public class DefaultHTTPUtilities extends Object implements HTTPUtilities
To simplify the interface, some methods use the current request and response that are tracked by ThreadLocal variables in the Authenticator. This means that you must have called ESAPI.authenticator().setCurrentHTTP(request, response) before calling these methods.
Typically, this is done by calling the Authenticator.login() method, which calls setCurrentHTTP() automatically. However if you want to use these methods in another application, you should explicitly call setCurrentHTTP() in your own code. In either case, you *must* call ESAPI.clearCurrent() to clear threadlocal variables before the thread is reused. The advantages of having identity everywhere outweigh the disadvantages of this approach.
HTTPUtilitiesCOOKIE, CSRF_TOKEN_NAME, ESAPI_STATE, HEADER, MAX_COOKIE_LEN, MAX_COOKIE_PAIRS, PARAMETER, REMEMBER_TOKEN_COOKIE_NAME| Constructor and Description |
|---|
DefaultHTTPUtilities()
No arg constructor.
|
| Modifier and Type | Method and Description |
|---|---|
void |
addCookie(javax.servlet.http.Cookie cookie)
Calls addCookie with the *current* request.
|
void |
addCookie(javax.servlet.http.HttpServletResponse response,
javax.servlet.http.Cookie cookie)
Add a cookie to the response after ensuring that there are no encoded or
illegal characters in the name and name and value.
|
String |
addCSRFToken(String href)
Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks.
|
void |
addHeader(javax.servlet.http.HttpServletResponse response,
String name,
String value)
Add a header to the response after ensuring that there are no encoded or
illegal characters in the name and name and value.
|
void |
addHeader(String name,
String value)
Calls addHeader with the *current* request.
|
void |
assertSecureChannel()
Calls assertSecureChannel with the *current* request.
|
void |
assertSecureChannel(javax.servlet.http.HttpServletRequest request)
Ensures the use of SSL to protect any sensitive parameters in the request and
any sensitive data in the response.
|
void |
assertSecureRequest()
Calls assertSecureRequest with the *current* request.
|
void |
assertSecureRequest(javax.servlet.http.HttpServletRequest request)
Ensures that the request uses both SSL and POST to protect any sensitive parameters
in the querystring from being sniffed, logged, bookmarked, included in referer header, etc...
|
javax.servlet.http.HttpSession |
changeSessionIdentifier()
Calls changeSessionIdentifier with the *current* request.
|
javax.servlet.http.HttpSession |
changeSessionIdentifier(javax.servlet.http.HttpServletRequest request)
Invalidate the existing session after copying all of its contents to a newly created session with a new session id.
|
void |
clearCurrent()
Clears the current HttpRequest and HttpResponse associated with the current thread.
|
String |
decryptHiddenField(String encrypted)
Decrypts an encrypted hidden field value and returns the cleartext.
|
Map<String,String> |
decryptQueryString(String encrypted)
Takes an encrypted querystring and returns a Map containing the original parameters.
|
Map<String,String> |
decryptStateFromCookie()
Calls decryptStateFromCookie with the *current* request.
|
Map<String,String> |
decryptStateFromCookie(javax.servlet.http.HttpServletRequest request)
Retrieves a map of data from a cookie encrypted with encryptStateInCookie().
|
String |
encryptHiddenField(String value)
Encrypts a hidden field value for use in HTML.
|
String |
encryptQueryString(String query)
Takes a querystring (everything after the question mark in the URL) and returns an encrypted string containing the parameters.
|
void |
encryptStateInCookie(javax.servlet.http.HttpServletResponse response,
Map<String,String> cleartext)
Stores a Map of data in an encrypted cookie.
|
void |
encryptStateInCookie(Map<String,String> cleartext)
Calls encryptStateInCookie with the *current* response.
|
String |
getCookie(javax.servlet.http.HttpServletRequest request,
String name)
A safer replacement for getCookies() in HttpServletRequest that returns the canonicalized
value of the named cookie after "global" validation against the
general type defined in ESAPI.properties.
|
String |
getCookie(String name)
Calls getCookie with the *current* response.
|
String |
getCSRFToken()
Returns the current user's CSRF token.
|
javax.servlet.http.HttpServletRequest |
getCurrentRequest()
Retrieves the current HttpServletRequest
|
javax.servlet.http.HttpServletResponse |
getCurrentResponse()
Retrieves the current HttpServletResponse
|
List<File> |
getFileUploads()
Calls getFileUploads with the *current* request, default upload directory, and default allowed file extensions
|
List<File> |
getFileUploads(javax.servlet.http.HttpServletRequest request)
Call getFileUploads with the specified request, default upload directory, and default allowed file extensions
|
List<File> |
getFileUploads(javax.servlet.http.HttpServletRequest request,
File finalDir)
Call getFileUploads with the specified request, specified upload directory, and default allowed file extensions
|
List<File> |
getFileUploads(javax.servlet.http.HttpServletRequest request,
File finalDir,
List allowedExtensions)
Extract uploaded files from a multipart HTTP requests.
|
String |
getHeader(javax.servlet.http.HttpServletRequest request,
String name)
A safer replacement for getHeader() in HttpServletRequest that returns the canonicalized
value of the named header after "global" validation against the
general type defined in ESAPI.properties.
|
String |
getHeader(String name)
Calls getHeader with the *current* request.
|
static HTTPUtilities |
getInstance() |
String |
getParameter(javax.servlet.http.HttpServletRequest request,
String name)
A safer replacement for getParameter() in HttpServletRequest that returns the canonicalized
value of the named parameter after "global" validation against the
general type defined in ESAPI.properties.
|
String |
getParameter(String name)
Calls getParameter with the *current* request.
|
<T> T |
getRequestAttribute(javax.servlet.http.HttpServletRequest request,
String key)
Gets a typed attribute from the
HttpServletRequest associated
with the passed in request. |
<T> T |
getRequestAttribute(String key)
Gets a typed attribute from the
HttpServletRequest associated
with the caller thread. |
<T> T |
getSessionAttribute(javax.servlet.http.HttpSession session,
String key)
Gets a typed attribute from the passed in session.
|
<T> T |
getSessionAttribute(String key)
Gets a typed attribute from the session associated with the calling thread.
|
void |
killAllCookies()
Calls killAllCookies with the *current* request and response.
|
void |
killAllCookies(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
Kill all cookies received in the last request from the browser.
|
void |
killCookie(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
String name)
Kills the specified cookie by setting a new cookie that expires immediately.
|
void |
killCookie(String name)
Calls killCookie with the *current* request and response.
|
void |
logHTTPRequest()
Calls logHTTPRequest with the *current* request and logger.
|
void |
logHTTPRequest(javax.servlet.http.HttpServletRequest request,
Logger logger)
Format the Source IP address, URL, URL parameters, and all form
parameters into a string suitable for the log file.
|
void |
logHTTPRequest(javax.servlet.http.HttpServletRequest request,
Logger logger,
List parameterNamesToObfuscate)
Formats an HTTP request into a log suitable string.
|
void |
sendForward(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
String location)
This method performs a forward to any resource located inside the WEB-INF directory.
|
void |
sendForward(String location)
Calls sendForward with the *current* request and response.
|
void |
sendRedirect(javax.servlet.http.HttpServletResponse response,
String location)
This method performs a forward to any resource located inside the WEB-INF directory.
|
void |
sendRedirect(String location)
Calls sendRedirect with the *current* response.
|
void |
setContentType()
Calls setContentType with the *current* request and response.
|
void |
setContentType(javax.servlet.http.HttpServletResponse response)
Set the content type character encoding header on every HttpServletResponse in order to limit
the ways in which the input data can be represented.
|
void |
setCurrentHTTP(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
Stores the current HttpRequest and HttpResponse so that they may be readily accessed throughout
ESAPI (and elsewhere)
|
void |
setHeader(javax.servlet.http.HttpServletResponse response,
String name,
String value)
Add a header to the response after ensuring that there are no encoded or
illegal characters in the name and value.
|
void |
setHeader(String name,
String value)
Calls setHeader with the *current* response.
|
void |
setNoCacheHeaders()
Calls setNoCacheHeaders with the *current* response.
|
void |
setNoCacheHeaders(javax.servlet.http.HttpServletResponse response)
Set headers to protect sensitive information against being cached in the browser.
|
String |
setRememberToken(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
String password,
int maxAge,
String domain,
String path)
Set a cookie containing the current User's remember me token for automatic authentication.
|
String |
setRememberToken(String password,
int maxAge,
String domain,
String path)
Calls setNoCacheHeaders with the *current* response.
|
void |
verifyCSRFToken()
Calls verifyCSRFToken with the *current* request.
|
void |
verifyCSRFToken(javax.servlet.http.HttpServletRequest request)
Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and
throws an IntrusionException if it is missing.
|
public static HTTPUtilities getInstance()
public void addCookie(javax.servlet.http.Cookie cookie)
addCookie in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void addCookie(javax.servlet.http.HttpServletResponse response,
javax.servlet.http.Cookie cookie)
addCookie in interface HTTPUtilitiespublic String addCSRFToken(String href)
addCSRFToken in interface HTTPUtilitieshref - the URL to which the CSRF token will be appendedpublic void addHeader(String name, String value)
addHeader in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void addHeader(javax.servlet.http.HttpServletResponse response,
String name,
String value)
addHeader in interface HTTPUtilitiespublic void assertSecureChannel()
throws AccessControlException
assertSecureChannel in interface HTTPUtilitiesAccessControlExceptionHTTPUtilities#assertSecureChannel(HttpServletRequest)},
HTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void assertSecureChannel(javax.servlet.http.HttpServletRequest request)
throws AccessControlException
assertSecureChannel in interface HTTPUtilitiesAccessControlException - if security constraints are not metpublic void assertSecureRequest()
throws AccessControlException
assertSecureRequest in interface HTTPUtilitiesAccessControlExceptionHTTPUtilities#assertSecureRequest(HttpServletRequest)},
HTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void assertSecureRequest(javax.servlet.http.HttpServletRequest request)
throws AccessControlException
assertSecureRequest in interface HTTPUtilitiesAccessControlException - if security constraints are not metpublic javax.servlet.http.HttpSession changeSessionIdentifier()
throws AuthenticationException
changeSessionIdentifier in interface HTTPUtilitiesAuthenticationExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public javax.servlet.http.HttpSession changeSessionIdentifier(javax.servlet.http.HttpServletRequest request)
throws AuthenticationException
changeSessionIdentifier in interface HTTPUtilitiesAuthenticationException - the exceptionpublic void clearCurrent()
clearCurrent in interface HTTPUtilitiesESAPI.clearCurrent()public String decryptHiddenField(String encrypted)
decryptHiddenField in interface HTTPUtilitiesencrypted - hidden field value to decryptpublic Map<String,String> decryptQueryString(String encrypted) throws EncryptionException
decryptQueryString in interface HTTPUtilitiesencrypted - the encrypted querystring to decryptEncryptionExceptionpublic Map<String,String> decryptStateFromCookie() throws EncryptionException
decryptStateFromCookie in interface HTTPUtilitiesEncryptionExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public Map<String,String> decryptStateFromCookie(javax.servlet.http.HttpServletRequest request) throws EncryptionException
decryptStateFromCookie in interface HTTPUtilitiesrequest - EncryptionExceptionpublic String encryptHiddenField(String value) throws EncryptionException
encryptHiddenField in interface HTTPUtilitiesvalue - the cleartext value of the hidden fieldEncryptionExceptionpublic String encryptQueryString(String query) throws EncryptionException
encryptQueryString in interface HTTPUtilitiesquery - the querystring to encryptEncryptionExceptionpublic void encryptStateInCookie(javax.servlet.http.HttpServletResponse response,
Map<String,String> cleartext)
throws EncryptionException
encryptStateInCookie in interface HTTPUtilitiesEncryptionExceptionpublic void encryptStateInCookie(Map<String,String> cleartext) throws EncryptionException
encryptStateInCookie in interface HTTPUtilitiesEncryptionExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public String getCookie(javax.servlet.http.HttpServletRequest request, String name) throws ValidationException
getCookie in interface HTTPUtilitiesValidationExceptionpublic String getCookie(String name) throws ValidationException
getCookie in interface HTTPUtilitiesValidationExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public String getCSRFToken()
getCSRFToken in interface HTTPUtilitiespublic javax.servlet.http.HttpServletRequest getCurrentRequest()
getCurrentRequest in interface HTTPUtilitiespublic javax.servlet.http.HttpServletResponse getCurrentResponse()
getCurrentResponse in interface HTTPUtilitiespublic List<File> getFileUploads() throws ValidationException
getFileUploads in interface HTTPUtilitiesValidationExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public List<File> getFileUploads(javax.servlet.http.HttpServletRequest request) throws ValidationException
getFileUploads in interface HTTPUtilitiesValidationExceptionpublic List<File> getFileUploads(javax.servlet.http.HttpServletRequest request, File finalDir) throws ValidationException
getFileUploads in interface HTTPUtilitiesValidationExceptionpublic List<File> getFileUploads(javax.servlet.http.HttpServletRequest request, File finalDir, List allowedExtensions) throws ValidationException
HTTPUtilities.getCurrentRequest() to obtain the HttpServletRequest objectgetFileUploads in interface HTTPUtilitiesValidationException - if the file fails validationpublic String getHeader(javax.servlet.http.HttpServletRequest request, String name) throws ValidationException
getHeader in interface HTTPUtilitiesValidationExceptionpublic String getHeader(String name) throws ValidationException
getHeader in interface HTTPUtilitiesValidationExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public String getParameter(javax.servlet.http.HttpServletRequest request, String name) throws ValidationException
getParameter in interface HTTPUtilitiesValidationExceptionpublic String getParameter(String name) throws ValidationException
getParameter in interface HTTPUtilitiesValidationExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void killAllCookies()
killAllCookies in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void killAllCookies(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
killAllCookies in interface HTTPUtilitiesrequest - response - public void killCookie(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
String name)
killCookie in interface HTTPUtilitiesrequest - response - name - public void killCookie(String name)
killCookie in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void logHTTPRequest()
logHTTPRequest in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void logHTTPRequest(javax.servlet.http.HttpServletRequest request,
Logger logger)
logHTTPRequest in interface HTTPUtilitieslogger - the logger to write the request topublic void logHTTPRequest(javax.servlet.http.HttpServletRequest request,
Logger logger,
List parameterNamesToObfuscate)
logHTTPRequest in interface HTTPUtilitiesrequest - logger - the logger to write the request toparameterNamesToObfuscate - the sensitive parameterspublic void sendForward(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response,
String location)
throws AccessControlException,
javax.servlet.ServletException,
IOException
sendForward in interface HTTPUtilitieslocation - the URL to forward to, including parametersAccessControlExceptionjavax.servlet.ServletExceptionIOExceptionpublic void sendForward(String location) throws AccessControlException, javax.servlet.ServletException, IOException
sendForward in interface HTTPUtilitiesAccessControlExceptionjavax.servlet.ServletExceptionIOExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void sendRedirect(javax.servlet.http.HttpServletResponse response,
String location)
throws AccessControlException,
IOException
sendRedirect in interface HTTPUtilitieslocation - the URL to forward to, including parametersAccessControlExceptionIOExceptionpublic void sendRedirect(String location) throws AccessControlException, IOException
sendRedirect in interface HTTPUtilitiesAccessControlExceptionIOExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void setContentType()
setContentType in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void setContentType(javax.servlet.http.HttpServletResponse response)
setContentType in interface HTTPUtilitiesresponse - The servlet response to set the content type for.public void setCurrentHTTP(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
setCurrentHTTP in interface HTTPUtilitiesrequest - the current requestresponse - the current responsepublic void setHeader(javax.servlet.http.HttpServletResponse response,
String name,
String value)
setHeader in interface HTTPUtilitiespublic void setHeader(String name, String value)
setHeader in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void setNoCacheHeaders()
setNoCacheHeaders in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void setNoCacheHeaders(javax.servlet.http.HttpServletResponse response)
Cache-Control: no-storeNote that the header "pragma: no-cache" is intended only for use in HTTP requests, not HTTP responses. However, Microsoft has chosen to directly violate the standards, so we need to include that header here. For more information, please refer to the relevant standards:
Cache-Control: no-cache
Cache-Control: must-revalidate
Expires: -1
setNoCacheHeaders in interface HTTPUtilitiesresponse - public String setRememberToken(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, String password, int maxAge, String domain, String path)
setRememberToken in interface HTTPUtilitiesrequest - response - password - the user's passwordmaxAge - the length of time that the token should be valid for in relative secondsdomain - the domain to restrict the token to or nullpath - the path to restrict the token to or nullpublic String setRememberToken(String password, int maxAge, String domain, String path)
setRememberToken in interface HTTPUtilitiesHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void verifyCSRFToken()
throws IntrusionException
verifyCSRFToken in interface HTTPUtilitiesIntrusionExceptionHTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse)}public void verifyCSRFToken(javax.servlet.http.HttpServletRequest request)
throws IntrusionException
verifyCSRFToken in interface HTTPUtilitiesrequest - IntrusionException - if CSRF token is missing or incorrectpublic <T> T getSessionAttribute(String key)
getSessionAttribute in interface HTTPUtilitiesT - The implied type of object expected.key - The key that references the session attributeHTTPUtilities.getSessionAttribute(javax.servlet.http.HttpSession, String)public <T> T getSessionAttribute(javax.servlet.http.HttpSession session,
String key)
HttpSession associated with the current
thread.getSessionAttribute in interface HTTPUtilitiesT - The implied type of object expectedsession - The session to retrieve the attribute fromkey - The key that references the requested objectpublic <T> T getRequestAttribute(String key)
HttpServletRequest associated
with the caller thread. If the attribute on the request is not of the implied
type, a ClassCastException will be thrown back to the caller.getRequestAttribute in interface HTTPUtilitiesT - The implied type of the object expectedkey - The key that references the request attribute.public <T> T getRequestAttribute(javax.servlet.http.HttpServletRequest request,
String key)
HttpServletRequest associated
with the passed in request. If the attribute on the request is not of the implied
type, a ClassCastException will be thrown back to the caller.getRequestAttribute in interface HTTPUtilitiesT - The implied type of the object expectedrequest - The request to retrieve the attribute fromkey - The key that references the request attribute.Copyright © 2016 The Open Web Application Security Project (OWASP). All rights reserved.