All Downloads are FREE. Search and download functionalities are using the official Maven repository.
  • Log In
  • Register

    • org.owasp.esapi.waf.rules.AuthenticatedRule Maven / Gradle / Ivy

    Go to download

    The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP website. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

    There is a newer version: 2.5.5.0
    Show newest version
    /**
 * OWASP Enterprise Security API (ESAPI)
 * 
 * This file is part of the Open Web Application Security Project (OWASP)
 * Enterprise Security API (ESAPI) project. For details, please see
 * http://www.owasp.org/index.php/ESAPI.
 *
 * Copyright (c) 2009 - The OWASP Foundation
 * 
 * The ESAPI is published by OWASP under the BSD license. You should read and accept the
 * LICENSE before you use, modify, and/or redistribute this software.
 * 
 * @author Arshan Dabirsiaghi Aspect Security
 * @created 2009
 */
package org.owasp.esapi.waf.rules;

import java.util.Iterator;
import java.util.List;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.owasp.esapi.waf.actions.Action;
import org.owasp.esapi.waf.actions.DefaultAction;
import org.owasp.esapi.waf.actions.DoNothingAction;
import org.owasp.esapi.waf.internal.InterceptingHTTPServletResponse;

/**
 * This is the Rule subclass executed for <authentication-rules> rules.
 * @author Arshan Dabirsiaghi
 *
 */
public class AuthenticatedRule extends Rule {

	private String sessionAttribute;
	private Pattern path;
	private List exceptions;

	public AuthenticatedRule(String id, String sessionAttribute, Pattern path, List exceptions) {
		this.sessionAttribute = sessionAttribute;
		this.path = path;
		this.exceptions = exceptions;
		setId(id);
	}

	public Action check(HttpServletRequest request,
			InterceptingHTTPServletResponse response, 
			HttpServletResponse httpResponse) {

		HttpSession session = request.getSession();
		String uri = request.getRequestURI();

		if ( path != null && ! path.matcher(uri).matches() ) {
			return new DoNothingAction();
		}

		if ( session != null && session.getAttribute(sessionAttribute) != null ) {

			return new DoNothingAction();

		} else { /* check if it's one of the exceptions */

			Iterator it = exceptions.iterator();

			while(it.hasNext()) {
				Object o = it.next();
				if ( o instanceof Pattern ) {

					Pattern p = (Pattern)o;
					if ( p.matcher(uri).matches() ) {
						return new DoNothingAction();
					}

				} else if ( o instanceof String ) {

					if ( uri.equals((String)o)) {
						return new DoNothingAction();
					}

				}
			}
		}

		log(request, "User requested unauthenticated access to URI '" + request.getRequestURI() + "' [querystring="+request.getQueryString()+"]");

		return new DefaultAction();
	}

}
    
    
    
    

    




    
    
    © 2015 - 2024 Weber Informatics LLC | Privacy Policy