository
- </span>
- <span class="js-jump-to-badge-search-text-global d-none" aria-label="in all of GitHub">
- All GitHub
- </span>
- <span aria-hidden="true" class="d-inline-block ml-1 v-align-middle">↵</span>
- </div>
-
- <div aria-hidden="true" class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none d-on-nav-focus js-jump-to-badge-jump">
- Jump to
- <span class="d-inline-block ml-1 v-align-middle">↵</span>
- </div>
- </a>
-</li>
-
-
-</ul>
-
- </div>
- </label>
-</form> </div>
-</div>
-
- </div>
-
- <a href="/login?return_to=%2FOWASP%2FEJSF%2Fblob%2Fmaster%2Fesapi_master_FULL%2FWebContent%2FESAPI.properties"
- class="HeaderMenu-link no-underline mr-3"
- data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header menu","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="a6e6e854e9ae77b41ab529dc460fa2efdbd4a5d843af238b568451c652a23b36"
- data-ga-click="(Logged out) Header, clicked Sign in, text:sign-in">
- Sign in
- </a>
- <a href="/join?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fblob%2Fshow&source=header-repo&source_repo=OWASP%2FEJSF"
- class="HeaderMenu-link d-inline-block no-underline border border-gray-dark rounded-1 px-2 py-1"
- data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header menu","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="a6e6e854e9ae77b41ab529dc460fa2efdbd4a5d843af238b568451c652a23b36"
- data-ga-click="Sign up, click to sign up for account, ref_page:/<user-name>/<repo-name>/blob/show;ref_cta:Sign up;ref_loc:header logged out">
- Sign up
- </a>
- </div>
- </div>
- </div>
-</header>
-
- </div>
-
- <div id="start-of-content" class="show-on-focus"></div>
-
-
-
-
-
- <div data-pjax-replace id="js-flash-container">
-
-
- <template class="js-flash-template">
- <div class="flash flash-full {{ className }}">
- <div class=" px-2" >
- <button class="flash-close js-flash-close" type="button" aria-label="Dismiss this message">
- <svg class="octicon octicon-x" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M3.72 3.72a.75.75 0 011.06 0L8 6.94l3.22-3.22a.75.75 0 111.06 1.06L9.06 8l3.22 3.22a.75.75 0 11-1.06 1.06L8 9.06l-3.22 3.22a.75.75 0 01-1.06-1.06L6.94 8 3.72 4.78a.75.75 0 010-1.06z"></path></svg>
- </button>
-
- <div>{{ message }}</div>
-
- </div>
-</div>
- </template>
-</div>
-
-
-
-
- <include-fragment class="js-notification-shelf-include-fragment" data-base-src="https://github.com/notifications/beta/shelf"></include-fragment>
-
-
-
-
- <div
- class="application-main "
- data-commit-hovercards-enabled
- data-discussion-hovercards-enabled
- data-issue-and-pr-hovercards-enabled
- >
- <div itemscope itemtype="http://schema.org/SoftwareSourceCode" class="">
- <main >
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- <div class="bg-gray-light pt-3 hide-full-screen mb-5">
-
- <div class="d-flex mb-3 px-3 px-md-4 px-lg-5">
-
- <div class="flex-auto min-width-0 width-fit mr-3">
- <h1 class=" d-flex flex-wrap flex-items-center break-word f3 text-normal">
- <svg class="octicon octicon-repo text-gray mr-2" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M2 2.5A2.5 2.5 0 014.5 0h8.75a.75.75 0 01.75.75v12.5a.75.75 0 01-.75.75h-2.5a.75.75 0 110-1.5h1.75v-2h-8a1 1 0 00-.714 1.7.75.75 0 01-1.072 1.05A2.495 2.495 0 012 11.5v-9zm10.5-1V9h-8c-.356 0-.694.074-1 .208V2.5a1 1 0 011-1h8zM5 12.25v3.25a.25.25 0 00.4.2l1.45-1.087a.25.25 0 01.3 0L8.6 15.7a.25.25 0 00.4-.2v-3.25a.25.25 0 00-.25-.25h-3.5a.25.25 0 00-.25.25z"></path></svg>
- <span class="author flex-self-stretch" itemprop="author">
- <a class="url fn" rel="author" data-hovercard-type="organization" data-hovercard-url="/orgs/OWASP/hovercard" href="/OWASP">OWASP</a>
- </span>
- <span class="mx-1 flex-self-stretch color-text-secondary">/</span>
- <strong itemprop="name" class="mr-2 flex-self-stretch">
- <a data-pjax="#js-repo-pjax-container" class="" href="/OWASP/EJSF">EJSF</a>
- </strong>
-
-</h1>
-
-
- </div>
-
- <ul class="pagehead-actions flex-shrink-0 d-none d-md-inline" style="padding: 2px 0;">
-
- <li>
- <a class="tooltipped tooltipped-s btn btn-sm btn-with-count" aria-label="You must be signed in to watch a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"notification subscription menu watch","repository_id":null,"auth_type":"LOG_IN","originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="6d5ac289283db1f5f8ff84659c86c57372b15f20ee2a6a6d23a8e2e17315c4e2" href="/login?return_to=%2FOWASP%2FEJSF">
- <svg class="octicon octicon-eye" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M1.679 7.932c.412-.621 1.242-1.75 2.366-2.717C5.175 4.242 6.527 3.5 8 3.5c1.473 0 2.824.742 3.955 1.715 1.124.967 1.954 2.096 2.366 2.717a.119.119 0 010 .136c-.412.621-1.242 1.75-2.366 2.717C10.825 11.758 9.473 12.5 8 12.5c-1.473 0-2.824-.742-3.955-1.715C2.92 9.818 2.09 8.69 1.679 8.068a.119.119 0 010-.136zM8 2c-1.981 0-3.67.992-4.933 2.078C1.797 5.169.88 6.423.43 7.1a1.619 1.619 0 000 1.798c.45.678 1.367 1.932 2.637 3.024C4.329 13.008 6.019 14 8 14c1.981 0 3.67-.992 4.933-2.078 1.27-1.091 2.187-2.345 2.637-3.023a1.619 1.619 0 000-1.798c-.45-.678-1.367-1.932-2.637-3.023C11.671 2.992 9.981 2 8 2zm0 8a2 2 0 100-4 2 2 0 000 4z"></path></svg>
- Watch
-</a> <a class="social-count" href="/OWASP/EJSF/watchers"
- aria-label="13 users are watching this repository">
- 13
- </a>
-
- </li>
-
- <li>
- <a class="btn btn-sm btn-with-count tooltipped tooltipped-s" aria-label="You must be signed in to star a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"star button","repository_id":11455034,"auth_type":"LOG_IN","originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="d6af0000fe5df0d42738df09ee8ee377b20cdb599dc9c9cbbc49e53625efe75b" href="/login?return_to=%2FOWASP%2FEJSF">
- <svg class="octicon octicon-star v-align-text-bottom" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M8 .25a.75.75 0 01.673.418l1.882 3.815 4.21.612a.75.75 0 01.416 1.279l-3.046 2.97.719 4.192a.75.75 0 01-1.088.791L8 12.347l-3.766 1.98a.75.75 0 01-1.088-.79l.72-4.194L.818 6.374a.75.75 0 01.416-1.28l4.21-.611L7.327.668A.75.75 0 018 .25zm0 2.445L6.615 5.5a.75.75 0 01-.564.41l-3.097.45 2.24 2.184a.75.75 0 01.216.664l-.528 3.084 2.769-1.456a.75.75 0 01.698 0l2.77 1.456-.53-3.084a.75.75 0 01.216-.664l2.24-2.183-3.096-.45a.75.75 0 01-.564-.41L8 2.694v.001z"></path></svg>
- Star
-</a>
- <a class="social-count js-social-count" href="/OWASP/EJSF/stargazers"
- aria-label="9 users starred this repository">
- 9
- </a>
-
- </li>
-
- <li>
- <a class="btn btn-sm btn-with-count tooltipped tooltipped-s" aria-label="You must be signed in to fork a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"repo details fork button","repository_id":11455034,"auth_type":"LOG_IN","originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="7545c2aa722fe4cbf1b057eb32c8362af1abee3103c76571c54d1b0dc471ba4d" href="/login?return_to=%2FOWASP%2FEJSF">
- <svg class="octicon octicon-repo-forked" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M5 3.25a.75.75 0 11-1.5 0 .75.75 0 011.5 0zm0 2.122a2.25 2.25 0 10-1.5 0v.878A2.25 2.25 0 005.75 8.5h1.5v2.128a2.251 2.251 0 101.5 0V8.5h1.5a2.25 2.25 0 002.25-2.25v-.878a2.25 2.25 0 10-1.5 0v.878a.75.75 0 01-.75.75h-4.5A.75.75 0 015 6.25v-.878zm3.75 7.378a.75.75 0 11-1.5 0 .75.75 0 011.5 0zm3-8.75a.75.75 0 100-1.5.75.75 0 000 1.5z"></path></svg>
- Fork
-</a>
- <a href="/OWASP/EJSF/network/members" class="social-count"
- aria-label="87 users forked this repository">
- 87
- </a>
- </li>
-</ul>
-
- </div>
-
-<nav aria-label="Repository" data-pjax="#js-repo-pjax-container" class="js-repo-nav js-sidenav-container-pjax js-responsive-underlinenav overflow-hidden UnderlineNav px-3 px-md-4 px-lg-5 bg-gray-light">
- <ul class="UnderlineNav-body list-style-none ">
- <li class="d-flex">
- <a class="js-selected-navigation-item selected UnderlineNav-item hx_underlinenav-item no-wrap js-responsive-underlinenav-item" data-tab-item="code-tab" data-hotkey="g c" data-ga-click="Repository, Navigation click, Code tab" aria-current="page" data-selected-links="repo_source repo_downloads repo_commits repo_releases repo_tags repo_branches repo_packages repo_deployments /OWASP/EJSF" href="/OWASP/EJSF">
- <svg class="octicon octicon-code UnderlineNav-octicon d-none d-sm-inline" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M4.72 3.22a.75.75 0 011.06 1.06L2.06 8l3.72 3.72a.75.75 0 11-1.06 1.06L.47 8.53a.75.75 0 010-1.06l4.25-4.25zm6.56 0a.75.75 0 10-1.06 1.06L13.94 8l-3.72 3.72a.75.75 0 101.06 1.06l4.25-4.25a.75.75 0 000-1.06l-4.25-4.25z"></path></svg>
- <span data-content="Code">Code</span>
- <span title="Not available" class="Counter "></span>
-</a> </li>
- <li class="d-flex">
- <a class="js-selected-navigation-item UnderlineNav-item hx_underlinenav-item no-wrap js-responsive-underlinenav-item" data-tab-item="issues-tab" data-hotkey="g i" data-ga-click="Repository, Navigation click, Issues tab" data-selected-links="repo_issues repo_labels repo_milestones /OWASP/EJSF/issues" href="/OWASP/EJSF/issues">
- <svg class="octicon octicon-issue-opened UnderlineNav-octicon d-none d-sm-inline" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M8 1.5a6.5 6.5 0 100 13 6.5 6.5 0 000-13zM0 8a8 8 0 1116 0A8 8 0 010 8zm9 3a1 1 0 11-2 0 1 1 0 012 0zm-.25-6.25a.75.75 0 00-1.5 0v3.5a.75.75 0 001.5 0v-3.5z"></path></svg>
- <span data-content="Issues">Issues</span>
- <span title="0" hidden="hidden" class="Counter ">0</span>
-</a> </li>
- <li class="d-flex">
- <a class="js-selected-navigation-item UnderlineNav-item hx_underlinenav-item no-wrap js-responsive-underlinenav-item" data-tab-item="pull-requests-tab" data-hotkey="g p" data-ga-click="Repository, Navigation click, Pull requests tab" data-selected-links="repo_pulls checks /OWASP/EJSF/pulls" href="/OWASP/EJSF/pulls">
- <svg class="octicon octicon-git-pull-request UnderlineNav-octicon d-none d-sm-inline" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M7.177 3.073L9.573.677A.25.25 0 0110 .854v4.792a.25.25 0 01-.427.177L7.177 3.427a.25.25 0 010-.354zM3.75 2.5a.75.75 0 100 1.5.75.75 0 000-1.5zm-2.25.75a2.25 2.25 0 113 2.122v5.256a2.251 2.251 0 11-1.5 0V5.372A2.25 2.25 0 011.5 3.25zM11 2.5h-1V4h1a1 1 0 011 1v5.628a2.251 2.251 0 101.5 0V5A2.5 2.5 0 0011 2.5zm1 10.25a.75.75 0 111.5 0 .75.75 0 01-1.5 0zM3.75 12a.75.75 0 100 1.5.75.75 0 000-1.5z"></path></svg>
- <span data-content="Pull requests">Pull requests</span>
- <span title="1" class="Counter ">1</span>
-</a> </li>
- <li class="d-flex">
- <a class="js-selected-navigation-item UnderlineNav-item hx_underlinenav-item no-wrap js-responsive-underlinenav-item" data-tab-item="actions-tab" data-hotkey="g a" data-ga-click="Repository, Navigation click, Actions tab" data-selected-links="repo_actions /OWASP/EJSF/actions" href="/OWASP/EJSF/actions">
- <svg class="octicon octicon-play UnderlineNav-octicon d-none d-sm-inline" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M1.5 8a6.5 6.5 0 1113 0 6.5 6.5 0 01-13 0zM8 0a8 8 0 100 16A8 8 0 008 0zM6.379 5.227A.25.25 0 006 5.442v5.117a.25.25 0 00.379.214l4.264-2.559a.25.25 0 000-.428L6.379 5.227z"></path></svg>
- <span data-content="Actions">Actions</span>
- <span title="Not available" class="Counter "></span>
-</a> </li>
- <li class="d-flex">
- <a class="js-selected-navigation-item UnderlineNav-item hx_underlinenav-item no-wrap js-responsive-underlinenav-item" data-tab-item="projects-tab" data-hotkey="g b" data-ga-click="Repository, Navigation click, Projects tab" data-selected-links="repo_projects new_repo_project repo_project /OWASP/EJSF/projects" href="/OWASP/EJSF/projects">
- <svg class="octicon octicon-project UnderlineNav-octicon d-none d-sm-inline" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M1.75 0A1.75 1.75 0 000 1.75v12.5C0 15.216.784 16 1.75 16h12.5A1.75 1.75 0 0016 14.25V1.75A1.75 1.75 0 0014.25 0H1.75zM1.5 1.75a.25.25 0 01.25-.25h12.5a.25.25 0 01.25.25v12.5a.25.25 0 01-.25.25H1.75a.25.25 0 01-.25-.25V1.75zM11.75 3a.75.75 0 00-.75.75v7.5a.75.75 0 001.5 0v-7.5a.75.75 0 00-.75-.75zm-8.25.75a.75.75 0 011.5 0v5.5a.75.75 0 01-1.5 0v-5.5zM8 3a.75.75 0 00-.75.75v3.5a.75.75 0 001.5 0v-3.5A.75.75 0 008 3z"></path></svg>
- <span data-content="Projects">Projects</span>
- <span title="0" hidden="hidden" class="Counter ">0</span>
-</a> </li>
- <li class="d-flex">
- <a class="js-selected-navigation-item UnderlineNav-item hx_underlinenav-item no-wrap js-responsive-underlinenav-item" data-tab-item="security-tab" data-hotkey="g s" data-ga-click="Repository, Navigation click, Security tab" data-selected-links="security overview alerts policy token_scanning code_scanning /OWASP/EJSF/security" href="/OWASP/EJSF/security">
- <svg class="octicon octicon-shield UnderlineNav-octicon d-none d-sm-inline" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M7.467.133a1.75 1.75 0 011.066 0l5.25 1.68A1.75 1.75 0 0115 3.48V7c0 1.566-.32 3.182-1.303 4.682-.983 1.498-2.585 2.813-5.032 3.855a1.7 1.7 0 01-1.33 0c-2.447-1.042-4.049-2.357-5.032-3.855C1.32 10.182 1 8.566 1 7V3.48a1.75 1.75 0 011.217-1.667l5.25-1.68zm.61 1.429a.25.25 0 00-.153 0l-5.25 1.68a.25.25 0 00-.174.238V7c0 1.358.275 2.666 1.057 3.86.784 1.194 2.121 2.34 4.366 3.297a.2.2 0 00.154 0c2.245-.956 3.582-2.104 4.366-3.298C13.225 9.666 13.5 8.36 13.5 7V3.48a.25.25 0 00-.174-.237l-5.25-1.68zM9 10.5a1 1 0 11-2 0 1 1 0 012 0zm-.25-5.75a.75.75 0 10-1.5 0v3a.75.75 0 001.5 0v-3z"></path></svg>
- <span data-content="Security">Security</span>
- <include-fragment src="/OWASP/EJSF/security/overall-count" accept="text/fragment+html"></include-fragment>
-</a> </li>
- <li class="d-flex">
- <a class="js-selected-navigation-item UnderlineNav-item hx_underlinenav-item no-wrap js-responsive-underlinenav-item" data-tab-item="insights-tab" data-ga-click="Repository, Navigation click, Insights tab" data-selected-links="repo_graphs repo_contributors dependency_graph dependabot_updates pulse people /OWASP/EJSF/pulse" href="/OWASP/EJSF/pulse">
- <svg class="octicon octicon-graph UnderlineNav-octicon d-none d-sm-inline" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M1.5 1.75a.75.75 0 00-1.5 0v12.5c0 .414.336.75.75.75h14.5a.75.75 0 000-1.5H1.5V1.75zm14.28 2.53a.75.75 0 00-1.06-1.06L10 7.94 7.53 5.47a.75.75 0 00-1.06 0L3.22 8.72a.75.75 0 001.06 1.06L7 7.06l2.47 2.47a.75.75 0 001.06 0l5.25-5.25z"></path></svg>
- <span data-content="Insights">Insights</span>
- <span title="Not available" class="Counter "></span>
-</a> </li>
-
-</ul> <div class="position-absolute right-0 pr-3 pr-md-4 pr-lg-5 js-responsive-underlinenav-overflow" style="visibility:hidden;">
- <details class="details-overlay details-reset position-relative">
- <summary role="button">
- <div class="UnderlineNav-item mr-0 border-0">
- <svg class="octicon octicon-kebab-horizontal" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="M8 9a1.5 1.5 0 100-3 1.5 1.5 0 000 3zM1.5 9a1.5 1.5 0 100-3 1.5 1.5 0 000 3zm13 0a1.5 1.5 0 100-3 1.5 1.5 0 000 3z"></path></svg>
- <span class="sr-only">More</span>
- </div>
-</summary> <div>
- <details-menu role="menu" class="dropdown-menu dropdown-menu-sw ">
-
- <ul>
- <li data-menu-item="code-tab" hidden>
- <a role="menuitem" class="js-selected-navigation-item dropdown-item" data-selected-links=" /OWASP/EJSF" href="/OWASP/EJSF">
- Code
-</a> </li>
- <li data-menu-item="issues-tab" hidden>
- <a role="menuitem" class="js-selected-navigation-item dropdown-item" data-selected-links=" /OWASP/EJSF/issues" href="/OWASP/EJSF/issues">
- Issues
-</a> </li>
- <li data-menu-item="pull-requests-tab" hidden>
- <a role="menuitem" class="js-selected-navigation-item dropdown-item" data-selected-links=" /OWASP/EJSF/pulls" href="/OWASP/EJSF/pulls">
- Pull requests
-</a> </li>
- <li data-menu-item="actions-tab" hidden>
- <a role="menuitem" class="js-selected-navigation-item dropdown-item" data-selected-links=" /OWASP/EJSF/actions" href="/OWASP/EJSF/actions">
- Actions
-</a> </li>
- <li data-menu-item="projects-tab" hidden>
- <a role="menuitem" class="js-selected-navigation-item dropdown-item" data-selected-links=" /OWASP/EJSF/projects" href="/OWASP/EJSF/projects">
- Projects
-</a> </li>
- <li data-menu-item="security-tab" hidden>
- <a role="menuitem" class="js-selected-navigation-item dropdown-item" data-selected-links=" /OWASP/EJSF/security" href="/OWASP/EJSF/security">
- Security
-</a> </li>
- <li data-menu-item="insights-tab" hidden>
- <a role="menuitem" class="js-selected-navigation-item dropdown-item" data-selected-links=" /OWASP/EJSF/pulse" href="/OWASP/EJSF/pulse">
- Insights
-</a> </li>
- </ul>
-
-</details-menu>
-</div></details> </div>
-
-</nav>
- </div>
-
-
-<div class="container-xl clearfix new-discussion-timeline px-3 px-md-4 px-lg-5">
- <div class="repository-content " >
-
-
-
-
-
-
- <a class="d-none js-permalink-shortcut" data-hotkey="y" href="/OWASP/EJSF/blob/6d9178cba389df70407565540688bc9a2fc79ca2/esapi_master_FULL/WebContent/ESAPI.properties">Permalink</a>
-
- <!-- blob contrib key: blob_contributors:v22:1eb9fb81073bb3a786549cf20e767b673ccfad7acab7743dcba768e6643f88dd -->
- <signup-prompt class="signup-prompt-bg rounded-1" data-prompt="signup" hidden>
- <div class="js-control signup-prompt p-4 text-center mb-4 rounded-1">
- <div class="position-relative">
- <button
- type="button"
- class="position-absolute top-0 right-0 btn-link link-gray"
- data-action="click:signup-prompt#dismiss"
- data-ga-click="(Logged out) Sign up prompt, clicked Dismiss, text:dismiss"
- data-optimizely-event="click.dismiss_signup_prompt, 1802080157.1605460771"
- >
- Dismiss
- </button>
- <h3 class="pt-2">Join GitHub today</h3>
- <p class="col-6 mx-auto">GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.</p>
- <a class="btn btn-primary" data-ga-click="(Logged out) Sign up prompt, clicked Sign up, text:sign-up" data-optimizely-event="click.signup, 1802080157.1605460771" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"files signup prompt","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="cc53bd7124c12c7cd4f7e312127c6b1e8574ad7d3f9a337a94200b53a8b9a08d" href="/join?source=prompt-blob-show&source_repo=OWASP%2FEJSF">Sign up</a>
- </div>
- </div>
-
- <div class="js-launchpad position-relative p-4 p-lg-5 mb-4" hidden>
- <div class="d-sm-flex">
- <div class="col-sm-8 col-md-9 col-lg-8">
- <h3 class="h2 lh-condensed mt-sm-1 mt-lg-0">GitHub is where the world builds software</h3>
- <p class="f4 text-gray mt-2 mb-3">Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.</p>
- <div class="d-flex flex-items-center pb-3">
- <a class="btn btn-primary" data-ga-click="(Logged out) Sign up prompt, clicked Sign up, text:sign-up" data-optimizely-event="click.signup, 1802080157.1605460771" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"files signup prompt","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="cc53bd7124c12c7cd4f7e312127c6b1e8574ad7d3f9a337a94200b53a8b9a08d" href="/join?source=prompt-blob-show&source_repo=OWASP%2FEJSF">Sign up for free</a>
- <button
- type="button"
- class="btn-link link-gray ml-3"
- data-action="click:signup-prompt#dismiss"
- data-ga-click="(Logged out) Sign up prompt, clicked Dismiss, text:dismiss"
- data-optimizely-event="click.dismiss_signup_prompt, 1802080157.1605460771"
- >
- Dismiss
- </button>
- </div>
- </div>
- <svg xmlns="http://www.w3.org/2000/svg" fill="none" preserveAspectRatio="none" viewBox="0 0 1680 40" class="d-none d-sm-block position-absolute width-full" style="bottom: -1px;"><path d="M0 40h1680V30S1340 0 840 0 0 30 0 30z" fill="#fff"></path></svg>
-
- <div class="d-none d-sm-block position-absolute col-5 col-md-4 col-lg-3 bottom-0 right-0 mr-lg-5 mb-md-n4">
- <div class="width-full" >
- <svg viewBox="0 0 300 305" class="width-fit">
- <defs>
- <mask id="https___github_githubassets_com_images_modules_site_home_astro-mona-alpha_jpg">
- <image width="300" height="305" href="https://github.githubassets.com/images/modules/site/home/astro-mona-alpha.jpg"></image>
- </mask>
- </defs>
- <image mask="url(#https___github_githubassets_com_images_modules_site_home_astro-mona-alpha_jpg)" width="300" height="305" href="https://github.githubassets.com/images/modules/site/home/astro-mona.jpg"></image>
-</svg>
-
- </div>
- </div>
- </div>
- </div>
- </signup-prompt>
-
-
- <div class="d-flex flex-items-start flex-shrink-0 pb-3 flex-wrap flex-md-nowrap flex-justify-between flex-md-justify-start">
-
-<div class="position-relative">
- <details class="details-reset details-overlay mr-0 mb-0 " id="branch-select-menu">
- <summary class="btn css-truncate"
- data-hotkey="w"
- title="Switch branches or tags">
- <svg class="octicon octicon-git-branch text-gray" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M11.75 2.5a.75.75 0 100 1.5.75.75 0 000-1.5zm-2.25.75a2.25 2.25 0 113 2.122V6A2.5 2.5 0 0110 8.5H6a1 1 0 00-1 1v1.128a2.251 2.251 0 11-1.5 0V5.372a2.25 2.25 0 111.5 0v1.836A2.492 2.492 0 016 7h4a1 1 0 001-1v-.628A2.25 2.25 0 019.5 3.25zM4.25 12a.75.75 0 100 1.5.75.75 0 000-1.5zM3.5 3.25a.75.75 0 111.5 0 .75.75 0 01-1.5 0z"></path></svg>
- <span class="css-truncate-target" data-menu-button>master</span>
- <span class="dropdown-caret"></span>
- </summary>
-
- <details-menu class="SelectMenu SelectMenu--hasFilter" src="/OWASP/EJSF/refs/master/esapi_master_FULL/WebContent/ESAPI.properties?source_action=show&source_controller=blob" preload>
- <div class="SelectMenu-modal">
- <include-fragment class="SelectMenu-loading" aria-label="Menu is loading">
- <svg class="octicon octicon-octoface anim-pulse" height="32" viewBox="0 0 24 24" version="1.1" width="32" aria-hidden="true"><path d="M7.75 11c-.69 0-1.25.56-1.25 1.25v1.5a1.25 1.25 0 102.5 0v-1.5C9 11.56 8.44 11 7.75 11zm1.27 4.5a.469.469 0 01.48-.5h5a.47.47 0 01.48.5c-.116 1.316-.759 2.5-2.98 2.5s-2.864-1.184-2.98-2.5zm7.23-4.5c-.69 0-1.25.56-1.25 1.25v1.5a1.25 1.25 0 102.5 0v-1.5c0-.69-.56-1.25-1.25-1.25z"></path><path fill-rule="evenodd" d="M21.255 3.82a1.725 1.725 0 00-2.141-1.195c-.557.16-1.406.44-2.264.866-.78.386-1.647.93-2.293 1.677A18.442 18.442 0 0012 5c-.93 0-1.784.059-2.569.17-.645-.74-1.505-1.28-2.28-1.664a13.876 13.876 0 00-2.265-.866 1.725 1.725 0 00-2.141 1.196 23.645 23.645 0 00-.69 3.292c-.125.97-.191 2.07-.066 3.112C1.254 11.882 1 13.734 1 15.527 1 19.915 3.13 23 12 23c8.87 0 11-3.053 11-7.473 0-1.794-.255-3.647-.99-5.29.127-1.046.06-2.15-.066-3.125a23.652 23.652 0 00-.689-3.292zM20.5 14c.5 3.5-1.5 6.5-8.5 6.5s-9-3-8.5-6.5c.583-4 3-6 8.5-6s7.928 2 8.5 6z"></path></svg>
- </include-fragment>
- </div>
- </details-menu>
- </details>
-
-</div>
-
- <h2 id="blob-path" class="breadcrumb flex-auto min-width-0 text-normal mx-0 mx-md-3 width-full width-md-auto flex-order-1 flex-md-order-none mt-3 mt-md-0">
- <span class="js-repo-root text-bold"><span class="js-path-segment d-inline-block wb-break-all"><a data-pjax="true" href="/OWASP/EJSF"><span>EJSF</span></a></span></span><span class="separator">/</span><span class="js-path-segment d-inline-block wb-break-all"><a data-pjax="true" href="/OWASP/EJSF/tree/master/esapi_master_FULL"><span>esapi_master_FULL</span></a></span><span class="separator">/</span><span class="js-path-segment d-inline-block wb-break-all"><a data-pjax="true" href="/OWASP/EJSF/tree/master/esapi_master_FULL/WebContent"><span>WebContent</span></a></span><span class="separator">/</span><strong class="final-path">ESAPI.properties</strong>
- </h2>
- <a href="/OWASP/EJSF/find/master"
- class="js-pjax-capture-input btn mr-2 d-none d-md-block"
- data-pjax
- data-hotkey="t">
- Go to file
- </a>
-
- <details id="blob-more-options-details" class="details-overlay details-reset position-relative">
- <summary role="button">
- <svg aria-label="More options" class="octicon octicon-kebab-horizontal" height="16" viewBox="0 0 16 16" version="1.1" width="16" role="img"><path d="M8 9a1.5 1.5 0 100-3 1.5 1.5 0 000 3zM1.5 9a1.5 1.5 0 100-3 1.5 1.5 0 000 3zm13 0a1.5 1.5 0 100-3 1.5 1.5 0 000 3z"></path></svg>
-</summary> <div>
- <ul class="dropdown-menu dropdown-menu-sw">
- <li class="d-block d-md-none">
- <a class="dropdown-item d-flex flex-items-baseline" data-hydro-click="{"event_type":"repository.click","payload":{"target":"FIND_FILE_BUTTON","repository_id":11455034,"originating_url":"https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties","user_id":null}}" data-hydro-click-hmac="40cba32c6a2747592e633771a1c91115ee447535ab4bb9b768faf9b1814973cb" data-ga-click="Repository, find file, location:repo overview" data-hotkey="t" data-pjax="true" href="/OWASP/EJSF/find/master">
- <span class="flex-auto">Go to file</span>
- <span class="text-small text-gray" aria-hidden="true">T</span>
-</a> </li>
- <li data-toggle-for="blob-more-options-details">
- <button type="button" data-toggle-for="jumpto-line-details-dialog" class="btn-link dropdown-item">
- <span class="d-flex flex-items-baseline">
- <span class="flex-auto">Go to line</span>
- <span class="text-small text-gray" aria-hidden="true">L</span>
- </span>
- </button>
- </li>
- <li class="dropdown-divider" role="none"></li>
- <li>
- <clipboard-copy value="esapi_master_FULL/WebContent/ESAPI.properties" class="dropdown-item cursor-pointer" data-toggle-for="blob-more-options-details">
- Copy path
- </clipboard-copy>
- </li>
- </ul>
-</div></details> </div>
-
-
-
- <div class="Box d-flex flex-column flex-shrink-0 mb-3">
-
- <div class="Box-header Box-header--blue Details js-details-container">
- <div class="d-flex flex-items-center">
- <span class="flex-shrink-0 ml-n1 mr-n1 mt-n1 mb-n1">
- <img class="avatar avatar-user" width="24" height="24" alt="" src="https://camo.githubusercontent.com/fca2e669c26625695193872ad7cb76e22a21960c4c213332c584dbd57c8e04b2/68747470733a2f2f312e67726176617461722e636f6d2f6176617461722f62616235313738346164336263343365626636306532356366386564396639373f643d68747470732533412532462532466769746875622e6769746875626173736574732e636f6d253246696d6167657325324667726176617461727325324667726176617461722d757365722d3432302e706e6726723d6726733d313430" data-canonical-src="https://1.gravatar.com/avatar/bab51784ad3bc43ebf60e25cf8ed9f97?d=https%3A%2F%2Fgithub.githubassets.com%2Fimages%2Fgravatars%2Fgravatar-user-420.png&r=g&s=140" />
- </span>
- <div class="flex-1 d-flex flex-items-center ml-3 min-width-0">
- <div class="css-truncate css-truncate-overflow">
- <span class="text-bold link-gray-dark">matts6</span>
-
- <span>
- <a data-pjax="true" title="add esapi full" class="link-gray" href="/OWASP/EJSF/commit/b5f470d38cc66fc5b4b4939af878d63f2e80739d">add esapi full</a>
- </span>
- </div>
-
-
- <span class="ml-2">
- <include-fragment accept="text/fragment+html" src="/OWASP/EJSF/commit/b5f470d38cc66fc5b4b4939af878d63f2e80739d/rollup?direction=e" class="d-inline"></include-fragment>
- </span>
- </div>
- <div class="ml-3 d-flex flex-shrink-0 flex-items-center flex-justify-end text-gray no-wrap">
- <span class="d-none d-md-inline">
- <span>Latest commit</span>
- <a class="text-small text-mono link-gray" href="/OWASP/EJSF/commit/b5f470d38cc66fc5b4b4939af878d63f2e80739d" data-pjax>b5f470d</a>
- <span itemprop="dateModified"><relative-time datetime="2013-10-17T21:38:36Z" class="no-wrap">Oct 17, 2013</relative-time></span>
- </span>
-
- <a data-pjax href="/OWASP/EJSF/commits/master/esapi_master_FULL/WebContent/ESAPI.properties" class="ml-3 no-wrap link-gray-dark no-underline">
- <svg class="octicon octicon-history text-gray" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M1.643 3.143L.427 1.927A.25.25 0 000 2.104V5.75c0 .138.112.25.25.25h3.646a.25.25 0 00.177-.427L2.715 4.215a6.5 6.5 0 11-1.18 4.458.75.75 0 10-1.493.154 8.001 8.001 0 101.6-5.684zM7.75 4a.75.75 0 01.75.75v2.992l2.028.812a.75.75 0 01-.557 1.392l-2.5-1A.75.75 0 017 8.25v-3.5A.75.75 0 017.75 4z"></path></svg>
- <span class="d-none d-sm-inline">
- <strong>History</strong>
- </span>
- </a>
- </div>
- </div>
-
- </div>
-
- <div class="Box-body d-flex flex-items-center flex-auto border-bottom-0 flex-wrap" >
- <details class="details-reset details-overlay details-overlay-dark lh-default text-gray-dark float-left mr-3" id="blob_contributors_box">
- <summary class="link-gray-dark">
- <svg class="octicon octicon-people text-gray" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M5.5 3.5a2 2 0 100 4 2 2 0 000-4zM2 5.5a3.5 3.5 0 115.898 2.549 5.507 5.507 0 013.034 4.084.75.75 0 11-1.482.235 4.001 4.001 0 00-7.9 0 .75.75 0 01-1.482-.236A5.507 5.507 0 013.102 8.05 3.49 3.49 0 012 5.5zM11 4a.75.75 0 100 1.5 1.5 1.5 0 01.666 2.844.75.75 0 00-.416.672v.352a.75.75 0 00.574.73c1.2.289 2.162 1.2 2.522 2.372a.75.75 0 101.434-.44 5.01 5.01 0 00-2.56-3.012A3 3 0 0011 4z"></path></svg>
- <strong>0</strong>
-
- contributors
- </summary>
- <details-dialog
- class="Box Box--overlay d-flex flex-column anim-fade-in fast"
- aria-label="Users who have contributed to this file"
- src="/OWASP/EJSF/contributors-list/master/esapi_master_FULL/WebContent/ESAPI.properties" preload>
- <div class="Box-header">
- <button class="Box-btn-octicon btn-octicon float-right" type="button" aria-label="Close dialog" data-close-dialog>
- <svg class="octicon octicon-x" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M3.72 3.72a.75.75 0 011.06 0L8 6.94l3.22-3.22a.75.75 0 111.06 1.06L9.06 8l3.22 3.22a.75.75 0 11-1.06 1.06L8 9.06l-3.22 3.22a.75.75 0 01-1.06-1.06L6.94 8 3.72 4.78a.75.75 0 010-1.06z"></path></svg>
- </button>
- <h3 class="Box-title">
- Users who have contributed to this file
- </h3>
- </div>
- <include-fragment class="octocat-spinner my-3" aria-label="Loading..."></include-fragment>
- </details-dialog>
- </details>
- </div>
- </div>
-
-
-
-
-
-
- <div class="Box mt-3 position-relative
- ">
-
-<div class="Box-header py-2 d-flex flex-column flex-shrink-0 flex-md-row flex-md-items-center">
- <div class="text-mono f6 flex-auto pr-3 flex-order-2 flex-md-order-1 mt-2 mt-md-0">
-
- 452 lines (413 sloc)
- <span class="file-info-divider"></span>
- 23.9 KB
- </div>
-
- <div class="d-flex py-1 py-md-0 flex-auto flex-order-1 flex-md-order-2 flex-sm-grow-0 flex-justify-between">
-
- <div class="BtnGroup">
- <a href="/OWASP/EJSF/raw/master/esapi_master_FULL/WebContent/ESAPI.properties" id="raw-url" role="button" class="btn btn-sm BtnGroup-item ">Raw</a>
- <a href="/OWASP/EJSF/blame/master/esapi_master_FULL/WebContent/ESAPI.properties" data-hotkey="b" role="button" class="btn js-update-url-with-hash btn-sm BtnGroup-item ">Blame</a>
- </div>
-
- <div>
- <a class="btn-octicon tooltipped tooltipped-nw js-remove-unless-platform"
- data-platforms="windows,mac"
- href="https://desktop.github.com"
- aria-label="Open this file in GitHub Desktop"
- data-ga-click="Repository, open with desktop">
- <svg class="octicon octicon-device-desktop" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M1.75 2.5h12.5a.25.25 0 01.25.25v7.5a.25.25 0 01-.25.25H1.75a.25.25 0 01-.25-.25v-7.5a.25.25 0 01.25-.25zM14.25 1H1.75A1.75 1.75 0 000 2.75v7.5C0 11.216.784 12 1.75 12h3.727c-.1 1.041-.52 1.872-1.292 2.757A.75.75 0 004.75 16h6.5a.75.75 0 00.565-1.243c-.772-.885-1.193-1.716-1.292-2.757h3.727A1.75 1.75 0 0016 10.25v-7.5A1.75 1.75 0 0014.25 1zM9.018 12H6.982a5.72 5.72 0 01-.765 2.5h3.566a5.72 5.72 0 01-.765-2.5z"></path></svg>
- </a>
-
- <a href="/login?return_to=%2FOWASP%2FEJSF%2Fblob%2Fmaster%2Fesapi_master_FULL%2FWebContent%2FESAPI.properties" class="btn-octicon disabled tooltipped tooltipped-nw"
- aria-label="You must be signed in to make or propose changes">
- <svg class="octicon octicon-pencil" height="16" viewBox="0 0 16 16" version="1.1" width="16" aria-hidden="true"><path fill-rule="evenodd" d="M11.013 1.427a1.75 1.75 0 012.474 0l1.086 1.086a1.75 1.75 0 010 2.474l-8.61 8.61c-.21.21-.47.364-.756.445l-3.251.93a.75.75 0 01-.927-.928l.929-3.25a1.75 1.75 0 01.445-.758l8.61-8.61zm1.414 1.06a.25.25 0 00-.354 0L10.811 3.75l1.439 1.44 1.263-1.263a.25.25 0 000-.354l-1.086-1.086zM11.189 6.25L9.75 4.81l-6.286 6.287a.25.25 0 00-.064.108l-.558 1.953 1.953-.558a.249.249 0 00.108-.064l6.286-6.286z"></path></svg>
- </a>
- <a href="/login?return_to=%2FOWASP%2FEJSF%2Fblob%2Fmaster%2Fesapi_master_FULL%2FWebContent%2FESAPI.properties" class="btn-octicon btn-octicon-danger disabled tooltipped tooltipped-nw"
- aria-label="You must be signed in to make or propose changes">
- <svg class="octicon octicon-trashcan" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M6.5 1.75a.25.25 0 01.25-.25h2.5a.25.25 0 01.25.25V3h-3V1.75zm4.5 0V3h2.25a.75.75 0 010 1.5H2.75a.75.75 0 010-1.5H5V1.75C5 .784 5.784 0 6.75 0h2.5C10.216 0 11 .784 11 1.75zM4.496 6.675a.75.75 0 10-1.492.15l.66 6.6A1.75 1.75 0 005.405 15h5.19c.9 0 1.652-.681 1.741-1.576l.66-6.6a.75.75 0 00-1.492-.149l-.66 6.6a.25.25 0 01-.249.225h-5.19a.25.25 0 01-.249-.225l-.66-6.6z"></path></svg>
- </a>
- </div>
- </div>
-</div>
-
-
-
- <div itemprop="text" class="Box-body p-0 blob-wrapper data type-java-properties gist-border-0">
-
-<table class="highlight tab-size js-file-line-container" data-tab-size="8" data-paste-markdown-skip>
- <tr>
- <td id="L1" class="blob-num js-line-number" data-line-number="1"></td>
- <td id="LC1" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L2" class="blob-num js-line-number" data-line-number="2"></td>
- <td id="LC2" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> OWASP Enterprise Security API (ESAPI) Properties file -- PRODUCTION Version</span></td>
- </tr>
- <tr>
- <td id="L3" class="blob-num js-line-number" data-line-number="3"></td>
- <td id="LC3" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> </span></td>
- </tr>
- <tr>
- <td id="L4" class="blob-num js-line-number" data-line-number="4"></td>
- <td id="LC4" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> This file is part of the Open Web Application Security Project (OWASP)</span></td>
- </tr>
- <tr>
- <td id="L5" class="blob-num js-line-number" data-line-number="5"></td>
- <td id="LC5" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Enterprise Security API (ESAPI) project. For details, please see</span></td>
- </tr>
- <tr>
- <td id="L6" class="blob-num js-line-number" data-line-number="6"></td>
- <td id="LC6" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> http://www.owasp.org/index.php/ESAPI.</span></td>
- </tr>
- <tr>
- <td id="L7" class="blob-num js-line-number" data-line-number="7"></td>
- <td id="LC7" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L8" class="blob-num js-line-number" data-line-number="8"></td>
- <td id="LC8" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Copyright (c) 2008,2009 - The OWASP Foundation</span></td>
- </tr>
- <tr>
- <td id="L9" class="blob-num js-line-number" data-line-number="9"></td>
- <td id="LC9" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L10" class="blob-num js-line-number" data-line-number="10"></td>
- <td id="LC10" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> DISCUSS: This may cause a major backwards compatibility issue, etc. but</span></td>
- </tr>
- <tr>
- <td id="L11" class="blob-num js-line-number" data-line-number="11"></td>
- <td id="LC11" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> from a name space perspective, we probably should have prefaced</span></td>
- </tr>
- <tr>
- <td id="L12" class="blob-num js-line-number" data-line-number="12"></td>
- <td id="LC12" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> all the property names with ESAPI or at least OWASP. Otherwise</span></td>
- </tr>
- <tr>
- <td id="L13" class="blob-num js-line-number" data-line-number="13"></td>
- <td id="LC13" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> there could be problems is someone loads this properties file into</span></td>
- </tr>
- <tr>
- <td id="L14" class="blob-num js-line-number" data-line-number="14"></td>
- <td id="LC14" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> the System properties. We could also put this file into the</span></td>
- </tr>
- <tr>
- <td id="L15" class="blob-num js-line-number" data-line-number="15"></td>
- <td id="LC15" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> esapi.jar file (perhaps as a ResourceBundle) and then allow an external</span></td>
- </tr>
- <tr>
- <td id="L16" class="blob-num js-line-number" data-line-number="16"></td>
- <td id="LC16" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI properties be defined that would overwrite these defaults.</span></td>
- </tr>
- <tr>
- <td id="L17" class="blob-num js-line-number" data-line-number="17"></td>
- <td id="LC17" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> That keeps the application's properties relatively simple as usually</span></td>
- </tr>
- <tr>
- <td id="L18" class="blob-num js-line-number" data-line-number="18"></td>
- <td id="LC18" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> they will only want to override a few properties. If looks like we</span></td>
- </tr>
- <tr>
- <td id="L19" class="blob-num js-line-number" data-line-number="19"></td>
- <td id="LC19" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> already support multiple override levels of this in the</span></td>
- </tr>
- <tr>
- <td id="L20" class="blob-num js-line-number" data-line-number="20"></td>
- <td id="LC20" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> DefaultSecurityConfiguration class, but I'm suggesting placing the</span></td>
- </tr>
- <tr>
- <td id="L21" class="blob-num js-line-number" data-line-number="21"></td>
- <td id="LC21" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> defaults in the esapi.jar itself. That way, if the jar is signed,</span></td>
- </tr>
- <tr>
- <td id="L22" class="blob-num js-line-number" data-line-number="22"></td>
- <td id="LC22" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> we could detect if those properties had been tampered with. (The</span></td>
- </tr>
- <tr>
- <td id="L23" class="blob-num js-line-number" data-line-number="23"></td>
- <td id="LC23" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> code to check the jar signatures is pretty simple... maybe 70-90 LOC,</span></td>
- </tr>
- <tr>
- <td id="L24" class="blob-num js-line-number" data-line-number="24"></td>
- <td id="LC24" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> but off course there is an execution penalty (similar to the way</span></td>
- </tr>
- <tr>
- <td id="L25" class="blob-num js-line-number" data-line-number="25"></td>
- <td id="LC25" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> that the separate sunjce.jar used to be when a class from it was</span></td>
- </tr>
- <tr>
- <td id="L26" class="blob-num js-line-number" data-line-number="26"></td>
- <td id="LC26" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> first loaded). Thoughts?</span></td>
- </tr>
- <tr>
- <td id="L27" class="blob-num js-line-number" data-line-number="27"></td>
- <td id="LC27" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>##############################################################################</span></td>
- </tr>
- <tr>
- <td id="L28" class="blob-num js-line-number" data-line-number="28"></td>
- <td id="LC28" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L29" class="blob-num js-line-number" data-line-number="29"></td>
- <td id="LC29" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> WARNING: Operating system protection should be used to lock down the .esapi</span></td>
- </tr>
- <tr>
- <td id="L30" class="blob-num js-line-number" data-line-number="30"></td>
- <td id="LC30" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> resources directory and all the files inside and all the directories all the</span></td>
- </tr>
- <tr>
- <td id="L31" class="blob-num js-line-number" data-line-number="31"></td>
- <td id="LC31" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> way up to the root directory of the file system. Note that if you are using</span></td>
- </tr>
- <tr>
- <td id="L32" class="blob-num js-line-number" data-line-number="32"></td>
- <td id="LC32" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> file-based implementations, that some files may need to be read-write as they</span></td>
- </tr>
- <tr>
- <td id="L33" class="blob-num js-line-number" data-line-number="33"></td>
- <td id="LC33" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> get updated dynamically.</span></td>
- </tr>
- <tr>
- <td id="L34" class="blob-num js-line-number" data-line-number="34"></td>
- <td id="LC34" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L35" class="blob-num js-line-number" data-line-number="35"></td>
- <td id="LC35" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Before using, be sure to update the MasterKey and MasterSalt as described below.</span></td>
- </tr>
- <tr>
- <td id="L36" class="blob-num js-line-number" data-line-number="36"></td>
- <td id="LC36" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> N.B.: If you had stored data that you have previously encrypted with ESAPI 1.4,</span></td>
- </tr>
- <tr>
- <td id="L37" class="blob-num js-line-number" data-line-number="37"></td>
- <td id="LC37" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> you *must* FIRST decrypt it using ESAPI 1.4 and then (if so desired)</span></td>
- </tr>
- <tr>
- <td id="L38" class="blob-num js-line-number" data-line-number="38"></td>
- <td id="LC38" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> re-encrypt it with ESAPI 2.0. If you fail to do this, you will NOT be</span></td>
- </tr>
- <tr>
- <td id="L39" class="blob-num js-line-number" data-line-number="39"></td>
- <td id="LC39" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> able to decrypt your data with ESAPI 2.0.</span></td>
- </tr>
- <tr>
- <td id="L40" class="blob-num js-line-number" data-line-number="40"></td>
- <td id="LC40" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L41" class="blob-num js-line-number" data-line-number="41"></td>
- <td id="LC41" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> YOU HAVE BEEN WARNED!!! More details are in the ESAPI 2.0 Release Notes.</span></td>
- </tr>
- <tr>
- <td id="L42" class="blob-num js-line-number" data-line-number="42"></td>
- <td id="LC42" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L43" class="blob-num js-line-number" data-line-number="43"></td>
- <td id="LC43" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L44" class="blob-num js-line-number" data-line-number="44"></td>
- <td id="LC44" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI Configuration</span></td>
- </tr>
- <tr>
- <td id="L45" class="blob-num js-line-number" data-line-number="45"></td>
- <td id="LC45" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L46" class="blob-num js-line-number" data-line-number="46"></td>
- <td id="LC46" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> If true, then print all the ESAPI properties set here when they are loaded.</span></td>
- </tr>
- <tr>
- <td id="L47" class="blob-num js-line-number" data-line-number="47"></td>
- <td id="LC47" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> If false, they are not printed. Useful to reduce output when running JUnit tests.</span></td>
- </tr>
- <tr>
- <td id="L48" class="blob-num js-line-number" data-line-number="48"></td>
- <td id="LC48" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> If you need to troubleshoot a properties related problem, turning this on may help.</span></td>
- </tr>
- <tr>
- <td id="L49" class="blob-num js-line-number" data-line-number="49"></td>
- <td id="LC49" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> This is 'false' in the src/test/resources/.esapi version. It is 'true' by</span></td>
- </tr>
- <tr>
- <td id="L50" class="blob-num js-line-number" data-line-number="50"></td>
- <td id="LC50" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> default for reasons of backward compatibility with earlier ESAPI versions.</span></td>
- </tr>
- <tr>
- <td id="L51" class="blob-num js-line-number" data-line-number="51"></td>
- <td id="LC51" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.printProperties</span>=<span class="pl-s">true<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L52" class="blob-num js-line-number" data-line-number="52"></td>
- <td id="LC52" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L53" class="blob-num js-line-number" data-line-number="53"></td>
- <td id="LC53" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI is designed to be easily extensible. You can use the reference implementation</span></td>
- </tr>
- <tr>
- <td id="L54" class="blob-num js-line-number" data-line-number="54"></td>
- <td id="LC54" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> or implement your own providers to take advantage of your enterprise's security</span></td>
- </tr>
- <tr>
- <td id="L55" class="blob-num js-line-number" data-line-number="55"></td>
- <td id="LC55" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> infrastructure. The functions in ESAPI are referenced using the ESAPI locator, like:</span></td>
- </tr>
- <tr>
- <td id="L56" class="blob-num js-line-number" data-line-number="56"></td>
- <td id="LC56" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L57" class="blob-num js-line-number" data-line-number="57"></td>
- <td id="LC57" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> String ciphertext =</span></td>
- </tr>
- <tr>
- <td id="L58" class="blob-num js-line-number" data-line-number="58"></td>
- <td id="LC58" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI.encryptor().encrypt("Secret message"); // Deprecated in 2.0</span></td>
- </tr>
- <tr>
- <td id="L59" class="blob-num js-line-number" data-line-number="59"></td>
- <td id="LC59" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> CipherText cipherText =</span></td>
- </tr>
- <tr>
- <td id="L60" class="blob-num js-line-number" data-line-number="60"></td>
- <td id="LC60" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI.encryptor().encrypt(new PlainText("Secret message")); // Preferred</span></td>
- </tr>
- <tr>
- <td id="L61" class="blob-num js-line-number" data-line-number="61"></td>
- <td id="LC61" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L62" class="blob-num js-line-number" data-line-number="62"></td>
- <td id="LC62" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Below you can specify the classname for the provider that you wish to use in your</span></td>
- </tr>
- <tr>
- <td id="L63" class="blob-num js-line-number" data-line-number="63"></td>
- <td id="LC63" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> application. The only requirement is that it implement the appropriate ESAPI interface.</span></td>
- </tr>
- <tr>
- <td id="L64" class="blob-num js-line-number" data-line-number="64"></td>
- <td id="LC64" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> This allows you to switch security implementations in the future without rewriting the</span></td>
- </tr>
- <tr>
- <td id="L65" class="blob-num js-line-number" data-line-number="65"></td>
- <td id="LC65" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> entire application.</span></td>
- </tr>
- <tr>
- <td id="L66" class="blob-num js-line-number" data-line-number="66"></td>
- <td id="LC66" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L67" class="blob-num js-line-number" data-line-number="67"></td>
- <td id="LC67" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ExperimentalAccessController requires ESAPI-AccessControlPolicy.xml in .esapi directory</span></td>
- </tr>
- <tr>
- <td id="L68" class="blob-num js-line-number" data-line-number="68"></td>
- <td id="LC68" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.AccessControl</span>=<span class="pl-s">org.owasp.esapi.reference.DefaultAccessController<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L69" class="blob-num js-line-number" data-line-number="69"></td>
- <td id="LC69" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> FileBasedAuthenticator requires users.txt file in .esapi directory</span></td>
- </tr>
- <tr>
- <td id="L70" class="blob-num js-line-number" data-line-number="70"></td>
- <td id="LC70" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.Authenticator</span>=<span class="pl-s">org.owasp.esapi.reference.FileBasedAuthenticator<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L71" class="blob-num js-line-number" data-line-number="71"></td>
- <td id="LC71" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.Encoder</span>=<span class="pl-s">org.owasp.esapi.reference.DefaultEncoder<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L72" class="blob-num js-line-number" data-line-number="72"></td>
- <td id="LC72" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.Encryptor</span>=<span class="pl-s">org.owasp.esapi.reference.crypto.JavaEncryptor<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L73" class="blob-num js-line-number" data-line-number="73"></td>
- <td id="LC73" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L74" class="blob-num js-line-number" data-line-number="74"></td>
- <td id="LC74" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.Executor</span>=<span class="pl-s">org.owasp.esapi.reference.DefaultExecutor<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L75" class="blob-num js-line-number" data-line-number="75"></td>
- <td id="LC75" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.HTTPUtilities</span>=<span class="pl-s">org.owasp.esapi.reference.DefaultHTTPUtilities<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L76" class="blob-num js-line-number" data-line-number="76"></td>
- <td id="LC76" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.IntrusionDetector</span>=<span class="pl-s">org.owasp.esapi.reference.DefaultIntrusionDetector<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L77" class="blob-num js-line-number" data-line-number="77"></td>
- <td id="LC77" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Log4JFactory Requires log4j.xml or log4j.properties in classpath - http://www.laliluna.de/log4j-tutorial.html</span></td>
- </tr>
- <tr>
- <td id="L78" class="blob-num js-line-number" data-line-number="78"></td>
- <td id="LC78" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.Logger</span>=<span class="pl-s">org.owasp.esapi.reference.Log4JLogFactory<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L79" class="blob-num js-line-number" data-line-number="79"></td>
- <td id="LC79" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>ESAPI.Logger=org.owasp.esapi.reference.JavaLogFactory</span></td>
- </tr>
- <tr>
- <td id="L80" class="blob-num js-line-number" data-line-number="80"></td>
- <td id="LC80" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.Randomizer</span>=<span class="pl-s">org.owasp.esapi.reference.DefaultRandomizer<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L81" class="blob-num js-line-number" data-line-number="81"></td>
- <td id="LC81" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">ESAPI.Validator</span>=<span class="pl-s">org.owasp.esapi.reference.DefaultValidator<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L82" class="blob-num js-line-number" data-line-number="82"></td>
- <td id="LC82" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L83" class="blob-num js-line-number" data-line-number="83"></td>
- <td id="LC83" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L84" class="blob-num js-line-number" data-line-number="84"></td>
- <td id="LC84" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI Authenticator</span></td>
- </tr>
- <tr>
- <td id="L85" class="blob-num js-line-number" data-line-number="85"></td>
- <td id="LC85" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L86" class="blob-num js-line-number" data-line-number="86"></td>
- <td id="LC86" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Authenticator.AllowedLoginAttempts</span>=<span class="pl-s">3<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L87" class="blob-num js-line-number" data-line-number="87"></td>
- <td id="LC87" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Authenticator.MaxOldPasswordHashes</span>=<span class="pl-s">13<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L88" class="blob-num js-line-number" data-line-number="88"></td>
- <td id="LC88" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Authenticator.UsernameParameterName</span>=<span class="pl-s">username<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L89" class="blob-num js-line-number" data-line-number="89"></td>
- <td id="LC89" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Authenticator.PasswordParameterName</span>=<span class="pl-s">password<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L90" class="blob-num js-line-number" data-line-number="90"></td>
- <td id="LC90" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> RememberTokenDuration (in days)</span></td>
- </tr>
- <tr>
- <td id="L91" class="blob-num js-line-number" data-line-number="91"></td>
- <td id="LC91" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Authenticator.RememberTokenDuration</span>=<span class="pl-s">14<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L92" class="blob-num js-line-number" data-line-number="92"></td>
- <td id="LC92" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Session Timeouts (in minutes)</span></td>
- </tr>
- <tr>
- <td id="L93" class="blob-num js-line-number" data-line-number="93"></td>
- <td id="LC93" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Authenticator.IdleTimeoutDuration</span>=<span class="pl-s">20<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L94" class="blob-num js-line-number" data-line-number="94"></td>
- <td id="LC94" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Authenticator.AbsoluteTimeoutDuration</span>=<span class="pl-s">120<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L95" class="blob-num js-line-number" data-line-number="95"></td>
- <td id="LC95" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L96" class="blob-num js-line-number" data-line-number="96"></td>
- <td id="LC96" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L97" class="blob-num js-line-number" data-line-number="97"></td>
- <td id="LC97" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI Encoder</span></td>
- </tr>
- <tr>
- <td id="L98" class="blob-num js-line-number" data-line-number="98"></td>
- <td id="LC98" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L99" class="blob-num js-line-number" data-line-number="99"></td>
- <td id="LC99" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI canonicalizes input before validation to prevent bypassing filters with encoded attacks.</span></td>
- </tr>
- <tr>
- <td id="L100" class="blob-num js-line-number" data-line-number="100"></td>
- <td id="LC100" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Failure to canonicalize input is a very common mistake when implementing validation schemes.</span></td>
- </tr>
- <tr>
- <td id="L101" class="blob-num js-line-number" data-line-number="101"></td>
- <td id="LC101" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Canonicalization is automatic when using the ESAPI Validator, but you can also use the</span></td>
- </tr>
- <tr>
- <td id="L102" class="blob-num js-line-number" data-line-number="102"></td>
- <td id="LC102" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> following code to canonicalize data.</span></td>
- </tr>
- <tr>
- <td id="L103" class="blob-num js-line-number" data-line-number="103"></td>
- <td id="LC103" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L104" class="blob-num js-line-number" data-line-number="104"></td>
- <td id="LC104" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI.Encoder().canonicalize( "%22hello world&#x22;" );</span></td>
- </tr>
- <tr>
- <td id="L105" class="blob-num js-line-number" data-line-number="105"></td>
- <td id="LC105" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> </span></td>
- </tr>
- <tr>
- <td id="L106" class="blob-num js-line-number" data-line-number="106"></td>
- <td id="LC106" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Multiple encoding is when a single encoding format is applied multiple times. Allowing</span></td>
- </tr>
- <tr>
- <td id="L107" class="blob-num js-line-number" data-line-number="107"></td>
- <td id="LC107" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> multiple encoding is strongly discouraged.</span></td>
- </tr>
- <tr>
- <td id="L108" class="blob-num js-line-number" data-line-number="108"></td>
- <td id="LC108" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encoder.AllowMultipleEncoding</span>=<span class="pl-s">false<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L109" class="blob-num js-line-number" data-line-number="109"></td>
- <td id="LC109" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L110" class="blob-num js-line-number" data-line-number="110"></td>
- <td id="LC110" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Mixed encoding is when multiple different encoding formats are applied, or when </span></td>
- </tr>
- <tr>
- <td id="L111" class="blob-num js-line-number" data-line-number="111"></td>
- <td id="LC111" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> multiple formats are nested. Allowing multiple encoding is strongly discouraged.</span></td>
- </tr>
- <tr>
- <td id="L112" class="blob-num js-line-number" data-line-number="112"></td>
- <td id="LC112" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encoder.AllowMixedEncoding</span>=<span class="pl-s">false<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L113" class="blob-num js-line-number" data-line-number="113"></td>
- <td id="LC113" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L114" class="blob-num js-line-number" data-line-number="114"></td>
- <td id="LC114" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> The default list of codecs to apply when canonicalizing untrusted data. The list should include the codecs</span></td>
- </tr>
- <tr>
- <td id="L115" class="blob-num js-line-number" data-line-number="115"></td>
- <td id="LC115" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> for all downstream interpreters or decoders. For example, if the data is likely to end up in a URL, HTML, or</span></td>
- </tr>
- <tr>
- <td id="L116" class="blob-num js-line-number" data-line-number="116"></td>
- <td id="LC116" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> inside JavaScript, then the list of codecs below is appropriate. The order of the list is not terribly important.</span></td>
- </tr>
- <tr>
- <td id="L117" class="blob-num js-line-number" data-line-number="117"></td>
- <td id="LC117" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encoder.DefaultCodecList</span>=<span class="pl-s">HTMLEntityCodec,PercentCodec,JavaScriptCodec<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L118" class="blob-num js-line-number" data-line-number="118"></td>
- <td id="LC118" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L119" class="blob-num js-line-number" data-line-number="119"></td>
- <td id="LC119" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L120" class="blob-num js-line-number" data-line-number="120"></td>
- <td id="LC120" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L121" class="blob-num js-line-number" data-line-number="121"></td>
- <td id="LC121" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI Encryption</span></td>
- </tr>
- <tr>
- <td id="L122" class="blob-num js-line-number" data-line-number="122"></td>
- <td id="LC122" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L123" class="blob-num js-line-number" data-line-number="123"></td>
- <td id="LC123" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> The ESAPI Encryptor provides basic cryptographic functions with a simplified API.</span></td>
- </tr>
- <tr>
- <td id="L124" class="blob-num js-line-number" data-line-number="124"></td>
- <td id="LC124" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> To get started, generate a new key using java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor</span></td>
- </tr>
- <tr>
- <td id="L125" class="blob-num js-line-number" data-line-number="125"></td>
- <td id="LC125" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> There is not currently any support for key rotation, so be careful when changing your key and salt as it</span></td>
- </tr>
- <tr>
- <td id="L126" class="blob-num js-line-number" data-line-number="126"></td>
- <td id="LC126" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> will invalidate all signed, encrypted, and hashed data.</span></td>
- </tr>
- <tr>
- <td id="L127" class="blob-num js-line-number" data-line-number="127"></td>
- <td id="LC127" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L128" class="blob-num js-line-number" data-line-number="128"></td>
- <td id="LC128" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> WARNING: Not all combinations of algorithms and key lengths are supported.</span></td>
- </tr>
- <tr>
- <td id="L129" class="blob-num js-line-number" data-line-number="129"></td>
- <td id="LC129" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> If you choose to use a key length greater than 128, you MUST download the</span></td>
- </tr>
- <tr>
- <td id="L130" class="blob-num js-line-number" data-line-number="130"></td>
- <td id="LC130" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> unlimited strength policy files and install in the lib directory of your JRE/JDK.</span></td>
- </tr>
- <tr>
- <td id="L131" class="blob-num js-line-number" data-line-number="131"></td>
- <td id="LC131" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> See http://java.sun.com/javase/downloads/index.jsp for more information.</span></td>
- </tr>
- <tr>
- <td id="L132" class="blob-num js-line-number" data-line-number="132"></td>
- <td id="LC132" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L133" class="blob-num js-line-number" data-line-number="133"></td>
- <td id="LC133" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Backward compatibility with ESAPI Java 1.4 is supported by the two deprecated API</span></td>
- </tr>
- <tr>
- <td id="L134" class="blob-num js-line-number" data-line-number="134"></td>
- <td id="LC134" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> methods, Encryptor.encrypt(String) and Encryptor.decrypt(String). However, whenever</span></td>
- </tr>
- <tr>
- <td id="L135" class="blob-num js-line-number" data-line-number="135"></td>
- <td id="LC135" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> possible, these methods should be avoided as they use ECB cipher mode, which in almost</span></td>
- </tr>
- <tr>
- <td id="L136" class="blob-num js-line-number" data-line-number="136"></td>
- <td id="LC136" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> all circumstances a poor choice because of it's weakness. CBC cipher mode is the default</span></td>
- </tr>
- <tr>
- <td id="L137" class="blob-num js-line-number" data-line-number="137"></td>
- <td id="LC137" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> for the new Encryptor encrypt / decrypt methods for ESAPI Java 2.0. In general, you</span></td>
- </tr>
- <tr>
- <td id="L138" class="blob-num js-line-number" data-line-number="138"></td>
- <td id="LC138" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> should only use this compatibility setting if you have persistent data encrypted with</span></td>
- </tr>
- <tr>
- <td id="L139" class="blob-num js-line-number" data-line-number="139"></td>
- <td id="LC139" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> version 1.4 and even then, you should ONLY set this compatibility mode UNTIL</span></td>
- </tr>
- <tr>
- <td id="L140" class="blob-num js-line-number" data-line-number="140"></td>
- <td id="LC140" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> you have decrypted all of your old encrypted data and then re-encrypted it with</span></td>
- </tr>
- <tr>
- <td id="L141" class="blob-num js-line-number" data-line-number="141"></td>
- <td id="LC141" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI 2.0 using CBC mode. If you have some reason to mix the deprecated 1.4 mode</span></td>
- </tr>
- <tr>
- <td id="L142" class="blob-num js-line-number" data-line-number="142"></td>
- <td id="LC142" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> with the new 2.0 methods, make sure that you use the same cipher algorithm for both</span></td>
- </tr>
- <tr>
- <td id="L143" class="blob-num js-line-number" data-line-number="143"></td>
- <td id="LC143" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> (256-bit AES was the default for 1.4; 128-bit is the default for 2.0; see below for</span></td>
- </tr>
- <tr>
- <td id="L144" class="blob-num js-line-number" data-line-number="144"></td>
- <td id="LC144" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> more details.) Otherwise, you will have to use the new 2.0 encrypt / decrypt methods</span></td>
- </tr>
- <tr>
- <td id="L145" class="blob-num js-line-number" data-line-number="145"></td>
- <td id="LC145" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> where you can specify a SecretKey. (Note that if you are using the 256-bit AES,</span></td>
- </tr>
- <tr>
- <td id="L146" class="blob-num js-line-number" data-line-number="146"></td>
- <td id="LC146" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> that requires downloading the special jurisdiction policy files mentioned above.)</span></td>
- </tr>
- <tr>
- <td id="L147" class="blob-num js-line-number" data-line-number="147"></td>
- <td id="LC147" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L148" class="blob-num js-line-number" data-line-number="148"></td>
- <td id="LC148" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ***** IMPORTANT: Do NOT forget to replace these with your own values! *****</span></td>
- </tr>
- <tr>
- <td id="L149" class="blob-num js-line-number" data-line-number="149"></td>
- <td id="LC149" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> To calculate these values, you can run:</span></td>
- </tr>
- <tr>
- <td id="L150" class="blob-num js-line-number" data-line-number="150"></td>
- <td id="LC150" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor</span></td>
- </tr>
- <tr>
- <td id="L151" class="blob-num js-line-number" data-line-number="151"></td>
- <td id="LC151" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L152" class="blob-num js-line-number" data-line-number="152"></td>
- <td id="LC152" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.MasterKey</span>=<span class="pl-s">tzfztf56ftv<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L153" class="blob-num js-line-number" data-line-number="153"></td>
- <td id="LC153" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.MasterSalt</span>=<span class="pl-s">123456ztrewq<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L154" class="blob-num js-line-number" data-line-number="154"></td>
- <td id="LC154" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L155" class="blob-num js-line-number" data-line-number="155"></td>
- <td id="LC155" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Provides the default JCE provider that ESAPI will "prefer" for its symmetric</span></td>
- </tr>
- <tr>
- <td id="L156" class="blob-num js-line-number" data-line-number="156"></td>
- <td id="LC156" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> encryption and hashing. (That is it will look to this provider first, but it</span></td>
- </tr>
- <tr>
- <td id="L157" class="blob-num js-line-number" data-line-number="157"></td>
- <td id="LC157" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> will defer to other providers if the requested algorithm is not implemented</span></td>
- </tr>
- <tr>
- <td id="L158" class="blob-num js-line-number" data-line-number="158"></td>
- <td id="LC158" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> by this provider.) If left unset, ESAPI will just use your Java VM's current</span></td>
- </tr>
- <tr>
- <td id="L159" class="blob-num js-line-number" data-line-number="159"></td>
- <td id="LC159" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> preferred JCE provider, which is generally set in the file</span></td>
- </tr>
- <tr>
- <td id="L160" class="blob-num js-line-number" data-line-number="160"></td>
- <td id="LC160" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> "$JAVA_HOME/jre/lib/security/java.security".</span></td>
- </tr>
- <tr>
- <td id="L161" class="blob-num js-line-number" data-line-number="161"></td>
- <td id="LC161" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L162" class="blob-num js-line-number" data-line-number="162"></td>
- <td id="LC162" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> The main intent of this is to allow ESAPI symmetric encryption to be</span></td>
- </tr>
- <tr>
- <td id="L163" class="blob-num js-line-number" data-line-number="163"></td>
- <td id="LC163" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> used with a FIPS 140-2 compliant crypto-module. For details, see the section</span></td>
- </tr>
- <tr>
- <td id="L164" class="blob-num js-line-number" data-line-number="164"></td>
- <td id="LC164" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> "Using ESAPI Symmetric Encryption with FIPS 140-2 Cryptographic Modules" in</span></td>
- </tr>
- <tr>
- <td id="L165" class="blob-num js-line-number" data-line-number="165"></td>
- <td id="LC165" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> the ESAPI 2.0 Symmetric Encryption User Guide, at:</span></td>
- </tr>
- <tr>
- <td id="L166" class="blob-num js-line-number" data-line-number="166"></td>
- <td id="LC166" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/esapi4java-core-2.0-symmetric-crypto-user-guide.html</span></td>
- </tr>
- <tr>
- <td id="L167" class="blob-num js-line-number" data-line-number="167"></td>
- <td id="LC167" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> However, this property also allows you to easily use an alternate JCE provider</span></td>
- </tr>
- <tr>
- <td id="L168" class="blob-num js-line-number" data-line-number="168"></td>
- <td id="LC168" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> such as "Bouncy Castle" without having to make changes to "java.security".</span></td>
- </tr>
- <tr>
- <td id="L169" class="blob-num js-line-number" data-line-number="169"></td>
- <td id="LC169" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> See Javadoc for SecurityProviderLoader for further details. If you wish to use</span></td>
- </tr>
- <tr>
- <td id="L170" class="blob-num js-line-number" data-line-number="170"></td>
- <td id="LC170" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> a provider that is not known to SecurityProviderLoader, you may specify the</span></td>
- </tr>
- <tr>
- <td id="L171" class="blob-num js-line-number" data-line-number="171"></td>
- <td id="LC171" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> fully-qualified class name of the JCE provider class that implements</span></td>
- </tr>
- <tr>
- <td id="L172" class="blob-num js-line-number" data-line-number="172"></td>
- <td id="LC172" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> java.security.Provider. If the name contains a '.', this is interpreted as</span></td>
- </tr>
- <tr>
- <td id="L173" class="blob-num js-line-number" data-line-number="173"></td>
- <td id="LC173" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> a fully-qualified class name that implements java.security.Provider.</span></td>
- </tr>
- <tr>
- <td id="L174" class="blob-num js-line-number" data-line-number="174"></td>
- <td id="LC174" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L175" class="blob-num js-line-number" data-line-number="175"></td>
- <td id="LC175" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> NOTE: Setting this property has the side-effect of changing it in your application</span></td>
- </tr>
- <tr>
- <td id="L176" class="blob-num js-line-number" data-line-number="176"></td>
- <td id="LC176" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> as well, so if you are using JCE in your application directly rather than</span></td>
- </tr>
- <tr>
- <td id="L177" class="blob-num js-line-number" data-line-number="177"></td>
- <td id="LC177" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> through ESAPI (you wouldn't do that, would you? ;-), it will change the</span></td>
- </tr>
- <tr>
- <td id="L178" class="blob-num js-line-number" data-line-number="178"></td>
- <td id="LC178" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> preferred JCE provider there as well.</span></td>
- </tr>
- <tr>
- <td id="L179" class="blob-num js-line-number" data-line-number="179"></td>
- <td id="LC179" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L180" class="blob-num js-line-number" data-line-number="180"></td>
- <td id="LC180" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Default: Keeps the JCE provider set to whatever JVM sets it to.</span></td>
- </tr>
- <tr>
- <td id="L181" class="blob-num js-line-number" data-line-number="181"></td>
- <td id="LC181" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.PreferredJCEProvider</span>=</td>
- </tr>
- <tr>
- <td id="L182" class="blob-num js-line-number" data-line-number="182"></td>
- <td id="LC182" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L183" class="blob-num js-line-number" data-line-number="183"></td>
- <td id="LC183" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> AES is the most widely used and strongest encryption algorithm. This</span></td>
- </tr>
- <tr>
- <td id="L184" class="blob-num js-line-number" data-line-number="184"></td>
- <td id="LC184" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> should agree with your Encryptor.CipherTransformation property.</span></td>
- </tr>
- <tr>
- <td id="L185" class="blob-num js-line-number" data-line-number="185"></td>
- <td id="LC185" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> By default, ESAPI Java 1.4 uses "PBEWithMD5AndDES" and which is</span></td>
- </tr>
- <tr>
- <td id="L186" class="blob-num js-line-number" data-line-number="186"></td>
- <td id="LC186" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> very weak. It is essentially a password-based encryption key, hashed</span></td>
- </tr>
- <tr>
- <td id="L187" class="blob-num js-line-number" data-line-number="187"></td>
- <td id="LC187" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> with MD5 around 1K times and then encrypted with the weak DES algorithm</span></td>
- </tr>
- <tr>
- <td id="L188" class="blob-num js-line-number" data-line-number="188"></td>
- <td id="LC188" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> (56-bits) using ECB mode and an unspecified padding (it is</span></td>
- </tr>
- <tr>
- <td id="L189" class="blob-num js-line-number" data-line-number="189"></td>
- <td id="LC189" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> JCE provider specific, but most likely "NoPadding"). However, 2.0 uses</span></td>
- </tr>
- <tr>
- <td id="L190" class="blob-num js-line-number" data-line-number="190"></td>
- <td id="LC190" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> "AES/CBC/PKCSPadding". If you want to change these, change them here.</span></td>
- </tr>
- <tr>
- <td id="L191" class="blob-num js-line-number" data-line-number="191"></td>
- <td id="LC191" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Warning: This property does not control the default reference implementation for</span></td>
- </tr>
- <tr>
- <td id="L192" class="blob-num js-line-number" data-line-number="192"></td>
- <td id="LC192" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI 2.0 using JavaEncryptor. Also, this property will be dropped</span></td>
- </tr>
- <tr>
- <td id="L193" class="blob-num js-line-number" data-line-number="193"></td>
- <td id="LC193" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> in the future.</span></td>
- </tr>
- <tr>
- <td id="L194" class="blob-num js-line-number" data-line-number="194"></td>
- <td id="LC194" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> @deprecated</span></td>
- </tr>
- <tr>
- <td id="L195" class="blob-num js-line-number" data-line-number="195"></td>
- <td id="LC195" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.EncryptionAlgorithm</span>=<span class="pl-s">AES<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L196" class="blob-num js-line-number" data-line-number="196"></td>
- <td id="LC196" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> For ESAPI Java 2.0 - New encrypt / decrypt methods use this.</span></td>
- </tr>
- <tr>
- <td id="L197" class="blob-num js-line-number" data-line-number="197"></td>
- <td id="LC197" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.CipherTransformation</span>=<span class="pl-s">AES/CBC/PKCS5Padding<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L198" class="blob-num js-line-number" data-line-number="198"></td>
- <td id="LC198" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L199" class="blob-num js-line-number" data-line-number="199"></td>
- <td id="LC199" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Applies to ESAPI 2.0 and later only!</span></td>
- </tr>
- <tr>
- <td id="L200" class="blob-num js-line-number" data-line-number="200"></td>
- <td id="LC200" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Comma-separated list of cipher modes that provide *BOTH*</span></td>
- </tr>
- <tr>
- <td id="L201" class="blob-num js-line-number" data-line-number="201"></td>
- <td id="LC201" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> confidentiality *AND* message authenticity. (NIST refers to such cipher</span></td>
- </tr>
- <tr>
- <td id="L202" class="blob-num js-line-number" data-line-number="202"></td>
- <td id="LC202" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> modes as "combined modes" so that's what we shall call them.) If any of these</span></td>
- </tr>
- <tr>
- <td id="L203" class="blob-num js-line-number" data-line-number="203"></td>
- <td id="LC203" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> cipher modes are used then no MAC is calculated and stored</span></td>
- </tr>
- <tr>
- <td id="L204" class="blob-num js-line-number" data-line-number="204"></td>
- <td id="LC204" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> in the CipherText upon encryption. Likewise, if one of these</span></td>
- </tr>
- <tr>
- <td id="L205" class="blob-num js-line-number" data-line-number="205"></td>
- <td id="LC205" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> cipher modes is used with decryption, no attempt will be made</span></td>
- </tr>
- <tr>
- <td id="L206" class="blob-num js-line-number" data-line-number="206"></td>
- <td id="LC206" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> to validate the MAC contained in the CipherText object regardless</span></td>
- </tr>
- <tr>
- <td id="L207" class="blob-num js-line-number" data-line-number="207"></td>
- <td id="LC207" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> of whether it contains one or not. Since the expectation is that</span></td>
- </tr>
- <tr>
- <td id="L208" class="blob-num js-line-number" data-line-number="208"></td>
- <td id="LC208" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> these cipher modes support support message authenticity already,</span></td>
- </tr>
- <tr>
- <td id="L209" class="blob-num js-line-number" data-line-number="209"></td>
- <td id="LC209" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> injecting a MAC in the CipherText object would be at best redundant.</span></td>
- </tr>
- <tr>
- <td id="L210" class="blob-num js-line-number" data-line-number="210"></td>
- <td id="LC210" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L211" class="blob-num js-line-number" data-line-number="211"></td>
- <td id="LC211" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Note that as of JDK 1.5, the SunJCE provider does not support *any*</span></td>
- </tr>
- <tr>
- <td id="L212" class="blob-num js-line-number" data-line-number="212"></td>
- <td id="LC212" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> of these cipher modes. Of these listed, only GCM and CCM are currently</span></td>
- </tr>
- <tr>
- <td id="L213" class="blob-num js-line-number" data-line-number="213"></td>
- <td id="LC213" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> NIST approved. YMMV for other JCE providers. E.g., Bouncy Castle supports</span></td>
- </tr>
- <tr>
- <td id="L214" class="blob-num js-line-number" data-line-number="214"></td>
- <td id="LC214" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> GCM and CCM with "NoPadding" mode, but not with "PKCS5Padding" or other</span></td>
- </tr>
- <tr>
- <td id="L215" class="blob-num js-line-number" data-line-number="215"></td>
- <td id="LC215" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> padding modes.</span></td>
- </tr>
- <tr>
- <td id="L216" class="blob-num js-line-number" data-line-number="216"></td>
- <td id="LC216" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.cipher_modes.combined_modes</span>=<span class="pl-s">GCM,CCM,IAPM,EAX,OCB,CWC<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L217" class="blob-num js-line-number" data-line-number="217"></td>
- <td id="LC217" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L218" class="blob-num js-line-number" data-line-number="218"></td>
- <td id="LC218" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Applies to ESAPI 2.0 and later only!</span></td>
- </tr>
- <tr>
- <td id="L219" class="blob-num js-line-number" data-line-number="219"></td>
- <td id="LC219" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Additional cipher modes allowed for ESAPI 2.0 encryption. These</span></td>
- </tr>
- <tr>
- <td id="L220" class="blob-num js-line-number" data-line-number="220"></td>
- <td id="LC220" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> cipher modes are in _addition_ to those specified by the property</span></td>
- </tr>
- <tr>
- <td id="L221" class="blob-num js-line-number" data-line-number="221"></td>
- <td id="LC221" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> 'Encryptor.cipher_modes.combined_modes'.</span></td>
- </tr>
- <tr>
- <td id="L222" class="blob-num js-line-number" data-line-number="222"></td>
- <td id="LC222" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Note: We will add support for streaming modes like CFB & OFB once</span></td>
- </tr>
- <tr>
- <td id="L223" class="blob-num js-line-number" data-line-number="223"></td>
- <td id="LC223" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> we add support for 'specified' to the property 'Encryptor.ChooseIVMethod'</span></td>
- </tr>
- <tr>
- <td id="L224" class="blob-num js-line-number" data-line-number="224"></td>
- <td id="LC224" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> (probably in ESAPI 2.1).</span></td>
- </tr>
- <tr>
- <td id="L225" class="blob-num js-line-number" data-line-number="225"></td>
- <td id="LC225" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> DISCUSS: Better name?</span></td>
- </tr>
- <tr>
- <td id="L226" class="blob-num js-line-number" data-line-number="226"></td>
- <td id="LC226" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.cipher_modes.additional_allowed</span>=<span class="pl-s">CBC<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L227" class="blob-num js-line-number" data-line-number="227"></td>
- <td id="LC227" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L228" class="blob-num js-line-number" data-line-number="228"></td>
- <td id="LC228" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> 128-bit is almost always sufficient and appears to be more resistant to</span></td>
- </tr>
- <tr>
- <td id="L229" class="blob-num js-line-number" data-line-number="229"></td>
- <td id="LC229" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> related key attacks than is 256-bit AES. Use '_' to use default key size</span></td>
- </tr>
- <tr>
- <td id="L230" class="blob-num js-line-number" data-line-number="230"></td>
- <td id="LC230" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> for cipher algorithms (where it makes sense because the algorithm supports</span></td>
- </tr>
- <tr>
- <td id="L231" class="blob-num js-line-number" data-line-number="231"></td>
- <td id="LC231" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> a variable key size). Key length must agree to what's provided as the</span></td>
- </tr>
- <tr>
- <td id="L232" class="blob-num js-line-number" data-line-number="232"></td>
- <td id="LC232" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> cipher transformation, otherwise this will be ignored after logging a</span></td>
- </tr>
- <tr>
- <td id="L233" class="blob-num js-line-number" data-line-number="233"></td>
- <td id="LC233" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> warning.</span></td>
- </tr>
- <tr>
- <td id="L234" class="blob-num js-line-number" data-line-number="234"></td>
- <td id="LC234" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L235" class="blob-num js-line-number" data-line-number="235"></td>
- <td id="LC235" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> NOTE: This is what applies BOTH ESAPI 1.4 and 2.0. See warning above about mixing!</span></td>
- </tr>
- <tr>
- <td id="L236" class="blob-num js-line-number" data-line-number="236"></td>
- <td id="LC236" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.EncryptionKeyLength</span>=<span class="pl-s">128<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L237" class="blob-num js-line-number" data-line-number="237"></td>
- <td id="LC237" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L238" class="blob-num js-line-number" data-line-number="238"></td>
- <td id="LC238" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Because 2.0 uses CBC mode by default, it requires an initialization vector (IV).</span></td>
- </tr>
- <tr>
- <td id="L239" class="blob-num js-line-number" data-line-number="239"></td>
- <td id="LC239" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> (All cipher modes except ECB require an IV.) There are two choices: we can either</span></td>
- </tr>
- <tr>
- <td id="L240" class="blob-num js-line-number" data-line-number="240"></td>
- <td id="LC240" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> use a fixed IV known to both parties or allow ESAPI to choose a random IV. While</span></td>
- </tr>
- <tr>
- <td id="L241" class="blob-num js-line-number" data-line-number="241"></td>
- <td id="LC241" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> the IV does not need to be hidden from adversaries, it is important that the</span></td>
- </tr>
- <tr>
- <td id="L242" class="blob-num js-line-number" data-line-number="242"></td>
- <td id="LC242" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> adversary not be allowed to choose it. Also, random IVs are generally much more</span></td>
- </tr>
- <tr>
- <td id="L243" class="blob-num js-line-number" data-line-number="243"></td>
- <td id="LC243" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> secure than fixed IVs. (In fact, it is essential that feed-back cipher modes</span></td>
- </tr>
- <tr>
- <td id="L244" class="blob-num js-line-number" data-line-number="244"></td>
- <td id="LC244" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> such as CFB and OFB use a different IV for each encryption with a given key so</span></td>
- </tr>
- <tr>
- <td id="L245" class="blob-num js-line-number" data-line-number="245"></td>
- <td id="LC245" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> in such cases, random IVs are much preferred. By default, ESAPI 2.0 uses random</span></td>
- </tr>
- <tr>
- <td id="L246" class="blob-num js-line-number" data-line-number="246"></td>
- <td id="LC246" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> IVs. If you wish to use 'fixed' IVs, set 'Encryptor.ChooseIVMethod=fixed' and</span></td>
- </tr>
- <tr>
- <td id="L247" class="blob-num js-line-number" data-line-number="247"></td>
- <td id="LC247" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> uncomment the Encryptor.fixedIV.</span></td>
- </tr>
- <tr>
- <td id="L248" class="blob-num js-line-number" data-line-number="248"></td>
- <td id="LC248" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L249" class="blob-num js-line-number" data-line-number="249"></td>
- <td id="LC249" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Valid values: random|fixed|specified 'specified' not yet implemented; planned for 2.1</span></td>
- </tr>
- <tr>
- <td id="L250" class="blob-num js-line-number" data-line-number="250"></td>
- <td id="LC250" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.ChooseIVMethod</span>=<span class="pl-s">random<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L251" class="blob-num js-line-number" data-line-number="251"></td>
- <td id="LC251" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> If you choose to use a fixed IV, then you must place a fixed IV here that</span></td>
- </tr>
- <tr>
- <td id="L252" class="blob-num js-line-number" data-line-number="252"></td>
- <td id="LC252" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> is known to all others who are sharing your secret key. The format should</span></td>
- </tr>
- <tr>
- <td id="L253" class="blob-num js-line-number" data-line-number="253"></td>
- <td id="LC253" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> be a hex string that is the same length as the cipher block size for the</span></td>
- </tr>
- <tr>
- <td id="L254" class="blob-num js-line-number" data-line-number="254"></td>
- <td id="LC254" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> cipher algorithm that you are using. The following is an *example* for AES</span></td>
- </tr>
- <tr>
- <td id="L255" class="blob-num js-line-number" data-line-number="255"></td>
- <td id="LC255" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> from an AES test vector for AES-128/CBC as described in:</span></td>
- </tr>
- <tr>
- <td id="L256" class="blob-num js-line-number" data-line-number="256"></td>
- <td id="LC256" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> NIST Special Publication 800-38A (2001 Edition)</span></td>
- </tr>
- <tr>
- <td id="L257" class="blob-num js-line-number" data-line-number="257"></td>
- <td id="LC257" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> "Recommendation for Block Cipher Modes of Operation".</span></td>
- </tr>
- <tr>
- <td id="L258" class="blob-num js-line-number" data-line-number="258"></td>
- <td id="LC258" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> (Note that the block size for AES is 16 bytes == 128 bits.)</span></td>
- </tr>
- <tr>
- <td id="L259" class="blob-num js-line-number" data-line-number="259"></td>
- <td id="LC259" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L260" class="blob-num js-line-number" data-line-number="260"></td>
- <td id="LC260" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.fixedIV</span>=<span class="pl-s">0x000102030405060708090a0b0c0d0e0f<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L261" class="blob-num js-line-number" data-line-number="261"></td>
- <td id="LC261" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L262" class="blob-num js-line-number" data-line-number="262"></td>
- <td id="LC262" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Whether or not CipherText should use a message authentication code (MAC) with it.</span></td>
- </tr>
- <tr>
- <td id="L263" class="blob-num js-line-number" data-line-number="263"></td>
- <td id="LC263" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> This prevents an adversary from altering the IV as well as allowing a more</span></td>
- </tr>
- <tr>
- <td id="L264" class="blob-num js-line-number" data-line-number="264"></td>
- <td id="LC264" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> fool-proof way of determining the decryption failed because of an incorrect</span></td>
- </tr>
- <tr>
- <td id="L265" class="blob-num js-line-number" data-line-number="265"></td>
- <td id="LC265" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> key being supplied. This refers to the "separate" MAC calculated and stored</span></td>
- </tr>
- <tr>
- <td id="L266" class="blob-num js-line-number" data-line-number="266"></td>
- <td id="LC266" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> in CipherText, not part of any MAC that is calculated as a result of a</span></td>
- </tr>
- <tr>
- <td id="L267" class="blob-num js-line-number" data-line-number="267"></td>
- <td id="LC267" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> "combined mode" cipher mode.</span></td>
- </tr>
- <tr>
- <td id="L268" class="blob-num js-line-number" data-line-number="268"></td>
- <td id="LC268" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L269" class="blob-num js-line-number" data-line-number="269"></td>
- <td id="LC269" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> If you are using ESAPI with a FIPS 140-2 cryptographic module, you *must* also</span></td>
- </tr>
- <tr>
- <td id="L270" class="blob-num js-line-number" data-line-number="270"></td>
- <td id="LC270" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> set this property to false.</span></td>
- </tr>
- <tr>
- <td id="L271" class="blob-num js-line-number" data-line-number="271"></td>
- <td id="LC271" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.CipherText.useMAC</span>=<span class="pl-s">true<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L272" class="blob-num js-line-number" data-line-number="272"></td>
- <td id="LC272" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L273" class="blob-num js-line-number" data-line-number="273"></td>
- <td id="LC273" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Whether or not the PlainText object may be overwritten and then marked</span></td>
- </tr>
- <tr>
- <td id="L274" class="blob-num js-line-number" data-line-number="274"></td>
- <td id="LC274" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> eligible for garbage collection. If not set, this is still treated as 'true'.</span></td>
- </tr>
- <tr>
- <td id="L275" class="blob-num js-line-number" data-line-number="275"></td>
- <td id="LC275" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.PlainText.overwrite</span>=<span class="pl-s">true<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L276" class="blob-num js-line-number" data-line-number="276"></td>
- <td id="LC276" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L277" class="blob-num js-line-number" data-line-number="277"></td>
- <td id="LC277" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Do not use DES except in a legacy situations. 56-bit is way too small key size.</span></td>
- </tr>
- <tr>
- <td id="L278" class="blob-num js-line-number" data-line-number="278"></td>
- <td id="LC278" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>Encryptor.EncryptionKeyLength=56</span></td>
- </tr>
- <tr>
- <td id="L279" class="blob-num js-line-number" data-line-number="279"></td>
- <td id="LC279" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>Encryptor.EncryptionAlgorithm=DES</span></td>
- </tr>
- <tr>
- <td id="L280" class="blob-num js-line-number" data-line-number="280"></td>
- <td id="LC280" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L281" class="blob-num js-line-number" data-line-number="281"></td>
- <td id="LC281" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> TripleDES is considered strong enough for most purposes.</span></td>
- </tr>
- <tr>
- <td id="L282" class="blob-num js-line-number" data-line-number="282"></td>
- <td id="LC282" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Note: There is also a 112-bit version of DESede. Using the 168-bit version</span></td>
- </tr>
- <tr>
- <td id="L283" class="blob-num js-line-number" data-line-number="283"></td>
- <td id="LC283" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> requires downloading the special jurisdiction policy from Sun.</span></td>
- </tr>
- <tr>
- <td id="L284" class="blob-num js-line-number" data-line-number="284"></td>
- <td id="LC284" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>Encryptor.EncryptionKeyLength=168</span></td>
- </tr>
- <tr>
- <td id="L285" class="blob-num js-line-number" data-line-number="285"></td>
- <td id="LC285" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>Encryptor.EncryptionAlgorithm=DESede</span></td>
- </tr>
- <tr>
- <td id="L286" class="blob-num js-line-number" data-line-number="286"></td>
- <td id="LC286" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L287" class="blob-num js-line-number" data-line-number="287"></td>
- <td id="LC287" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.HashAlgorithm</span>=<span class="pl-s">SHA-512<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L288" class="blob-num js-line-number" data-line-number="288"></td>
- <td id="LC288" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.HashIterations</span>=<span class="pl-s">1024<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L289" class="blob-num js-line-number" data-line-number="289"></td>
- <td id="LC289" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.DigitalSignatureAlgorithm</span>=<span class="pl-s">SHA1withDSA<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L290" class="blob-num js-line-number" data-line-number="290"></td>
- <td id="LC290" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.DigitalSignatureKeyLength</span>=<span class="pl-s">1024<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L291" class="blob-num js-line-number" data-line-number="291"></td>
- <td id="LC291" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.RandomAlgorithm</span>=<span class="pl-s">SHA1PRNG<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L292" class="blob-num js-line-number" data-line-number="292"></td>
- <td id="LC292" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.CharacterEncoding</span>=<span class="pl-s">UTF-8<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L293" class="blob-num js-line-number" data-line-number="293"></td>
- <td id="LC293" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L294" class="blob-num js-line-number" data-line-number="294"></td>
- <td id="LC294" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> This is the Pseudo Random Function (PRF) that ESAPI's Key Derivation Function</span></td>
- </tr>
- <tr>
- <td id="L295" class="blob-num js-line-number" data-line-number="295"></td>
- <td id="LC295" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> (KDF) normally uses. Note this is *only* the PRF used for ESAPI's KDF and</span></td>
- </tr>
- <tr>
- <td id="L296" class="blob-num js-line-number" data-line-number="296"></td>
- <td id="LC296" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> *not* what is used for ESAPI's MAC. (Currently, HmacSHA1 is always used for</span></td>
- </tr>
- <tr>
- <td id="L297" class="blob-num js-line-number" data-line-number="297"></td>
- <td id="LC297" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> the MAC, mostly to keep the overall size at a minimum.)</span></td>
- </tr>
- <tr>
- <td id="L298" class="blob-num js-line-number" data-line-number="298"></td>
- <td id="LC298" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L299" class="blob-num js-line-number" data-line-number="299"></td>
- <td id="LC299" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Currently supported choices for JDK 1.5 and 1.6 are:</span></td>
- </tr>
- <tr>
- <td id="L300" class="blob-num js-line-number" data-line-number="300"></td>
- <td id="LC300" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> HmacSHA1 (160 bits), HmacSHA256 (256 bits), HmacSHA384 (384 bits), and</span></td>
- </tr>
- <tr>
- <td id="L301" class="blob-num js-line-number" data-line-number="301"></td>
- <td id="LC301" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> HmacSHA512 (512 bits).</span></td>
- </tr>
- <tr>
- <td id="L302" class="blob-num js-line-number" data-line-number="302"></td>
- <td id="LC302" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Note that HmacMD5 is *not* supported for the PRF used by the KDF even though</span></td>
- </tr>
- <tr>
- <td id="L303" class="blob-num js-line-number" data-line-number="303"></td>
- <td id="LC303" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> the JDKs support it. See the ESAPI 2.0 Symmetric Encryption User Guide</span></td>
- </tr>
- <tr>
- <td id="L304" class="blob-num js-line-number" data-line-number="304"></td>
- <td id="LC304" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> further details.</span></td>
- </tr>
- <tr>
- <td id="L305" class="blob-num js-line-number" data-line-number="305"></td>
- <td id="LC305" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Encryptor.KDF.PRF</span>=<span class="pl-s">HmacSHA256<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L306" class="blob-num js-line-number" data-line-number="306"></td>
- <td id="LC306" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L307" class="blob-num js-line-number" data-line-number="307"></td>
- <td id="LC307" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI HttpUtilties</span></td>
- </tr>
- <tr>
- <td id="L308" class="blob-num js-line-number" data-line-number="308"></td>
- <td id="LC308" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L309" class="blob-num js-line-number" data-line-number="309"></td>
- <td id="LC309" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> The HttpUtilities provide basic protections to HTTP requests and responses. Primarily these methods </span></td>
- </tr>
- <tr>
- <td id="L310" class="blob-num js-line-number" data-line-number="310"></td>
- <td id="LC310" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> protect against malicious data from attackers, such as unprintable characters, escaped characters,</span></td>
- </tr>
- <tr>
- <td id="L311" class="blob-num js-line-number" data-line-number="311"></td>
- <td id="LC311" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> and other simple attacks. The HttpUtilities also provides utility methods for dealing with cookies,</span></td>
- </tr>
- <tr>
- <td id="L312" class="blob-num js-line-number" data-line-number="312"></td>
- <td id="LC312" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> headers, and CSRF tokens.</span></td>
- </tr>
- <tr>
- <td id="L313" class="blob-num js-line-number" data-line-number="313"></td>
- <td id="LC313" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L314" class="blob-num js-line-number" data-line-number="314"></td>
- <td id="LC314" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Default file upload location (remember to escape backslashes with \\)</span></td>
- </tr>
- <tr>
- <td id="L315" class="blob-num js-line-number" data-line-number="315"></td>
- <td id="LC315" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.UploadDir</span>=<span class="pl-s">C:<span class="pl-cce">\\</span>ESAPI<span class="pl-cce">\\</span>testUpload<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L316" class="blob-num js-line-number" data-line-number="316"></td>
- <td id="LC316" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.UploadTempDir</span>=<span class="pl-s">C:<span class="pl-cce">\\</span>temp<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L317" class="blob-num js-line-number" data-line-number="317"></td>
- <td id="LC317" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Force flags on cookies, if you use HttpUtilities to set cookies</span></td>
- </tr>
- <tr>
- <td id="L318" class="blob-num js-line-number" data-line-number="318"></td>
- <td id="LC318" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.ForceHttpOnlySession</span>=<span class="pl-s">false<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L319" class="blob-num js-line-number" data-line-number="319"></td>
- <td id="LC319" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.ForceSecureSession</span>=<span class="pl-s">false<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L320" class="blob-num js-line-number" data-line-number="320"></td>
- <td id="LC320" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.ForceHttpOnlyCookies</span>=<span class="pl-s">true<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L321" class="blob-num js-line-number" data-line-number="321"></td>
- <td id="LC321" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.ForceSecureCookies</span>=<span class="pl-s">true<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L322" class="blob-num js-line-number" data-line-number="322"></td>
- <td id="LC322" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Maximum size of HTTP headers</span></td>
- </tr>
- <tr>
- <td id="L323" class="blob-num js-line-number" data-line-number="323"></td>
- <td id="LC323" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.MaxHeaderSize</span>=<span class="pl-s">4096<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L324" class="blob-num js-line-number" data-line-number="324"></td>
- <td id="LC324" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> File upload configuration</span></td>
- </tr>
- <tr>
- <td id="L325" class="blob-num js-line-number" data-line-number="325"></td>
- <td id="LC325" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.ApprovedUploadExtensions</span>=<span class="pl-s">.zip,.pdf,.doc,.docx,.ppt,.pptx,.tar,.gz,.tgz,.rar,.war,.jar,.ear,.xls,.rtf,.properties,.java,.class,.txt,.xml,.jsp,.jsf,.exe,.dll<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L326" class="blob-num js-line-number" data-line-number="326"></td>
- <td id="LC326" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.MaxUploadFileBytes</span>=<span class="pl-s">500000000<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L327" class="blob-num js-line-number" data-line-number="327"></td>
- <td id="LC327" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Using UTF-8 throughout your stack is highly recommended. That includes your database driver,</span></td>
- </tr>
- <tr>
- <td id="L328" class="blob-num js-line-number" data-line-number="328"></td>
- <td id="LC328" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> container, and any other technologies you may be using. Failure to do this may expose you</span></td>
- </tr>
- <tr>
- <td id="L329" class="blob-num js-line-number" data-line-number="329"></td>
- <td id="LC329" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> to Unicode transcoding injection attacks. Use of UTF-8 does not hinder internationalization.</span></td>
- </tr>
- <tr>
- <td id="L330" class="blob-num js-line-number" data-line-number="330"></td>
- <td id="LC330" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.ResponseContentType</span>=<span class="pl-s">text/html; charset=UTF-8<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L331" class="blob-num js-line-number" data-line-number="331"></td>
- <td id="LC331" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> This is the name of the cookie used to represent the HTTP session</span></td>
- </tr>
- <tr>
- <td id="L332" class="blob-num js-line-number" data-line-number="332"></td>
- <td id="LC332" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Typically this will be the default "JSESSIONID" </span></td>
- </tr>
- <tr>
- <td id="L333" class="blob-num js-line-number" data-line-number="333"></td>
- <td id="LC333" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">HttpUtilities.HttpSessionIdName</span>=<span class="pl-s">JSESSIONID<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L334" class="blob-num js-line-number" data-line-number="334"></td>
- <td id="LC334" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L335" class="blob-num js-line-number" data-line-number="335"></td>
- <td id="LC335" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L336" class="blob-num js-line-number" data-line-number="336"></td>
- <td id="LC336" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L337" class="blob-num js-line-number" data-line-number="337"></td>
- <td id="LC337" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L338" class="blob-num js-line-number" data-line-number="338"></td>
- <td id="LC338" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI Executor</span></td>
- </tr>
- <tr>
- <td id="L339" class="blob-num js-line-number" data-line-number="339"></td>
- <td id="LC339" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> CHECKME - Not sure what this is used for, but surely it should be made OS independent.</span></td>
- </tr>
- <tr>
- <td id="L340" class="blob-num js-line-number" data-line-number="340"></td>
- <td id="LC340" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Executor.WorkingDirectory</span>=<span class="pl-s">C:<span class="pl-cce">\\</span>Windows<span class="pl-cce">\\</span>Temp<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L341" class="blob-num js-line-number" data-line-number="341"></td>
- <td id="LC341" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Executor.ApprovedExecutables</span>=<span class="pl-s">C:<span class="pl-cce">\\</span>Windows<span class="pl-cce">\\</span>System32<span class="pl-cce">\\</span>cmd.exe,C:<span class="pl-cce">\\</span>Windows<span class="pl-cce">\\</span>System32<span class="pl-cce">\\</span>runas.exe<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L342" class="blob-num js-line-number" data-line-number="342"></td>
- <td id="LC342" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L343" class="blob-num js-line-number" data-line-number="343"></td>
- <td id="LC343" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L344" class="blob-num js-line-number" data-line-number="344"></td>
- <td id="LC344" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L345" class="blob-num js-line-number" data-line-number="345"></td>
- <td id="LC345" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI Logging</span></td>
- </tr>
- <tr>
- <td id="L346" class="blob-num js-line-number" data-line-number="346"></td>
- <td id="LC346" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Set the application name if these logs are combined with other applications</span></td>
- </tr>
- <tr>
- <td id="L347" class="blob-num js-line-number" data-line-number="347"></td>
- <td id="LC347" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Logger.ApplicationName</span>=<span class="pl-s">ExampleApplication<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L348" class="blob-num js-line-number" data-line-number="348"></td>
- <td id="LC348" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true</span></td>
- </tr>
- <tr>
- <td id="L349" class="blob-num js-line-number" data-line-number="349"></td>
- <td id="LC349" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Logger.LogEncodingRequired</span>=<span class="pl-s">false<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L350" class="blob-num js-line-number" data-line-number="350"></td>
- <td id="LC350" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments.</span></td>
- </tr>
- <tr>
- <td id="L351" class="blob-num js-line-number" data-line-number="351"></td>
- <td id="LC351" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Logger.LogApplicationName</span>=<span class="pl-s">true<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L352" class="blob-num js-line-number" data-line-number="352"></td>
- <td id="LC352" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.</span></td>
- </tr>
- <tr>
- <td id="L353" class="blob-num js-line-number" data-line-number="353"></td>
- <td id="LC353" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Logger.LogServerIP</span>=<span class="pl-s">true<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L354" class="blob-num js-line-number" data-line-number="354"></td>
- <td id="LC354" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you</span></td>
- </tr>
- <tr>
- <td id="L355" class="blob-num js-line-number" data-line-number="355"></td>
- <td id="LC355" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> want to place it in a specific directory.</span></td>
- </tr>
- <tr>
- <td id="L356" class="blob-num js-line-number" data-line-number="356"></td>
- <td id="LC356" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Logger.LogFileName</span>=<span class="pl-s">ESAPI_logging_file<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L357" class="blob-num js-line-number" data-line-number="357"></td>
- <td id="LC357" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)</span></td>
- </tr>
- <tr>
- <td id="L358" class="blob-num js-line-number" data-line-number="358"></td>
- <td id="LC358" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Logger.MaxLogFileSize</span>=<span class="pl-s">10000000<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L359" class="blob-num js-line-number" data-line-number="359"></td>
- <td id="LC359" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L360" class="blob-num js-line-number" data-line-number="360"></td>
- <td id="LC360" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L361" class="blob-num js-line-number" data-line-number="361"></td>
- <td id="LC361" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L362" class="blob-num js-line-number" data-line-number="362"></td>
- <td id="LC362" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI Intrusion Detection</span></td>
- </tr>
- <tr>
- <td id="L363" class="blob-num js-line-number" data-line-number="363"></td>
- <td id="LC363" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L364" class="blob-num js-line-number" data-line-number="364"></td>
- <td id="LC364" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Each event has a base to which .count, .interval, and .action are added</span></td>
- </tr>
- <tr>
- <td id="L365" class="blob-num js-line-number" data-line-number="365"></td>
- <td id="LC365" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> The IntrusionException will fire if we receive "count" events within "interval" seconds</span></td>
- </tr>
- <tr>
- <td id="L366" class="blob-num js-line-number" data-line-number="366"></td>
- <td id="LC366" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> The IntrusionDetector is configurable to take the following actions: log, logout, and disable</span></td>
- </tr>
- <tr>
- <td id="L367" class="blob-num js-line-number" data-line-number="367"></td>
- <td id="LC367" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> (multiple actions separated by commas are allowed e.g. event.test.actions=log,disable</span></td>
- </tr>
- <tr>
- <td id="L368" class="blob-num js-line-number" data-line-number="368"></td>
- <td id="LC368" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L369" class="blob-num js-line-number" data-line-number="369"></td>
- <td id="LC369" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Custom Events</span></td>
- </tr>
- <tr>
- <td id="L370" class="blob-num js-line-number" data-line-number="370"></td>
- <td id="LC370" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Names must start with "event." as the base</span></td>
- </tr>
- <tr>
- <td id="L371" class="blob-num js-line-number" data-line-number="371"></td>
- <td id="LC371" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Use IntrusionDetector.addEvent( "test" ) in your code to trigger "event.test" here</span></td>
- </tr>
- <tr>
- <td id="L372" class="blob-num js-line-number" data-line-number="372"></td>
- <td id="LC372" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> You can also disable intrusion detection completely by changing</span></td>
- </tr>
- <tr>
- <td id="L373" class="blob-num js-line-number" data-line-number="373"></td>
- <td id="LC373" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> the following parameter to true</span></td>
- </tr>
- <tr>
- <td id="L374" class="blob-num js-line-number" data-line-number="374"></td>
- <td id="LC374" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L375" class="blob-num js-line-number" data-line-number="375"></td>
- <td id="LC375" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.Disable</span>=<span class="pl-s">false<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L376" class="blob-num js-line-number" data-line-number="376"></td>
- <td id="LC376" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L377" class="blob-num js-line-number" data-line-number="377"></td>
- <td id="LC377" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.event.test.count</span>=<span class="pl-s">2<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L378" class="blob-num js-line-number" data-line-number="378"></td>
- <td id="LC378" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.event.test.interval</span>=<span class="pl-s">10<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L379" class="blob-num js-line-number" data-line-number="379"></td>
- <td id="LC379" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.event.test.actions</span>=<span class="pl-s">disable,log<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L380" class="blob-num js-line-number" data-line-number="380"></td>
- <td id="LC380" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L381" class="blob-num js-line-number" data-line-number="381"></td>
- <td id="LC381" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Exception Events</span></td>
- </tr>
- <tr>
- <td id="L382" class="blob-num js-line-number" data-line-number="382"></td>
- <td id="LC382" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> All EnterpriseSecurityExceptions are registered automatically</span></td>
- </tr>
- <tr>
- <td id="L383" class="blob-num js-line-number" data-line-number="383"></td>
- <td id="LC383" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Call IntrusionDetector.getInstance().addException(e) for Exceptions that do not extend EnterpriseSecurityException</span></td>
- </tr>
- <tr>
- <td id="L384" class="blob-num js-line-number" data-line-number="384"></td>
- <td id="LC384" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Use the fully qualified classname of the exception as the base</span></td>
- </tr>
- <tr>
- <td id="L385" class="blob-num js-line-number" data-line-number="385"></td>
- <td id="LC385" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L386" class="blob-num js-line-number" data-line-number="386"></td>
- <td id="LC386" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> any intrusion is an attack</span></td>
- </tr>
- <tr>
- <td id="L387" class="blob-num js-line-number" data-line-number="387"></td>
- <td id="LC387" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.IntrusionException.count</span>=<span class="pl-s">1<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L388" class="blob-num js-line-number" data-line-number="388"></td>
- <td id="LC388" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.IntrusionException.interval</span>=<span class="pl-s">1<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L389" class="blob-num js-line-number" data-line-number="389"></td>
- <td id="LC389" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.IntrusionException.actions</span>=<span class="pl-s">log,disable,logout<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L390" class="blob-num js-line-number" data-line-number="390"></td>
- <td id="LC390" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L391" class="blob-num js-line-number" data-line-number="391"></td>
- <td id="LC391" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> for test purposes</span></td>
- </tr>
- <tr>
- <td id="L392" class="blob-num js-line-number" data-line-number="392"></td>
- <td id="LC392" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> CHECKME: Shouldn't there be something in the property name itself that designates</span></td>
- </tr>
- <tr>
- <td id="L393" class="blob-num js-line-number" data-line-number="393"></td>
- <td id="LC393" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> that these are for testing???</span></td>
- </tr>
- <tr>
- <td id="L394" class="blob-num js-line-number" data-line-number="394"></td>
- <td id="LC394" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.IntegrityException.count</span>=<span class="pl-s">10<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L395" class="blob-num js-line-number" data-line-number="395"></td>
- <td id="LC395" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.IntegrityException.interval</span>=<span class="pl-s">5<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L396" class="blob-num js-line-number" data-line-number="396"></td>
- <td id="LC396" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.IntegrityException.actions</span>=<span class="pl-s">log,disable,logout<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L397" class="blob-num js-line-number" data-line-number="397"></td>
- <td id="LC397" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L398" class="blob-num js-line-number" data-line-number="398"></td>
- <td id="LC398" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> rapid validation errors indicate scans or attacks in progress</span></td>
- </tr>
- <tr>
- <td id="L399" class="blob-num js-line-number" data-line-number="399"></td>
- <td id="LC399" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> org.owasp.esapi.errors.ValidationException.count=10</span></td>
- </tr>
- <tr>
- <td id="L400" class="blob-num js-line-number" data-line-number="400"></td>
- <td id="LC400" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> org.owasp.esapi.errors.ValidationException.interval=10</span></td>
- </tr>
- <tr>
- <td id="L401" class="blob-num js-line-number" data-line-number="401"></td>
- <td id="LC401" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> org.owasp.esapi.errors.ValidationException.actions=log,logout</span></td>
- </tr>
- <tr>
- <td id="L402" class="blob-num js-line-number" data-line-number="402"></td>
- <td id="LC402" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L403" class="blob-num js-line-number" data-line-number="403"></td>
- <td id="LC403" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> sessions jumping between hosts indicates session hijacking</span></td>
- </tr>
- <tr>
- <td id="L404" class="blob-num js-line-number" data-line-number="404"></td>
- <td id="LC404" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.count</span>=<span class="pl-s">2<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L405" class="blob-num js-line-number" data-line-number="405"></td>
- <td id="LC405" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.interval</span>=<span class="pl-s">10<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L406" class="blob-num js-line-number" data-line-number="406"></td>
- <td id="LC406" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.actions</span>=<span class="pl-s">log,logout<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L407" class="blob-num js-line-number" data-line-number="407"></td>
- <td id="LC407" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L408" class="blob-num js-line-number" data-line-number="408"></td>
- <td id="LC408" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L409" class="blob-num js-line-number" data-line-number="409"></td>
- <td id="LC409" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>===========================================================================</span></td>
- </tr>
- <tr>
- <td id="L410" class="blob-num js-line-number" data-line-number="410"></td>
- <td id="LC410" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> ESAPI Validation</span></td>
- </tr>
- <tr>
- <td id="L411" class="blob-num js-line-number" data-line-number="411"></td>
- <td id="LC411" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L412" class="blob-num js-line-number" data-line-number="412"></td>
- <td id="LC412" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> The ESAPI Validator works on regular expressions with defined names. You can define names</span></td>
- </tr>
- <tr>
- <td id="L413" class="blob-num js-line-number" data-line-number="413"></td>
- <td id="LC413" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> either here, or you may define application specific patterns in a separate file defined below.</span></td>
- </tr>
- <tr>
- <td id="L414" class="blob-num js-line-number" data-line-number="414"></td>
- <td id="LC414" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> This allows enterprises to specify both organizational standards as well as application specific</span></td>
- </tr>
- <tr>
- <td id="L415" class="blob-num js-line-number" data-line-number="415"></td>
- <td id="LC415" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> validation rules.</span></td>
- </tr>
- <tr>
- <td id="L416" class="blob-num js-line-number" data-line-number="416"></td>
- <td id="LC416" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span></span></td>
- </tr>
- <tr>
- <td id="L417" class="blob-num js-line-number" data-line-number="417"></td>
- <td id="LC417" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.ConfigurationFile</span>=<span class="pl-s">validation.properties<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L418" class="blob-num js-line-number" data-line-number="418"></td>
- <td id="LC418" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L419" class="blob-num js-line-number" data-line-number="419"></td>
- <td id="LC419" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Validators used by ESAPI</span></td>
- </tr>
- <tr>
- <td id="L420" class="blob-num js-line-number" data-line-number="420"></td>
- <td id="LC420" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.AccountName</span>=<span class="pl-s">^[a-zA-Z0-9]{3,20}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L421" class="blob-num js-line-number" data-line-number="421"></td>
- <td id="LC421" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.SystemCommand</span>=<span class="pl-s">^[a-zA-Z<span class="pl-cce">\\</span>-<span class="pl-cce">\\</span>/]{1,64}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L422" class="blob-num js-line-number" data-line-number="422"></td>
- <td id="LC422" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.RoleName</span>=<span class="pl-s">^[a-z]{1,20}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L423" class="blob-num js-line-number" data-line-number="423"></td>
- <td id="LC423" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L424" class="blob-num js-line-number" data-line-number="424"></td>
- <td id="LC424" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>the word TEST below should be changed to your application </span></td>
- </tr>
- <tr>
- <td id="L425" class="blob-num js-line-number" data-line-number="425"></td>
- <td id="LC425" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span>name - only relative URL's are supported</span></td>
- </tr>
- <tr>
- <td id="L426" class="blob-num js-line-number" data-line-number="426"></td>
- <td id="LC426" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.Redirect</span>=<span class="pl-s">^<span class="pl-cce">\\</span>/test.*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L427" class="blob-num js-line-number" data-line-number="427"></td>
- <td id="LC427" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L428" class="blob-num js-line-number" data-line-number="428"></td>
- <td id="LC428" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Global HTTP Validation Rules</span></td>
- </tr>
- <tr>
- <td id="L429" class="blob-num js-line-number" data-line-number="429"></td>
- <td id="LC429" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Values with Base64 encoded data (e.g. encrypted state) will need at least [a-zA-Z0-9\/+=]</span></td>
- </tr>
- <tr>
- <td id="L430" class="blob-num js-line-number" data-line-number="430"></td>
- <td id="LC430" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPScheme</span>=<span class="pl-s">^(http|https)$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L431" class="blob-num js-line-number" data-line-number="431"></td>
- <td id="LC431" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPServerName</span>=<span class="pl-s">^[a-zA-Z0-9_.<span class="pl-cce">\\</span>-]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L432" class="blob-num js-line-number" data-line-number="432"></td>
- <td id="LC432" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPParameterName</span>=<span class="pl-s">^[a-zA-Z0-9_]{1,32}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L433" class="blob-num js-line-number" data-line-number="433"></td>
- <td id="LC433" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPParameterValue</span>=<span class="pl-s">^[a-zA-Z0-9.<span class="pl-cce">\\</span>-<span class="pl-cce">\\</span>/+=@_ ]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L434" class="blob-num js-line-number" data-line-number="434"></td>
- <td id="LC434" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPCookieName</span>=<span class="pl-s">^[a-zA-Z0-9<span class="pl-cce">\\</span>-_]{1,32}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L435" class="blob-num js-line-number" data-line-number="435"></td>
- <td id="LC435" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPCookieValue</span>=<span class="pl-s">^[a-zA-Z0-9<span class="pl-cce">\\</span>-<span class="pl-cce">\\</span>/+=_ ]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L436" class="blob-num js-line-number" data-line-number="436"></td>
- <td id="LC436" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPHeaderName</span>=<span class="pl-s">^[a-zA-Z0-9<span class="pl-cce">\\</span>-_]{1,32}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L437" class="blob-num js-line-number" data-line-number="437"></td>
- <td id="LC437" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPHeaderValue</span>=<span class="pl-s">^[a-zA-Z0-9()<span class="pl-cce">\\</span>-=<span class="pl-cce">\\</span>*<span class="pl-cce">\\</span>.<span class="pl-cce">\\</span>?;,+<span class="pl-cce">\\</span>/:&_ ]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L438" class="blob-num js-line-number" data-line-number="438"></td>
- <td id="LC438" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPContextPath</span>=<span class="pl-s">^<span class="pl-cce">\\</span>/?[a-zA-Z0-9.<span class="pl-cce">\\</span>-<span class="pl-cce">\\</span>/_]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L439" class="blob-num js-line-number" data-line-number="439"></td>
- <td id="LC439" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPServletPath</span>=<span class="pl-s">^[a-zA-Z0-9.<span class="pl-cce">\\</span>-<span class="pl-cce">\\</span>/_]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L440" class="blob-num js-line-number" data-line-number="440"></td>
- <td id="LC440" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPPath</span>=<span class="pl-s">^[a-zA-Z0-9.<span class="pl-cce">\\</span>-_]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L441" class="blob-num js-line-number" data-line-number="441"></td>
- <td id="LC441" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPQueryString</span>=<span class="pl-s">^[a-zA-Z0-9()<span class="pl-cce">\\</span>-=<span class="pl-cce">\\</span>*<span class="pl-cce">\\</span>.<span class="pl-cce">\\</span>?;,+<span class="pl-cce">\\</span>/:&_ %]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L442" class="blob-num js-line-number" data-line-number="442"></td>
- <td id="LC442" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPURI</span>=<span class="pl-s">^[a-zA-Z0-9()<span class="pl-cce">\\</span>-=<span class="pl-cce">\\</span>*<span class="pl-cce">\\</span>.<span class="pl-cce">\\</span>?;,+<span class="pl-cce">\\</span>/:&_ ]*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L443" class="blob-num js-line-number" data-line-number="443"></td>
- <td id="LC443" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPURL</span>=<span class="pl-s">^.*$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L444" class="blob-num js-line-number" data-line-number="444"></td>
- <td id="LC444" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.HTTPJSESSIONID</span>=<span class="pl-s">^[A-Z0-9]{10,30}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L445" class="blob-num js-line-number" data-line-number="445"></td>
- <td id="LC445" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L446" class="blob-num js-line-number" data-line-number="446"></td>
- <td id="LC446" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Validation of file related input</span></td>
- </tr>
- <tr>
- <td id="L447" class="blob-num js-line-number" data-line-number="447"></td>
- <td id="LC447" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.FileName</span>=<span class="pl-s">^[a-zA-Z0-9!@#$%^&{}<span class="pl-cce">\\</span>[<span class="pl-cce">\\</span>]()_+<span class="pl-cce">\\</span>-=,.~'` ]{1,255}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L448" class="blob-num js-line-number" data-line-number="448"></td>
- <td id="LC448" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.DirectoryName</span>=<span class="pl-s">^[a-zA-Z0-9:/<span class="pl-cce">\\\\</span>!@#$%^&{}<span class="pl-cce">\\</span>[<span class="pl-cce">\\</span>]()_+<span class="pl-cce">\\</span>-=,.~'` ]{1,255}$<span class="pl-c2"></span></span></td>
- </tr>
- <tr>
- <td id="L449" class="blob-num js-line-number" data-line-number="449"></td>
- <td id="LC449" class="blob-code blob-code-inner js-file-line">
-</td>
- </tr>
- <tr>
- <td id="L450" class="blob-num js-line-number" data-line-number="450"></td>
- <td id="LC450" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> Validation of dates. Controls whether or not 'lenient' dates are accepted.</span></td>
- </tr>
- <tr>
- <td id="L451" class="blob-num js-line-number" data-line-number="451"></td>
- <td id="LC451" class="blob-code blob-code-inner js-file-line"><span class="pl-c"><span class="pl-c">#</span> See DataFormat.setLenient(boolean flag) for further details.</span></td>
- </tr>
- <tr>
- <td id="L452" class="blob-num js-line-number" data-line-number="452"></td>
- <td id="LC452" class="blob-code blob-code-inner js-file-line"><span class="pl-c1">Validator.AcceptLenientDates</span>=<span class="pl-s">false<span class="pl-c2"></span></span></td>
- </tr>
-</table>
-
- <details class="details-reset details-overlay BlobToolbar position-absolute js-file-line-actions dropdown d-none" aria-hidden="true">
- <summary class="btn-octicon ml-0 px-2 p-0 bg-white border border-gray-dark rounded-1" aria-label="Inline file action toolbar">
- <svg class="octicon octicon-kebab-horizontal" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="M8 9a1.5 1.5 0 100-3 1.5 1.5 0 000 3zM1.5 9a1.5 1.5 0 100-3 1.5 1.5 0 000 3zm13 0a1.5 1.5 0 100-3 1.5 1.5 0 000 3z"></path></svg>
- </summary>
- <details-menu>
- <ul class="BlobToolbar-dropdown dropdown-menu dropdown-menu-se mt-2" style="width:185px">
- <li>
- <clipboard-copy role="menuitem" class="dropdown-item" id="js-copy-lines" style="cursor:pointer;">
- Copy lines
- </clipboard-copy>
- </li>
- <li>
- <clipboard-copy role="menuitem" class="dropdown-item" id="js-copy-permalink" style="cursor:pointer;">
- Copy permalink
- </clipboard-copy>
- </li>
- <li><a class="dropdown-item js-update-url-with-hash" id="js-view-git-blame" role="menuitem" href="/OWASP/EJSF/blame/6d9178cba389df70407565540688bc9a2fc79ca2/esapi_master_FULL/WebContent/ESAPI.properties">View git blame</a></li>
- <li><a class="dropdown-item" id="js-new-issue" role="menuitem" href="/OWASP/EJSF/issues/new">Reference in new issue</a></li>
- </ul>
- </details-menu>
- </details>
-
- </div>
-
- </div>
-
-
-
-
- <details class="details-reset details-overlay details-overlay-dark" id="jumpto-line-details-dialog">
- <summary data-hotkey="l" aria-label="Jump to line"></summary>
- <details-dialog class="Box Box--overlay d-flex flex-column anim-fade-in fast linejump" aria-label="Jump to line">
- <!-- '"` --><!-- </textarea></xmp> --></option></form><form class="js-jump-to-line-form Box-body d-flex" action="" accept-charset="UTF-8" method="get">
- <input class="form-control flex-auto mr-3 linejump-input js-jump-to-line-field" type="text" placeholder="Jump to line…" aria-label="Jump to line" autofocus>
- <button type="submit" class="btn" data-close-dialog>Go</button>
-</form> </details-dialog>
- </details>
-
-
-
-
- </div>
-</div>
-
- </main>
- </div>
-
- </div>
-
-
-<div class="footer container-xl width-full p-responsive" role="contentinfo">
- <div class="position-relative d-flex flex-row-reverse flex-lg-row flex-wrap flex-lg-nowrap flex-justify-center flex-lg-justify-between flex-sm-items-center pt-6 pb-2 mt-6 f6 text-gray border-top border-gray-light ">
- <a aria-label="Homepage" title="GitHub" class="footer-octicon d-none d-lg-block mr-lg-4" href="https://github.com">
- <svg height="24" class="octicon octicon-mark-github" viewBox="0 0 16 16" version="1.1" width="24" aria-hidden="true"><path fill-rule="evenodd" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"></path></svg>
-</a>
- <ul class="list-style-none d-flex flex-wrap col-12 flex-justify-center flex-lg-justify-between mb-2 mb-lg-0">
- <li class="mr-3 mr-lg-0">© 2020 GitHub, Inc.</li>
- <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to terms, text:terms" href="https://github.com/site/terms">Terms</a></li>
- <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to privacy, text:privacy" href="https://github.com/site/privacy">Privacy</a></li>
- <li class="js-cookie-consent-preferences-link-container mr-3 mr-lg-0" hidden="hidden">
- <button data-ga-click="Footer, go to cookie preferences, text:cookie preferences" class="btn-link js-cookie-consent-preferences-link" type="button">Cookie Preferences</button>
-</li>
- <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to security, text:security" href="https://github.com/security">Security</a></li>
- <li class="mr-3 mr-lg-0"><a href="https://githubstatus.com/" data-ga-click="Footer, go to status, text:status">Status</a></li>
- <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to help, text:help" href="https://docs.github.com">Help</a></li>
- <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to contact, text:contact" href="https://github.com/contact">Contact GitHub</a></li>
- <li class="mr-3 mr-lg-0"><a href="https://github.com/pricing" data-ga-click="Footer, go to Pricing, text:Pricing">Pricing</a></li>
- <li class="mr-3 mr-lg-0"><a href="https://docs.github.com" data-ga-click="Footer, go to api, text:api">API</a></li>
- <li class="mr-3 mr-lg-0"><a href="https://services.github.com" data-ga-click="Footer, go to training, text:training">Training</a></li>
- <li class="mr-3 mr-lg-0"><a href="https://github.blog" data-ga-click="Footer, go to blog, text:blog">Blog</a></li>
- <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to about, text:about" href="https://github.com/about">About</a></li>
- </ul>
- </div>
- <div class="d-flex flex-justify-center pb-6">
- <span class="f6 text-gray-light"></span>
- </div>
-</div>
-
-
-
- <div id="ajax-error-message" class="ajax-error-message flash flash-error">
- <svg class="octicon octicon-alert" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M8.22 1.754a.25.25 0 00-.44 0L1.698 13.132a.25.25 0 00.22.368h12.164a.25.25 0 00.22-.368L8.22 1.754zm-1.763-.707c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0114.082 15H1.918a1.75 1.75 0 01-1.543-2.575L6.457 1.047zM9 11a1 1 0 11-2 0 1 1 0 012 0zm-.25-5.25a.75.75 0 00-1.5 0v2.5a.75.75 0 001.5 0v-2.5z"></path></svg>
- <button type="button" class="flash-close js-ajax-error-dismiss" aria-label="Dismiss error">
- <svg class="octicon octicon-x" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M3.72 3.72a.75.75 0 011.06 0L8 6.94l3.22-3.22a.75.75 0 111.06 1.06L9.06 8l3.22 3.22a.75.75 0 11-1.06 1.06L8 9.06l-3.22 3.22a.75.75 0 01-1.06-1.06L6.94 8 3.72 4.78a.75.75 0 010-1.06z"></path></svg>
- </button>
- You can’t perform that action at this time.
- </div>
-
-
- <div class="js-stale-session-flash flash flash-warn flash-banner" hidden
- >
- <svg class="octicon octicon-alert" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M8.22 1.754a.25.25 0 00-.44 0L1.698 13.132a.25.25 0 00.22.368h12.164a.25.25 0 00.22-.368L8.22 1.754zm-1.763-.707c.659-1.234 2.427-1.234 3.086 0l6.082 11.378A1.75 1.75 0 0114.082 15H1.918a1.75 1.75 0 01-1.543-2.575L6.457 1.047zM9 11a1 1 0 11-2 0 1 1 0 012 0zm-.25-5.25a.75.75 0 00-1.5 0v2.5a.75.75 0 001.5 0v-2.5z"></path></svg>
- <span class="js-stale-session-flash-signed-in" hidden>You signed in with another tab or window. <a href="">Reload</a> to refresh your session.</span>
- <span class="js-stale-session-flash-signed-out" hidden>You signed out in another tab or window. <a href="">Reload</a> to refresh your session.</span>
- </div>
- <template id="site-details-dialog">
- <details class="details-reset details-overlay details-overlay-dark lh-default text-gray-dark hx_rsm" open>
- <summary role="button" aria-label="Close dialog"></summary>
- <details-dialog class="Box Box--overlay d-flex flex-column anim-fade-in fast hx_rsm-dialog hx_rsm-modal">
- <button class="Box-btn-octicon m-0 btn-octicon position-absolute right-0 top-0" type="button" aria-label="Close dialog" data-close-dialog>
- <svg class="octicon octicon-x" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M3.72 3.72a.75.75 0 011.06 0L8 6.94l3.22-3.22a.75.75 0 111.06 1.06L9.06 8l3.22 3.22a.75.75 0 11-1.06 1.06L8 9.06l-3.22 3.22a.75.75 0 01-1.06-1.06L6.94 8 3.72 4.78a.75.75 0 010-1.06z"></path></svg>
- </button>
- <div class="octocat-spinner my-6 js-details-dialog-spinner"></div>
- </details-dialog>
- </details>
-</template>
-
- <div class="Popover js-hovercard-content position-absolute" style="display: none; outline: none;" tabindex="0">
- <div class="Popover-message Popover-message--bottom-left Popover-message--large Box box-shadow-large" style="width:360px;">
- </div>
-</div>
-
- <div class="js-cookie-consent-banner" hidden>
- <div class="hx_cookie-banner p-2 p-sm-3 p-md-4">
- <div style="max-width: 1194px;" class="Box hx_cookie-banner-box box-shadow-medium mx-auto">
- <div class="Box-body border-0 py-0 px-3 px-md-4">
- <div class="js-main-cookie-banner hx_cookie-banner-main">
- <div class="d-md-flex flex-items-center py-3">
- <p class="f5 flex-1 mb-3 mb-md-0">
-
- We use <span class="text-bold">optional</span> third-party analytics cookies to understand how you use GitHub.com so we can build better products.
-
- <span class="btn-link js-cookie-consent-learn-more">Learn more</span>.
- </p>
- <div class="d-flex d-md-block flex-wrap flex-sm-nowrap">
- <button class="btn btn-outline flex-1 mr-1 mx-sm-1 m-md-0 ml-md-2 js-cookie-consent-accept">Accept</button>
- <button class="btn btn-outline flex-1 ml-1 m-md-0 ml-md-2 js-cookie-consent-reject">Reject</button>
- </div>
- </div>
- </div>
-
- <div class="js-cookie-details hx_cookie-banner-details" hidden>
- <div class="d-md-flex flex-items-center py-3">
- <p class="f5 flex-1 mb-2 mb-md-0">
-
- We use <span class="text-bold">optional</span> third-party analytics cookies to understand how you use GitHub.com so we can build better products.
-
- <br>
- You can always update your selection by clicking <span class="text-bold">Cookie Preferences</span> at the bottom of the page.
- For more information, see our <a href="https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-privacy-statement">Privacy Statement</a>.
- </p>
- </div>
-
- <div class="d-md-flex flex-items-center py-3 border-top">
- <div class="f5 flex-1 mb-2 mb-md-0">
- <h5 class="mb-1">Essential cookies</h5>
- <p class="f6 mb-md-0">We use essential cookies to perform essential website functions, e.g. they're used to log you in.
- <a href="https://docs.github.com/en/github/site-policy/github-subprocessors-and-cookies">Learn more</a>
- </p>
- </div>
- <div class="text-right">
- <h5 class="text-blue">Always active</h5>
- </div>
- </div>
-
- <div class="d-md-flex flex-items-center py-3 border-top">
- <div class="f5 flex-1 mb-2 mb-md-0">
- <h5 class="mb-1">Analytics cookies</h5>
- <p class="f6 mb-md-0">We use analytics cookies to understand how you use our websites so we can make them better, e.g. they're used to gather information about the pages you visit and how many clicks you need to accomplish a task.
- <a href="https://docs.github.com/en/github/site-policy/github-subprocessors-and-cookies">Learn more</a>
- </p>
- </div>
- <div class="text-right">
- <div class="BtnGroup mt-1 mt-md-0 ml-2">
- <button class="btn btn-outline BtnGroup-item js-accept-analytics-cookies" type="button">Accept</button>
- <button class="btn btn-outline BtnGroup-item js-reject-analytics-cookies" type="button">Reject</button>
- </div>
- </div>
- </div>
-
- <div class="text-right py-3 border-top">
- <button class="btn btn-primary js-save-cookie-preferences" type="button" disabled>Save preferences</button>
- </div>
- </div>
-</div></div> </div>
-</div>
-
-
- </body>
-</html>
-
diff --git a/modules/webapp/pom.xml b/modules/webapp/pom.xml
index 8ec2f79..a34bd3a 100644
--- a/modules/webapp/pom.xml
+++ b/modules/webapp/pom.xml
@@ -45,10 +45,6 @@
<artifactId>log4j</artifactId>
</dependency>
<dependency>
- <groupId>org.owasp.esapi</groupId>
- <artifactId>esapi</artifactId>
- </dependency>
- <dependency>
<groupId>org.apache.axis2</groupId>
<artifactId>axis2-spring</artifactId>
<version>${project.version}</version>
@@ -404,13 +400,6 @@
<exclude>servlet*.txt</exclude>
</excludes>
</resource>
- <resource>
- <directory>conf</directory>
- <includes>
- <include>ESAPI.properties</include>
- </includes>
- <targetPath>WEB-INF/classes</targetPath>
- </resource>
</webResources>
</configuration>
</plugin>
diff --git a/modules/webapp/src/main/java/org/apache/axis2/webapp/AdminActions.java b/modules/webapp/src/main/java/org/apache/axis2/webapp/AdminActions.java
index bbb7fec..a672178 100644
--- a/modules/webapp/src/main/java/org/apache/axis2/webapp/AdminActions.java
+++ b/modules/webapp/src/main/java/org/apache/axis2/webapp/AdminActions.java
@@ -52,10 +52,6 @@
import java.util.Map;
import java.util.TreeMap;
-import org.owasp.esapi.reference.DefaultHTTPUtilities;
-import org.owasp.esapi.ESAPI;
-import org.owasp.esapi.Validator;
-
/**
* Provides methods to process axis2 admin requests.
*/
@@ -124,16 +120,10 @@
if (req.getSession(false) != null) {
return new Redirect(LOGOUT);
} else {
- try {
- String failed = DefaultHTTPUtilities.getInstance().getParameter(req, "failed");
- if ("true".equals(failed)) {
- req.setAttribute("errorMessage", "Invalid auth credentials!");
- }
- return new View(LOGIN_JSP_NAME);
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- return new Redirect(LOGOUT);
+ if ("true".equals(req.getParameter("failed"))) {
+ req.setAttribute("errorMessage", "Invalid auth credentials!");
}
+ return new View(LOGIN_JSP_NAME);
}
}
@@ -170,16 +160,6 @@
String fileName = item.getName();
String fileExtesion = fileName;
fileExtesion = fileExtesion.toLowerCase();
-
- Validator validator = ESAPI.validator();
- if (fileExtesion != null) {
- boolean fileextstatus = validator.isValidInput("userInput", fileExtesion, "FileName", 3, false);
- if (!fileextstatus) {
- log.error("invalid fileExtesion: " + fileExtesion);
- return new Redirect(UPLOAD).withStatus(false, "Unsupported file name");
- }
- }
-
if (!(fileExtesion.endsWith(".jar") || fileExtesion.endsWith(".aar"))) {
return new Redirect(UPLOAD).withStatus(false, "Unsupported file type " + fileExtesion);
} else {
@@ -195,13 +175,6 @@
.length());
}
- if (fileNameOnly != null) {
- boolean filestatus = validator.isValidInput("userInput", fileNameOnly, "FileName", 100, false);
- if (!filestatus) {
- log.error("invalid fileNameOnly: " + fileNameOnly);
- return new Redirect(UPLOAD).withStatus(false, "Unsupported file name");
- }
- }
File uploadedFile = new File(serviceDir, fileNameOnly);
item.write(uploadedFile);
return new Redirect(UPLOAD).withStatus(true, "File " + fileNameOnly + " successfully uploaded");
@@ -224,15 +197,8 @@
return new Redirect(WELCOME);
}
- String username = null;
- String password = null;
- try {
- username = DefaultHTTPUtilities.getInstance().getParameter(req, "userName");
- password = DefaultHTTPUtilities.getInstance().getParameter(req, "password");
- } catch (Exception ex) {
- log.error("invalid credentials: " + ex.getMessage(), ex);
- return new Redirect(WELCOME).withParameter("failed", "true");
- }
+ String username = req.getParameter("userName");
+ String password = req.getParameter("password");
if ((username == null) || (password == null) || username.trim().length() == 0
|| password.trim().length() == 0) {
@@ -254,15 +220,7 @@
@Action(name=EDIT_SERVICE_PARAMETERS)
public View editServiceParameters(HttpServletRequest req) throws AxisFault {
-
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(req, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid serviceName");
- return new View("editServiceParameters.jsp");
- }
+ String serviceName = req.getParameter("axisService");
AxisService service =
configContext.getAxisConfiguration().getServiceForActivation(serviceName);
if (service.isActive()) {
@@ -302,23 +260,11 @@
@Action(name="updateServiceParameters", post=true)
public Redirect updateServiceParameters(HttpServletRequest request) throws AxisFault {
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(request, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- return new Redirect(EDIT_SERVICE_PARAMETERS).withStatus(false, "invalid serviceName");
- }
+ String serviceName = request.getParameter("axisService");
AxisService service = configContext.getAxisConfiguration().getService(serviceName);
if (service != null) {
for (Parameter parameter : service.getParameters()) {
- String para = null;
- try {
- para = DefaultHTTPUtilities.getInstance().getParameter(request, serviceName + "_" + parameter.getName());
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- return new Redirect(EDIT_SERVICE_PARAMETERS).withStatus(false, "invalid serviceName");
- }
+ String para = request.getParameter(serviceName + "_" + parameter.getName());
service.addParameter(new Parameter(parameter.getName(), para));
}
@@ -327,13 +273,7 @@
String op_name = axisOperation.getName().getLocalPart();
for (Parameter parameter : axisOperation.getParameters()) {
- String para = null;
- try {
- para = DefaultHTTPUtilities.getInstance().getParameter(request, serviceName + "_" + parameter.getName());
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- return new Redirect(EDIT_SERVICE_PARAMETERS).withStatus(false, "invalid serviceName");
- }
+ String para = request.getParameter(op_name + "_" + parameter.getName());
axisOperation.addParameter(new Parameter(parameter.getName(), para));
}
@@ -356,13 +296,7 @@
@Action(name="doEngageGlobally", post=true)
public Redirect doEngageGlobally(HttpServletRequest request) {
- String moduleName = null;
- try {
- moduleName = DefaultHTTPUtilities.getInstance().getParameter(request, "module");
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- return new Redirect(ENGAGE_GLOBALLY).withStatus(false, "invalid module name");
- }
+ String moduleName = request.getParameter("module");
try {
configContext.getAxisConfiguration().engageModule(moduleName);
return new Redirect(ENGAGE_GLOBALLY).withStatus(true,
@@ -381,14 +315,7 @@
req.getSession().setAttribute(Constants.ENGAGE_STATUS, null);
req.getSession().setAttribute("modules", null);
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(req, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid serviceName");
- return new View("engageToOperation.jsp");
- }
+ String serviceName = req.getParameter("axisService");
if (serviceName != null) {
req.setAttribute("service", serviceName);
@@ -404,32 +331,9 @@
@Action(name="doEngageToOperation", post=true)
public Redirect doEngageToOperation(HttpServletRequest request) {
-
- String moduleName = null;
- try {
- moduleName = DefaultHTTPUtilities.getInstance().getParameter(request, "module");
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- return new Redirect(ENGAGE_TO_OPERATION).withStatus(false, "invalid moduleName");
- }
-
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(request, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- request.setAttribute("status", "invalid serviceName");
- return new Redirect(ENGAGE_TO_OPERATION).withStatus(false, "invalid serviceName");
- }
-
- String operationName = null;
- try {
- operationName = DefaultHTTPUtilities.getInstance().getParameter(request, "axisOperation");
- } catch (Exception ex) {
- log.error("invalid operationName: " + ex.getMessage(), ex);
- request.setAttribute("status", "invalid operationName");
- return new Redirect(ENGAGE_TO_OPERATION).withStatus(false, "invalid operationName");
- }
+ String moduleName = request.getParameter("module");
+ String serviceName = request.getParameter("service");
+ String operationName = request.getParameter("axisOperation");
Redirect redirect = new Redirect(ENGAGE_TO_OPERATION).withParameter("axisService", serviceName);
try {
AxisOperation od = configContext.getAxisConfiguration().getService(
@@ -461,23 +365,8 @@
@Action(name="doEngageToService", post=true)
public Redirect doEngageToService(HttpServletRequest request) {
- String moduleName = null;
- try {
- moduleName = DefaultHTTPUtilities.getInstance().getParameter(request, "module");
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- return new Redirect(ENGAGE_GLOBALLY).withStatus(false, "invalid module name");
- }
-
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(request, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- request.setAttribute("status", "invalid serviceName");
- return new Redirect(ENGAGE_TO_SERVICE).withStatus(false, "invalid serviceName");
- }
-
+ String moduleName = request.getParameter("module");
+ String serviceName = request.getParameter("axisService");
try {
configContext.getAxisConfiguration().getService(serviceName).engageModule(
configContext.getAxisConfiguration().getModule(moduleName));
@@ -509,22 +398,8 @@
@Action(name="doEngageToServiceGroup", post=true)
public Redirect doEngageToServiceGroup(HttpServletRequest request) throws AxisFault {
- String moduleName = null;
- try {
- moduleName = DefaultHTTPUtilities.getInstance().getParameter(request, "module");
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- return new Redirect(ENGAGE_GLOBALLY).withStatus(false, "invalid module name");
- }
-
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(request, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- request.setAttribute("status", "invalid serviceName");
- return new Redirect(ENGAGE_TO_SERVICE).withStatus(false, "invalid serviceName");
- }
+ String moduleName = request.getParameter("module");
+ String serviceName = request.getParameter("axisService");
configContext.getAxisConfiguration().getServiceGroup(serviceName).engageModule(
configContext.getAxisConfiguration().getModule(moduleName));
return new Redirect(ENGAGE_TO_SERVICE_GROUP).withStatus(true,
@@ -539,23 +414,8 @@
@Action(name="viewServiceGroupContext")
public View viewServiceGroupContext(HttpServletRequest req) {
- String type = null;
- try {
- type = DefaultHTTPUtilities.getInstance().getParameter(req, "type");
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- req.setAttribute("status", "invalid type name");
- return new View("viewServiceGroupContext.jsp");
- }
-
- String sgID = null;
- try {
- sgID = DefaultHTTPUtilities.getInstance().getParameter(req, "ID");
- } catch (Exception ex) {
- log.error("invalid id: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid id");
- return new View("viewServiceGroupContext.jsp");
- }
+ String type = req.getParameter("TYPE");
+ String sgID = req.getParameter("ID");
ServiceGroupContext sgContext = configContext.getServiceGroupContext(sgID);
req.getSession().setAttribute("ServiceGroupContext",sgContext);
req.getSession().setAttribute("TYPE",type);
@@ -565,32 +425,9 @@
@Action(name="viewServiceContext")
public View viewServiceContext(HttpServletRequest req) throws AxisFault {
- String type = null;
- try {
- type = DefaultHTTPUtilities.getInstance().getParameter(req, "type");
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- req.setAttribute("status", "invalid type name");
- return new View("viewServiceContext.jsp");
- }
-
- String sgID = null;
- try {
- sgID = DefaultHTTPUtilities.getInstance().getParameter(req, "PID");
- } catch (Exception ex) {
- log.error("invalid PID param received: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid PID");
- return new View("viewServiceContext.jsp");
- }
-
- String ID = null;
- try {
- ID = DefaultHTTPUtilities.getInstance().getParameter(req, "ID");
- } catch (Exception ex) {
- log.error("invalid ID: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid ID");
- return new View("viewServiceContext.jsp");
- }
+ String type = req.getParameter("TYPE");
+ String sgID = req.getParameter("PID");
+ String ID = req.getParameter("ID");
ServiceGroupContext sgContext = configContext.getServiceGroupContext(sgID);
if (sgContext != null) {
AxisService service = sgContext.getDescription().getService(ID);
@@ -628,22 +465,8 @@
@Action(name="doActivateService", post=true)
public Redirect doActivateService(HttpServletRequest request) throws AxisFault {
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(request, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- request.setAttribute("status", "invalid serviceName");
- return new Redirect(ACTIVATE_SERVICE);
- }
- String turnon = null;
- try {
- turnon = DefaultHTTPUtilities.getInstance().getParameter(request, "turnon");
- } catch (Exception ex) {
- log.error("invalid turnon: " + ex.getMessage(), ex);
- request.setAttribute("status", "invalid turnon");
- return new Redirect(DEACTIVATE_SERVICE);
- }
+ String serviceName = request.getParameter("axisService");
+ String turnon = request.getParameter("turnon");
if (serviceName != null) {
if (turnon != null) {
configContext.getAxisConfiguration().startService(serviceName);
@@ -660,22 +483,8 @@
@Action(name="doDeactivateService", post=true)
public Redirect doDeactivateService(HttpServletRequest request) throws AxisFault {
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(request, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- request.setAttribute("status", "invalid serviceName");
- return new Redirect(DEACTIVATE_SERVICE);
- }
- String turnoff = null;
- try {
- turnoff = DefaultHTTPUtilities.getInstance().getParameter(request, "turnoff");
- } catch (Exception ex) {
- log.error("invalid turnoff: " + ex.getMessage(), ex);
- request.setAttribute("status", "invalid turnoff");
- return new Redirect(DEACTIVATE_SERVICE);
- }
+ String serviceName = request.getParameter("axisService");
+ String turnoff = request.getParameter("turnoff");
if (serviceName != null) {
if (turnoff != null) {
configContext.getAxisConfiguration().stopService(serviceName);
@@ -694,14 +503,7 @@
@Action(name=VIEW_OPERATION_SPECIFIC_CHAINS)
public View viewOperationSpecificChains(HttpServletRequest req) throws AxisFault {
- String service = null;
- try {
- service = DefaultHTTPUtilities.getInstance().getParameter(req, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid serviceName");
- return new View("editServiceParameters.jsp");
- }
+ String service = req.getParameter("axisService");
if (service != null) {
req.getSession().setAttribute(Constants.SERVICE_HANDLERS,
@@ -739,14 +541,7 @@
@Action(name="listSingleService")
public View listSingleService(HttpServletRequest req) throws AxisFault {
req.getSession().setAttribute(Constants.IS_FAULTY, ""); //Clearing out any old values.
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(req, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid serviceName");
- return new View("editServiceParameters.jsp");
- }
+ String serviceName = req.getParameter("serviceName");
if (serviceName != null) {
AxisService service = configContext.getAxisConfiguration().getService(serviceName);
req.getSession().setAttribute(Constants.SINGLE_SERVICE, service);
@@ -782,32 +577,9 @@
@Action(name="disengageModule", post=true)
public Redirect processdisengageModule(HttpServletRequest req) throws AxisFault {
- String type = null;
- try {
- type = DefaultHTTPUtilities.getInstance().getParameter(req, "type");
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- req.setAttribute("status", "invalid type name");
- return new Redirect(LIST_SERVICES).withStatus(false, "invalid type name");
- }
-
- String moduleName = null;
- try {
- moduleName = DefaultHTTPUtilities.getInstance().getParameter(req, "module");
- } catch (Exception ex) {
- log.error(ex.getMessage(), ex);
- return new Redirect(LIST_SERVICES).withStatus(false, "invalid module name");
- }
-
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(req, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid serviceName");
- return new Redirect(LIST_SERVICES).withStatus(false, "invalid serviceName");
- }
-
+ String type = req.getParameter("type");
+ String serviceName = req.getParameter("serviceName");
+ String moduleName = req.getParameter("module");
AxisConfiguration axisConfiguration = configContext.getAxisConfiguration();
AxisService service = axisConfiguration.getService(serviceName);
AxisModule module = axisConfiguration.getModule(moduleName);
@@ -817,14 +589,7 @@
return new Redirect(LIST_SERVICES).withStatus(false, "Can not disengage module "
+ moduleName + ". This module is engaged at a higher level.");
} else {
- String opName = null;
- try {
- opName = DefaultHTTPUtilities.getInstance().getParameter(req, "operation");
- } catch (Exception ex) {
- log.error("invalid operation: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid operation");
- return new Redirect(LIST_SERVICES).withStatus(false, "invalid operation");
- }
+ String opName = req.getParameter("operation");
AxisOperation op = service.getOperation(new QName(opName));
op.disengageModule(module);
return new Redirect(LIST_SERVICES).withStatus(true,
@@ -845,14 +610,7 @@
@Action(name="deleteService", post=true)
public Redirect deleteService(HttpServletRequest req) throws AxisFault {
- String serviceName = null;
- try {
- serviceName = DefaultHTTPUtilities.getInstance().getParameter(req, "axisService");
- } catch (Exception ex) {
- log.error("invalid serviceName: " + ex.getMessage(), ex);
- req.setAttribute("status", "invalid serviceName");
- return new Redirect(LIST_SERVICES).withStatus(false, "Failed to delete service, serviceName is invalid");
- }
+ String serviceName = req.getParameter("serviceName");
AxisConfiguration axisConfiguration = configContext.getAxisConfiguration();
if (axisConfiguration.getService(serviceName) != null) {
axisConfiguration.removeService(serviceName);
diff --git a/pom.xml b/pom.xml
index 845fc70..71d3366 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1118,12 +1118,6 @@
<artifactId>aspectjweaver</artifactId>
<version>1.8.2</version>
</dependency>
- <!-- security filters -->
- <dependency>
- <groupId>org.owasp.esapi</groupId>
- <artifactId>esapi</artifactId>
- <version>2.2.0.0</version>
- </dependency>
</dependencies>
</dependencyManagement>
<build>
