org.owasp.esapi.filters

Class SecurityWrapper

java.lang.Object

org.owasp.esapi.filters.SecurityWrapper

All Implemented Interfaces:

javax.servlet.Filter

public class SecurityWrapper
extends java.lang.Object
implements javax.servlet.Filter

This filter wraps the incoming request and outgoing response and overrides many methods with safer versions. Many of the safer versions simply validate parts of the request or response for unwanted characters before allowing the call to complete. Some examples of attacks that use these vectors include request splitting, response splitting, and file download injection. Attackers use techniques like CRLF injection and null byte injection to confuse the parsing of requests and responses.

Example Configuration #1 (Default Configuration allows /WEB-INF):

 <filter>
    <filter-name>SecurityWrapperDefault</filter-name>
    <filter-class>org.owasp.filters.SecurityWrapper</filter-class>
 </filter>
 

Example Configuration #2 (Allows /servlet)

 <filter>
    <filter-name>SecurityWrapperForServlet</filter-name>
    <filter-class>org.owasp.filters.SecurityWrapper</filter-class>
    <init-param>
       <param-name>allowableResourceRoot</param-name>
       <param-value>/servlet</param-value>
    </init-param>
 </filter>
 

Field Summary

Fields

Modifier and Type	Field and Description
private java.lang.String	allowableResourcesRoot This is the root path of what resources this filter will allow a RequestDispatcher to be dispatched to.
private Logger	logger

Constructor Summary

Constructors

Constructor and Description
SecurityWrapper()

Method Summary

Modifier and Type	Method and Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
void	init(javax.servlet.FilterConfig filterConfig)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

logger

private final Logger logger

allowableResourcesRoot

private java.lang.String allowableResourcesRoot

This is the root path of what resources this filter will allow a RequestDispatcher to be dispatched to. This defaults to WEB-INF as best practice dictates that dispatched requests should be done to resources that are not browsable and everything behind WEB-INF is protected by the container. However, it is possible and sometimes required to dispatch requests to places outside of the WEB-INF path (such as to another servlet). See http://code.google.com/p/owasp-esapi-java/issues/detail?id=70 and https://lists.owasp.org/pipermail/owasp-esapi/2009-December/001672.html for details.

Constructor Detail

SecurityWrapper

public SecurityWrapper()

Method Detail

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Parameters:

request -

response -

chain -

Throws:

java.io.IOException

javax.servlet.ServletException

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Parameters:

filterConfig -

Throws:

javax.servlet.ServletException