- * Implementations must adopt a "whitelist" approach to validation where a + *
+ * Implementations must adopt a "allow-list" approach to validation where a * specific pattern or character set is matched. "Blacklist" approaches that * attempt to identify the invalid or disallowed characters are much more likely * to allow a bypass with encoding or other tricks. + *
+ * CAUTION: There are many methods that take multiple (or only!) {@code String} + * arguments. Be careful that you do not mix up the order of these, because for + * some methods such as {@code isValidSafeHTML} if you were to confuse the order of + * {@code context} and {@code input} arguments, you would not be verifying what + * you thought you were and it could have serious security consequences as a + * result. When there are 2 these {@code String} parameters—{@code context} and + * {@code input} arguments—the * {@code context} argument is always first. + * See the individual method documentation for additional details. + *
* * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security @@ -50,11 +60,13 @@ public interface Validator { /** * Add a validation rule to the registry using the "type name" of the rule as the key. + * @param rule The {@link ValidationRule} to add. */ void addRule( ValidationRule rule ); /** * Get a validation rule from the registry with the "type name" of the rule as the key. + * @param name The "type" name of a {@link ValidationRule} to retrieve. */ ValidationRule getRule( String name ); @@ -64,6 +76,18 @@ public interface Validator { * Calls {@link #getValidInput(String, String, String, int, boolean, boolean)} with {@code canonicalize=true} * and returns true if no exceptions are thrown. * + * @param context + * A descriptive name of the parameter that you are validating (e.g., "LoginPage_UsernameField"). + * This value is used by any logging or error handling that is done with respect to the value passed in. + * @param input + * The actual user input data to validate. + * @param type + * The regular expression name which maps to the actual regular expression from "ESAPI.properties". + * @param maxLength + * The maximum {@code String} length allowed for {@code input}. + * @param allowNull + * If {@code allowNull} is true then an input that is NULL or an empty string will be legal. + * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException. * @throws IntrusionException Input likely indicates an attack. */ boolean isValidInput(String context, String input, String type, int maxLength, boolean allowNull) throws IntrusionException; @@ -75,6 +99,20 @@ public interface Validator { * Calls {@link #getValidInput(String, String, String, int, boolean, boolean)} with {@code canonicalize=true} * and returns true if no exceptions are thrown. * + * @param context + * A descriptive name of the parameter that you are validating (e.g., "LoginPage_UsernameField"). + * This value is used by any logging or error handling that is done with respect to the value passed in. + * @param input + * The actual user input data to validate. + * @param type + * The regular expression name which maps to the actual regular expression from "ESAPI.properties". + * @param maxLength + * The maximum {@code String} length allowed for {@code input}. + * @param allowNull + * If {@code allowNull} is true then an input that is NULL or an empty string will be legal. + * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException. + * @param errorList The error list to which any {@code ValidationException} messages are added. + * * @throws IntrusionException Input likely indicates an attack. */ boolean isValidInput(String context, String input, String type, int maxLength, boolean allowNull, ValidationErrorList errorList) throws IntrusionException; @@ -85,28 +123,72 @@ public interface Validator { * Calls {@link #getValidInput(String, String, String, int, boolean, boolean)} * and returns true if no exceptions are thrown. * + * @param context + * A descriptive name of the parameter that you are validating (e.g., "LoginPage_UsernameField"). + * This value is used by any logging or error handling that is done with respect to the value passed in. + * @param input + * The actual user input data to validate. + * @param type + * The regular expression name which maps to the actual regular expression from "ESAPI.properties". + * @param maxLength + * The maximum {@code String} length allowed for {@code input}. + * @param allowNull + * If {@code allowNull} is true then an input that is NULL or an empty string will be legal. + * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException. + * @param canonicalize + * If true, the {@code input} if first canonicalized before being validated. + * * @throws IntrusionException Input likely indicates an attack. */ boolean isValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize) throws IntrusionException; /** - * Returns true if {@code input} is valid, + * Returns true if {@code input} is valid; * any validation exceptions are added to the supplied {@code errorList}. ** Calls {@link #getValidInput(String, String, String, int, boolean, boolean)} * and returns true if no exceptions are thrown. * + * @param context + * A descriptive name of the parameter that you are validating (e.g., "LoginPage_UsernameField"). + * This value is used by any logging or error handling that is done with respect to the value passed in. + * @param input + * The actual user input data to validate. + * @param type + * The regular expression name which maps to the actual regular expression from "ESAPI.properties". + * @param maxLength + * The maximum {@code String} length allowed for {@code input}. + * @param allowNull + * If {@code allowNull} is true then an input that is NULL or an empty string will be legal. + * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException. + * @param canonicalize + * If true, the {@code input} if first canonicalized before being validated. + * @param errorList The error list to which any {@code ValidationException} messages are added. + * * @throws IntrusionException Input likely indicates an attack. */ boolean isValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize, ValidationErrorList errorList) throws IntrusionException; /** - * Returns validated canonicalized {@code input} as a String. + * Returns the validated, canonicalized {@code input} as a String. *
* Calls {@link #getValidInput(String, String, String, int, boolean, boolean)} * with {@code canonicalize=true}. * - * @throws ValidationException Input is invalid. + * @param context + * A descriptive name of the parameter that you are validating (e.g., "LoginPage_UsernameField"). + * This value is used by any logging or error handling that is done with respect to the value passed in. + * @param input + * The actual user input data to validate. + * @param type + * The regular expression name which maps to the actual regular expression from "ESAPI.properties". + * @param maxLength + * The maximum {@code String} length allowed for {@code input}. + * @param allowNull + * If {@code allowNull} is true then an input that is NULL or an empty string will be legal. + * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException. + * + * @throws ValidationException Input is invalid, based on the regex associated with {@code type}. * @throws IntrusionException Input likely indicates an attack. */ String getValidInput(String context, String input, String type, int maxLength, boolean allowNull) throws ValidationException, IntrusionException; @@ -134,7 +216,7 @@ public interface Validator { * * @return The canonicalized user input. * - * @throws ValidationException Input is invalid. + * @throws ValidationException Input is invalid, based on the regex associated with {@code type}. * @throws IntrusionException Input likely indicates an attack. */ String getValidInput(String context, String input, String type, int maxLength, boolean allowNull, boolean canonicalize) throws ValidationException, IntrusionException; @@ -200,7 +282,7 @@ public interface Validator { * * @return A valid date as a {@link java.util.Date} * - * @throws ValidationException Input is invalid. + * @throws ValidationException Input is invalid, based on the regex associated with {@code type}. * @throws IntrusionException Input likely indicates an attack. */ Date getValidDate(String context, String input, DateFormat format, boolean allowNull) throws ValidationException, IntrusionException; @@ -222,7 +304,13 @@ public interface Validator { * and returns true if no exceptions are thrown. * * @throws IntrusionException Input likely indicates an attack. + * + * @deprecated Deprecated as of ESAPI 2.5.3.0. This method will be removed in 1 year + * after this ESAPI 2.5.3.0 release. + * + * @see GitHub Security Advisory: Validator.isValidSafeHTML is being deprecated and will be deleted in 1 year */ + @Deprecated boolean isValidSafeHTML(String context, String input, int maxLength, boolean allowNull) throws IntrusionException; /** @@ -233,44 +321,73 @@ public interface Validator { * and returns true if no exceptions are thrown. * * @throws IntrusionException Input likely indicates an attack. + * + * @deprecated Deprecated as of ESAPI 2.5.3.0. This method will be removed in 1 year + * after this ESAPI 2.5.3.0 release. + * + * @see GitHub Security Advisory: Validator.isValidSafeHTML is being deprecated and will be deleted in 1 year */ + @Deprecated boolean isValidSafeHTML(String context, String input, int maxLength, boolean allowNull, ValidationErrorList errorList) throws IntrusionException; /** - * Returns canonicalized and validated "safe" HTML that does not contain unwanted scripts in the body, attributes, CSS, URLs, or anywhere else. + * Canonicalize and then sanitize the input so that it is "safe" for renderinger in an HTML context (i.e., that + * it does not contain unwanted scripts in the body, attributes, CSS, URLs, or anywhere else). Note that the resulting + * returned value may omit input that is considered dangerous and cannot be safely sanitized and other input + * that gets HTML encoded (e.g., a single quote (') might get chaged to """). *
- * The default behavior of this check depends on the {@code antisamy-esapi.xml} configuration. - * Implementors should reference the OWASP AntiSamy project for ideas - * on how to do HTML validation in a whitelist way, as this is an extremely difficult problem. + * The default behavior of this check depends on the {@code antisamy-esapi.xml} AntiSamy policy configuration file + * (or an alternate filename, specified via the "Validator.HtmlValidationConfigurationFile" property in your + * {@code ESAPI.properties} file. Implementors wishing to alter the AntiSamy policy configuration file should + * reference the OWASP AntiSamy project for ideas + * on how to do HTML validation in a allow-list way, as this is an extremely difficult problem. * * @param context - * A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). + * A descriptive name of the parameter that you are validating (e.g., "LoginPage_UsernameField"). * This value is used by any logging or error handling that is done with respect to the value passed in. * @param input * The actual user input data to validate. * @param maxLength - * The maximum String length allowed. + * The maximum {@code String} length allowed for {@code input}. * @param allowNull * If {@code allowNull} is true then an input that is NULL or an empty string will be legal. * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException. * - * @return Valid safe HTML + * @return A string representing the canonicalized and sanitized input that is safe for rendering in an HTML context. * - * @throws ValidationException Input is invalid. + * @throws ValidationException Input is invalid, based on the regex associated with {@code type}. * @throws IntrusionException Input likely indicates an attack. */ String getValidSafeHTML(String context, String input, int maxLength, boolean allowNull) throws ValidationException, IntrusionException; /** - * Returns canonicalized and validated "safe" HTML that does not contain unwanted scripts in the body, attributes, CSS, URLs, or anywhere else, - * any validation exceptions are added to the supplied {@code errorList}. + * Canonicalize and then sanitize the input so that it is "safe" for renderinger in an HTML context (i.e., that + * it does not contain unwanted scripts in the body, attributes, CSS, URLs, or anywhere else). Note that the resulting + * returned value may omit input that is considered dangerous and cannot be safely sanitized and other input + * that gets HTML encoded (e.g., a single quote (') might get chaged to """). *
- * The default behavior of this check depends on the {@code antisamy-esapi.xml} configuration. - * Implementors should reference the OWASP AntiSamy project for ideas - * on how to do HTML validation in a whitelist way, as this is an extremely difficult problem. + * The default behavior of this check depends on the {@code antisamy-esapi.xml} AntiSamy policy configuration file + * (or an alternate filename, specified via the "Validator.HtmlValidationConfigurationFile" property in your + * {@code ESAPI.properties} file. Implementors wishing to alter the AntiSamy policy configuration file should + * reference the OWASP AntiSamy project for ideas + * on how to do HTML validation in a allow-list way, as this is an extremely difficult problem. *
* Calls {@link #getValidSafeHTML(String, String, int, boolean)}.
*
+ * @param context
+ * A descriptive name of the parameter that you are validating (e.g., "LoginPage_UsernameField").
+ * This value is used by any logging or error handling that is done with respect to the value passed in.
+ * @param input
+ * The actual user input data to validate.
+ * @param maxLength
+ * The maximum {@code String} length allowed for {@code input}.
+ * @param allowNull
+ * If {@code allowNull} is true then an input that is NULL or an empty string will be legal.
+ * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException.
+ * @param errorList The error list to which any {@code ValidationException} messages are added.
+ *
+ * @return A string representing the canonicalized and sanitized input that is safe for rendering in an HTML context.
+ *
* @throws IntrusionException Input likely indicates an attack.
*/
String getValidSafeHTML(String context, String input, int maxLength, boolean allowNull, ValidationErrorList errorList) throws IntrusionException;
@@ -303,7 +420,7 @@ public interface Validator {
* and input that is clearly an attack will generate a descriptive IntrusionException.
*
* @param context
- * A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField).
+ * A descriptive name of the parameter that you are validating (e.g., PaymentPage_CreditCard).
* This value is used by any logging or error handling that is done with respect to the value passed in.
* @param input
* The actual user input data to validate.
@@ -313,7 +430,7 @@ public interface Validator {
*
* @return A valid credit card number
*
- * @throws ValidationException Input is invalid.
+ * @throws ValidationException Input is invalid because it doesn't appear to be a valid credit card account number.
* @throws IntrusionException Input likely indicates an attack.
*/
String getValidCreditCard(String context, String input, boolean allowNull) throws ValidationException, IntrusionException;
@@ -367,7 +484,7 @@ public interface Validator {
*
* @return A valid directory path
*
- * @throws ValidationException Input is invalid.
+ * @throws ValidationException Input is invalid (e.g., the provided input is not a directory).
* @throws IntrusionException Input likely indicates an attack.
*/
String getValidDirectoryPath(String context, String input, File parent, boolean allowNull) throws ValidationException, IntrusionException;
@@ -459,7 +576,9 @@ public interface Validator {
*
* @return A valid file name
*
- * @throws ValidationException Input is invalid.
+ * @throws ValidationException Input is invalid (e.g., {@code input} refers to a non-existant file, does not have a
+ * valid file extension as per {@code allowedExtensions}, does not match the canonicalized path,
+ * exceeds a maximum length of 255 characters, etc.
* @throws IntrusionException Input likely indicates an attack.
*/
String getValidFileName(String context, String input, List
* Calls {@link #getValidNumber(String, String, long, long, boolean)}.
*
+ * @param context
+ * A descriptive name of the parameter that you are validating (e.g., "OrderPage_Quantity").
+ * This value is used by any logging or error handling that is done with respect to the value passed in.
+ * @param input
+ * The actual user input data to validate.
+ * @param minValue
+ * Lowest legal value for input.
+ * @param maxValue
+ * Highest legal value for input.
+ * @param allowNull
+ * If {@code allowNull} is true then an input that is NULL or an empty string will be legal.
+ * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException.
+ * @param errorList The error list to which any {@code ValidationException} messages are added.
+ *
* @throws IntrusionException Input likely indicates an attack.
*/
Double getValidNumber(String context, String input, long minValue, long maxValue, boolean allowNull, ValidationErrorList errorList) throws IntrusionException;
@@ -537,6 +672,19 @@ public interface Validator {
* Calls {@link #getValidInteger(String, String, int, int, boolean)},
* and returns true if no exceptions are thrown.
*
+ * @param context
+ * A descriptive name of the parameter that you are validating (e.g., "OrderPage_Quantity").
+ * This value is used by any logging or error handling that is done with respect to the value passed in.
+ * @param input
+ * The actual user input data to validate.
+ * @param minValue
+ * Lowest legal value for input.
+ * @param maxValue
+ * Highest legal value for input.
+ * @param allowNull
+ * If {@code allowNull} is true then an input that is NULL or an empty string will be legal.
+ * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException.
+ *
* @throws IntrusionException Input likely indicates an attack.
*/
boolean isValidInteger(String context, String input, int minValue, int maxValue, boolean allowNull) throws IntrusionException;
@@ -548,6 +696,20 @@ public interface Validator {
* Calls {@link #getValidInteger(String, String, int, int, boolean)}
* and returns true if no exceptions are thrown.
*
+ * @param context
+ * A descriptive name of the parameter that you are validating (e.g., "OrderPage_Quantity").
+ * This value is used by any logging or error handling that is done with respect to the value passed in.
+ * @param input
+ * The actual user input data to validate.
+ * @param minValue
+ * Lowest legal value for input.
+ * @param maxValue
+ * Highest legal value for input.
+ * @param allowNull
+ * If {@code allowNull} is true then an input that is NULL or an empty string will be legal.
+ * If {@code allowNull} is false then NULL or an empty String will throw a ValidationException.
+ * @param errorList The error list to which any {@code ValidationException} messages are added.
+ *
* @throws IntrusionException Input likely indicates an attack.
*/
boolean isValidInteger(String context, String input, int minValue, int maxValue, boolean allowNull, ValidationErrorList errorList) throws IntrusionException;
@@ -559,7 +721,7 @@ public interface Validator {
* and input that is clearly an attack will generate a descriptive IntrusionException.
*
* @param context
- * A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField).
+ * A descriptive name of the parameter that you are validating (e.g., OrderPage_Quantity).
* This value is used by any logging or error handling that is done with respect to the value passed in.
* @param input
* The actual input data to validate.
@@ -573,7 +735,7 @@ public interface Validator {
*
* @return A validated number as an integer.
*
- * @throws ValidationException Input is invalid.
+ * @throws ValidationException Input is not a valid integer in the range of [{@code minValue}, {@code maxValue}].
* @throws IntrusionException Input likely indicates an attack.
*/
Integer getValidInteger(String context, String input, int minValue, int maxValue, boolean allowNull) throws ValidationException, IntrusionException;
diff --git a/src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java b/src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java
index 50c4ba4d5..8cba81982 100644
--- a/src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java
+++ b/src/main/java/org/owasp/esapi/reference/DefaultSecurityConfiguration.java
@@ -1076,7 +1076,7 @@ public String getDigitalSignatureAlgorithm() {
* {@inheritDoc}
*/
public int getDigitalSignatureKeyLength() {
- return getESAPIProperty(DIGITAL_SIGNATURE_KEY_LENGTH, 1024);
+ return getESAPIProperty(DIGITAL_SIGNATURE_KEY_LENGTH, 2048);
}
/**
diff --git a/src/main/java/org/owasp/esapi/reference/crypto/JavaEncryptor.java b/src/main/java/org/owasp/esapi/reference/crypto/JavaEncryptor.java
index 63022925e..81ff5b0e5 100644
--- a/src/main/java/org/owasp/esapi/reference/crypto/JavaEncryptor.java
+++ b/src/main/java/org/owasp/esapi/reference/crypto/JavaEncryptor.java
@@ -106,9 +106,9 @@ public static Encryptor getInstance() throws EncryptionException {
// digital signatures
private static PrivateKey privateKey = null;
private static PublicKey publicKey = null;
- private static String signatureAlgorithm = "SHA1withDSA";
- private static String randomAlgorithm = "SHA1PRNG";
- private static int signatureKeyLength = 1024;
+ private static String signatureAlgorithm = "SHA256withDSA";
+ private static String randomAlgorithm = "SHA1PRNG"; // SHA1 is fine as a CSRNG.
+ private static int signatureKeyLength = 2048;
// hashing
private static String hashAlgorithm = "SHA-512";
diff --git a/src/test/java/org/owasp/esapi/reference/validation/HTMLValidationRuleClasspathTest.java b/src/test/java/org/owasp/esapi/reference/validation/HTMLValidationRuleClasspathTest.java
index 0170a9214..d7ac1ceff 100644
--- a/src/test/java/org/owasp/esapi/reference/validation/HTMLValidationRuleClasspathTest.java
+++ b/src/test/java/org/owasp/esapi/reference/validation/HTMLValidationRuleClasspathTest.java
@@ -36,28 +36,39 @@
import static org.owasp.esapi.PropNames.VALIDATOR_HTML_VALIDATION_CONFIGURATION_FILE;
/**
- * The Class HTMLValidationRuleThrowsTest.
- *
- * Based on original test cases, testGetValidSafeHTML() and
- * testIsValidSafeHTML() from ValidatorTest by
+ * The class {@code HTMLValidationRuleClasspathTest} is used to test ESAPI where
+ * the AntiSamy policy file is located in a non-standard place. It is based
+ * on te original test cases, testGetValidSafeHTML() and
+ * testIsValidSafeHTML() from the file {@code ValidatorTest} originally written
+ * by
* Mike Fauzy (mike.fauzy@aspectsecurity.com) and
* Jeff Williams (jeff.williams@aspectsecurity.com)
- * that were originally part of src/test/java/org/owasp/esapi/reference/ValidatorTest.java.
+ * that were originally part of "src/test/java/org/owasp/esapi/reference/ValidatorTest.java".
*
- * This class tests the cases where the new ESAPI.property
- * Validator.HtmlValidationAction
+ * This class tests the case of a non-standard AntiSamy policy file along with
+ * the case where the new ESAPI.property
+ * {@code Validator.HtmlValidationAction}
* is set to "throw", which causes certain calls to
* ESAPI.validator().getValidSafeHTML() or ESAPI.validator().isValidSafeHTML()
* to throw a ValidationException rather than simply logging a warning and returning
* the cleansed (sanitizied) output when certain unsafe input is encountered.
+ *
+ * It should be noted that several of the tests in this file are deprecated because
+ * they use {@code Validator.isValidSafeHTML} which is deprecated. See the
+ * deprecation warnings for those methods respective Javadoc for further
+ * details.
*/
public class HTMLValidationRuleClasspathTest {
- /** The intentionally non-compliant AntiSamy policy file. We don't intend to
- * actually use it for anything.
+ /** The intentionally non-compliant (to the AntiSamy XSD) AntiSamy policy file. We don't intend to
+ * actually use it for anything other than to test that we report
+ * non-compliant AntiSamy policy files in a sane manner.
*/
private static final String INVALID_ANTISAMY_POLICY_FILE = "antisamy-InvalidPolicy.xml";
- /** The intentionally non-compliant AntiSamy policy file. We don't intend to
- * actually use it for anything.
+
+ /** A compliant AntiSamy policy file that is just located in a non-standard
+ * place. We don't intend to * actually use it for anything other
+ * than testing. Otherwise, it's mostly identical to the AntiSamy policy
+ * file "src/test/resources/esapi/antisamy-esapi.xml".
*/
private static final String ANTISAMY_POLICY_FILE_NONSTANDARD_LOCATION = "antisamy-esapi-CP.xml";
@@ -131,6 +142,7 @@ public void testGetValidSafeHTML() throws Exception {
String[] testInput = {
// These first two don't cause AntiSamy to throw.
+ // They are only listed here for completeness.
// "Test. Aspect Security",
// "Test. <alert(document.cookie)"));
assertEquals("Test. alert(document.cookie)", rule.getSafe("test", "Test. alert(document.cookie)"));
assertEquals("Test. alert(document.cookie)", rule.getSafe("test", "Test. alert(document.cookie)"));
- // TODO: ENHANCE waiting for a way to validate text headed for an attribute for scripts
- // This would be nice to catch, but just looks like text to AntiSamy
- // assertFalse(instance.isValidSafeHTML("test", "\" onload=\"alert(document.cookie)\" "));
- // String result4 = instance.getValidSafeHTML("test", test4);
- // assertEquals("", result4);
}
- // FIXME: Change the method name to reflect the CVE once we have a number for this.
- // Test to confirm that CVE-2022-xxxxx (TBD) is fixed. The cause of this was
- // from a subtle botched regex for 'onsiteURL' in all the versions of
+ // Test to confirm that CVE-2022-24891 is fixed in ESAPI. The cause of this was
+ // from a subtly botched regex for 'onsiteURL' in all the versions of
// antsamy-esapi.xml that had been there as far back as ESAPI 1.4!
//
- // This TBD CVE should arguably get the same CVSSv3 store as the AntiSamy
- // CVE-2021-35043 as the are very similar.
+ // This CVE should arguably get the same CVSSv3 score as the AntiSamy
+ // CVE-2021-35043 as they are very similar.
//
- // Updated: Requested CVE from GitHub CNA on 4/23/2022. See
+ // Updated: Requested CVE from GitHub CNA on 4/23/2022. See also
// https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-q77q-vx4q-xx6q
- // (Which may not be published yet, but is remediated. Waiting on CVE ID to publish.)
@Test
- public void testJavaScriptURL() throws Exception {
- System.out.println("testJavaScriptURL");
+ public void testESAPI_CVE_2022_24891() throws Exception {
+ System.out.println("testESAPI_CVE_2022_24891");
String expectedSafeText = "This is safe from XSS. Trust us!";
String badVoodoo = "" + expectedSafeText + "";
@@ -155,26 +161,129 @@ public void testJavaScriptURL() throws Exception {
// it was never really "broken" in ESAPI's "default configuration" because it is
// triggers an Intrusion Detection when it is checking the canonicalization
// and the ':' trips it up, that that's pretty much irrelevant given
- // the (TBD) CVE mented in the previous test case.
+ // the CVE mentioned in the previous test case.
//
// Note: This test assumes a standard default ESAPI.properties file. In
// particular, the normal canonicalization has to be enabled.
- public void testAntiSamyCVE_2021_35043Fixed() {
- System.out.println("testAntiSamyCVE_2021_35043Fixed");
+ //
+ public void testAntiSamy_CVE_2021_35043Fixed() throws Exception {
+ System.out.println("testAntiSamy_CVE_2021_35043Fixed");
String expectedSafeText = "This is safe from XSS. Trust us!";
// Translates to '" + expectedSafeText + "";
Validator instance = ESAPI.validator();
- // ValidationErrorList errorList = new ValidationErrorList();
- boolean result = instance.isValidSafeHTML("CVE-2021-35043", badVoodoo, 200, false);
- assertTrue( result );
+ String cleansed = instance.getValidSafeHTML("CVE-2021-35043", badVoodoo, 200, false);
+ assertEquals( "", cleansed );
+ }
+
+ ////////// New AntiSamy tests added to ESAPI 2.5.3.0 //////////
+ // Some of these were with the new XSS discoveries in AntiSamy.
+ // Sebastian doesn't think thta ESAPI should be vulnerable to these 2. (They weren't.)
+ @Test
+ public void testQuotesInsideStyles() throws Exception {
+ System.out.println("testQuotesInsideStyles");
+ Validator instance = ESAPI.validator();
+ ValidationErrorList errors = new ValidationErrorList();
+
+ // Added this test because of a fix to AntiSamy that doesn't seem to have affected ESAPI because of our
+ // very restrictive default AntiSamy policy file. However, with some of AntiSamy policy files, this used
+ // to cause any quoted (double or single) string identifier in CSS was being enclosed in quotes.
+ // That resulted in quotes enclosed by more quotes in some cases without any kind of escape or
+ // transformation. It never did that for ESAPI, but it seemed like a good test to add.
+ String input =
+ "Safe Text";
+ String expected = "Safe Text"; // We expect the span tag to be completely filtered out & only the tag contents to remain.
+ String output = instance.getValidSafeHTML("testQuotesInsideStyles-1", input, 250, false);
+ assertEquals(expected, output);
+
+ input = "Safe Text"; // Slight variation
+ output = instance.getValidSafeHTML("testQuotesInsideStyle-2", input, 250, false);
+ assertEquals(expected, output);
+
+ assertTrue(errors.size() == 0);
}
+ @Test
+ public void testSmuggledTagsInStyleContentCase() throws Exception {
+ System.out.println("testSmuggledTagsInStyleContentCase");
+
+ Validator instance = ESAPI.validator();
+ ValidationErrorList errors = new ValidationErrorList();
+
+ // Style tag processing was not handling correctly the value set to its child node that should
+ // be only text. On some mutation scenarios due to filtering tags by default, content was being
+ // smuggled and not properly sanitized by the output serializer.
+ //
+ // Not expected to affect ESAPI because our default AntiSamy policy file does NOT have:
+ //