Skip to content

Commit 0871dcd

Browse files
author
Chris Schmidt
committed
Added canonicalize method to Validator interface and base AccessController interface
1 parent 8a05210 commit 0871dcd

3 files changed

Lines changed: 131 additions & 0 deletions

File tree

‎src/main/java/org/owasp/esapi/core/accesscontrol/AccessControlException.java‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package org.owasp.esapi.core.accesscontrol;
2+
3+
import org.owasp.esapi.core.EnterpriseSecurityException;
4+
5+
import java.io.Serializable;
6+
7+
public class AccessControlException extends EnterpriseSecurityException {
8+
private Serializable resourceReference;
9+
10+
/**
11+
* Creates a new instance of EnterpriseSecurityException. This exception is automatically logged, so that simply by
12+
* using this API, applications will generate an extensive security log. In addition, this exception is
13+
* automatically registered with the IntrusionDetector, so that quotas can be checked.
14+
* <p/>
15+
* It should be noted that messages that are intended to be displayed to the user should be safe for display. In
16+
* other words, don't pass in unsanitized data here. Also could hold true for the logging message depending on the
17+
* context of the exception.
18+
*
19+
* @param userMessage the message displayed to the user
20+
* @param logMessage the message logged
21+
*/
22+
public AccessControlException(String userMessage, String logMessage, Serializable resourceReference) {
23+
super(userMessage, logMessage);
24+
this.resourceReference = resourceReference;
25+
}
26+
27+
/**
28+
* Creates a new instance of EnterpriseSecurityException that includes a root cause Throwable.
29+
* <p/>
30+
* It should be noted that messages that are intended to be displayed to the user should be safe for display. In
31+
* other words, don't pass in unsanitized data here. Also could hold true for the logging message depending on the
32+
* context of the exception.
33+
*
34+
* @param userMessage the message displayed to the user
35+
* @param logMessage the message logged
36+
* @param cause the cause
37+
*/
38+
public AccessControlException(String userMessage, String logMessage, Throwable cause, Serializable resourceReference) {
39+
super(userMessage, logMessage, cause);
40+
this.resourceReference = resourceReference;
41+
}
42+
43+
public Serializable getResourceReference() {
44+
return resourceReference;
45+
}
46+
}

‎src/main/java/org/owasp/esapi/core/accesscontrol/AccessController.java‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
package org.owasp.esapi.core.accesscontrol;
2+
3+
/**
4+
* The AccessController interface defines a set of methods that can be used in a wide variety of applications to
5+
* enforce access control. In most applications, access control must be performed in multiple different locations across
6+
* the various application layers.
7+
* <P>
8+
* The implementation of this interface will need to access the current User object (from Authenticator.getCurrentUser())
9+
* to determine roles or permissions. In addition, the implementation will also need information about the resources that
10+
* are being accessed. Using the user information and the resource information, the implementation should return an
11+
* access control decision.
12+
* <P>
13+
* The point of the ESAPI access control interface is to centralize access control logic behind easy to use calls like
14+
* assertAuthorized() so that access control is easy to use and easy to verify. Here is an example of a very
15+
* straightforward to implement, understand, and verify ESAPI access control check:
16+
*
17+
* <pre>
18+
* try {
19+
* ESAPI.accessController().assertAuthorized("businessFunction", runtimeData);
20+
* // execute BUSINESS_FUNCTION
21+
* } catch (AccessControlException ace) {
22+
* ... attack in progress
23+
* }
24+
* </pre>
25+
*
26+
* Note that in the user interface layer, access control checks can be used to control whether particular controls are
27+
* rendered or not. These checks are supposed to fail when an unauthorized user is logged in, and do not represent
28+
* attacks. Remember that regardless of how the user interface appears, an attacker can attempt to invoke any business
29+
* function or access any data in your application. Therefore, access control checks in the user interface should be
30+
* repeated in both the business logic and data layers.
31+
*
32+
* <pre>
33+
* &lt;% if ( ESAPI.accessController().isAuthorized( "businessFunction", runtimeData ) ) { %&gt;
34+
* &lt;a href=&quot;/doAdminFunction&quot;&gt;ADMIN&lt;/a&gt;
35+
* &lt;% } else { %&gt;
36+
* &lt;a href=&quot;/doNormalFunction&quot;&gt;NORMAL&lt;/a&gt;
37+
* &lt;% } %&gt;
38+
* </pre>
39+
*
40+
* @author Mike H. Fauzy ([email protected]) ESAPI v1.6-
41+
* @author Jeff Williams ([email protected]) ESAPI v0-1.5
42+
* @author Chris Schmidt ([email protected]) ESAPI v3.0
43+
*/
44+
public interface AccessController {
45+
/**
46+
* Developers should call isAuthorized to control execution flow. For
47+
* example, if you want to decide whether to display a UI widget in the
48+
* browser using the same logic that you will use to enforce permissions
49+
* on the server, then isAuthorized is the method that you want to use.
50+
*
51+
* Typically, assertAuthorized should be used to enforce permissions on the
52+
* server.
53+
*
54+
* @param key
55+
* @param runtimeParameter
56+
* @return
57+
*/
58+
public boolean isAuthorized(Object key, Object runtimeParameter);
59+
60+
/**
61+
* Developers should call {@code assertAuthorized} to enforce privileged access to
62+
* the system. It should be used to answer the question: "Should execution
63+
* continue." Ideally, the call to <code>assertAuthorized</code> should
64+
* be integrated into the application framework so that it is called
65+
* automatically.
66+
*
67+
* @param key
68+
* @param runtimeParameter
69+
*/
70+
public void assertAuthorized(Object key, Object runtimeParameter) throws AccessControlException;
71+
72+
}

‎src/main/java/org/owasp/esapi/core/validation/Validator.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,4 +40,17 @@ public interface Validator {
4040
* @return True if this validator supports the supplied data, false otherwise.
4141
*/
4242
boolean supports(Object input);
43+
44+
/**
45+
* Canonicalizes the given input to it's simplest form. Implementors should ensure that canonicalize throws
46+
* a {@link ValidationException} if the input contains multiple or mixed encodings in most cases, special cases
47+
* may allow these specific situations.
48+
*
49+
* Validation should invoke this method prior to validating data.
50+
*
51+
* @param input The input to be canonicalized
52+
* @param <T> Data-Type inferred by the input argument
53+
* @return The supplied input reduced to it's simplest form.
54+
*/
55+
<T> T canonicalize(T input) throws ValidationException;
4356
}

0 commit comments

Comments
 (0)