The class contains various non-secure fields that are used for the purpose of testing web + * application scanners, and therefore, most of the fields in this class are NOT suitable for + * implementing applications. * * @author Shay Chen * @since 1.0 */ public final class DatabaseConstants { - - //******************* - //* MySQL CONSTANTS * - //******************* + + // ******************* + // * MySQL CONSTANTS * + // ******************* /** * This constant is used as the global database driver string. + * * @since 1.0 */ - public static final String DATABASE_DRIVER = - "com.mysql.jdbc.Driver"; + public static final String DATABASE_DRIVER = "com.mysql.jdbc.Driver"; + /** * This constant is used as the global wavsep database name string. + * * @since 1.0 */ - public static final String DATABASE_NAME = - "wavsepDB"; + public static final String DATABASE_NAME = "wavsepDB"; + /** * This constant is used as the global database connection string (dynamic). + * * @since 1.0.2 */ public static String CONNECTION_STRING_WITHOUT_CREDENTIALS = - "jdbc:mysql://localhost:3306/wavsepDB"; + "jdbc:mysql://localhost:3306/wavsepDB"; + /** * This constant is used to store the database account user name (dynamic). + * * @since 1.0.2 */ public static String USERNAME = "wavsep"; - //original: wavsep, not final + + // original: wavsep, not final /** * This constant is used to store the database account password (dynamic). + * * @since 1.0.2 */ public static String PASSWORD = "wavsepPass782"; - //original: wavsepPass782, not final + + // original: wavsepPass782, not final /** * This constant is used to store the connection pool name. + * * @since 1.0.2 */ public static final String CONNECTION_POOL_NAME = "WavsepConnectionPool"; - //******************* - //* DERBY CONSTANTS * - //******************* + + // ******************* + // * DERBY CONSTANTS * + // ******************* /** * This constant is used to store the derby database name. + * * @since 1.1.0 */ public static final String DERBY_DATABASE_NAME = "db/WavsepConfigDB"; + /** * This constant is used to store the derby database connection string. + * * @since 1.1.0 */ - public static final String DERBY_CONNECTION_STRING = - "jdbc:derby:" + DERBY_DATABASE_NAME + ";"; - /** + public static final String DERBY_CONNECTION_STRING = "jdbc:derby:" + DERBY_DATABASE_NAME + ";"; + + /** * This constant is used to store the derby database driver string. + * * @since 1.1.0 */ - public static final String DERBY_DATABASE_DRIVER = - "org.apache.derby.jdbc.EmbeddedDriver"; - /** + public static final String DERBY_DATABASE_DRIVER = "org.apache.derby.jdbc.EmbeddedDriver"; + + /** * This constant is used to store the configuration row identifier. + * * @since 1.1.0 */ - public static final int DERBY_DATABASE_CONFIGURATION_ID = 2; + public static final int DERBY_DATABASE_CONFIGURATION_ID = 2; - //**************** - //* CONSTRUCTORS * - //**************** + // **************** + // * CONSTRUCTORS * + // **************** /** - * The default constructor is disabled to prevent the creation - * of class instances. - * @throws Exception Default constructor not supported + * The default constructor is disabled to prevent the creation of class instances. + * + * @throws Exception Default constructor not supported * @since 1.0 */ private DatabaseConstants() throws Exception { throw new Exception("Default constructor not supported"); - } //end of constructor - -} //end of class + } // end of constructor +} // end of class diff --git a/src/com/sectooladdict/constants/FileConstants.java b/src/com/sectooladdict/constants/FileConstants.java index 04a5cbe..9f0b18b 100644 --- a/src/com/sectooladdict/constants/FileConstants.java +++ b/src/com/sectooladdict/constants/FileConstants.java @@ -1,143 +1,171 @@ package com.sectooladdict.constants; /** - * This class contains constants used for file prefix/suffix - * concatenation related activities. + * This class contains constants used for file prefix/suffix concatenation related activities. * * @author Shay Chen * @since 1.2 */ public class FileConstants { - //************************* - //* FILE PREFIX CONSTANTS * - //************************* - /** + // ************************* + // * FILE PREFIX CONSTANTS * + // ************************* + /** * This constant is used to signify an empty file/dir input. + * * @since 1.2 */ - public static final String EMPTY_INPUT = ""; - /** + public static final String EMPTY_INPUT = ""; + + /** * This constant is used to signify an empty prefix. + * + * @since 1.2 + */ + public static final String EMPTY_PREFIX = ""; + + /** + * This constant is used for HTTP protocol enforcement. Designed to be used with the URL class. + * * @since 1.2 */ - public static final String EMPTY_PREFIX = ""; - /** - * This constant is used for HTTP protocol enforcement. - * Designed to be used with the URL class. + public static final String HTTP_PREFIX = "http://"; + + /** + * This constant is used for FTP protocol enforcement. Designed to be used with the URL class. + * * @since 1.2 */ - public static final String HTTP_PREFIX = "http://"; - /** - * This constant is used for FTP protocol enforcement. - * Designed to be used with the URL class. + public static final String FTP_PREFIX = "ftp://"; + + /** + * This constant is used for FTP protocol port enforcement. Designed to be used with the URL + * class. + * * @since 1.2 */ - public static final String FTP_PREFIX = "ftp://"; - /** - * This constant is used for FTP protocol port enforcement. - * Designed to be used with the URL class. + public static final String FTP_PORT = "21"; + + /** + * This constant is used for file directive enforcement. Designed to be used with the + * File/FileInputStream class. Using only a single slash enables using the prefix with path that + * begin with or without a slash (both file:/ and file:// are valid) + * * @since 1.2 */ - public static final String FTP_PORT = "21"; - /** - * This constant is used for file directive enforcement. - * Designed to be used with the File/FileInputStream class. - * Using only a single slash enables using the prefix with - * path that begin with or without a slash - * (both file:/ and file:// are valid) + public static final String FILE_PREFIX = "file:"; // add / for Windows? + + // ************************* + // * FILE SUFFIX CONSTANTS * + // ************************* + /** + * This constant is used to store the default target filename. + * * @since 1.2 */ - public static final String FILE_PREFIX = "file:"; //add / for Windows? - - - //************************* - //* FILE SUFFIX CONSTANTS * - //************************* - /** - * This constant is used to store the default target filename. + public static final String DEFAULT_TARGET_FILE = "content.ini"; + + /** + * This constant is used to store the default target filename, when the default location is not + * in the jsp directory. + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE = "content.ini"; - /** - * This constant is used to store the default target filename, - * when the default location is not in the jsp directory. + public static final String DEFAULT_TARGET_FILE_NOT_LOCAL = "eclipse.ini"; + + /** + * This constant is used to store the default target filename. + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_NOT_LOCAL = "eclipse.ini"; - /** - * This constant is used to store the default target filename. + public static final String DEFAULT_TARGET_FILE_INVALID = "none892j3kd.txt"; + + /** + * This constant is used to store the default invalid target destination for Unvalidated + * Redirect vulnerabilities. + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_INVALID = "none892j3kd.txt"; - /** - * This constant is used to store the default invalid target destination for - * Unvalidated Redirect vulnerabilities. - * @since 1.2 - */ - public static final String DEFAULT_TARGET_URL_INVALID_REDIRECT = "httk://google.com"; - /** + public static final String DEFAULT_TARGET_URL_INVALID_REDIRECT = "httk://google.com"; + + /** * This constant is used to store an invalid file name, + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_ROOT_DIR = "boot.ini"; - - //******************************** - //* FILE SUFFIX/PREFIX CONSTANTS * - //******************************** - /** - * This constant is used to store the default target file extension. + public static final String DEFAULT_TARGET_FILE_ROOT_DIR = "boot.ini"; + + // ******************************** + // * FILE SUFFIX/PREFIX CONSTANTS * + // ******************************** + /** + * This constant is used to store the default target file extension. + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_EXTENSION = "ini"; - /** - * This constant is used to store the default target file directory. + public static final String DEFAULT_TARGET_FILE_EXTENSION = "ini"; + + /** + * This constant is used to store the default target file directory. + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_DIRECTORY = "files"; - //Filename only - /** - * This constant is used to store the default target file name (no extension). + public static final String DEFAULT_TARGET_FILE_DIRECTORY = "files"; + + // Filename only + /** + * This constant is used to store the default target file name (no extension). + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_NAME_ONLY = "content"; - /** - * This constant is used to store the default target file name (no extension). + public static final String DEFAULT_TARGET_FILE_NAME_ONLY = "content"; + + /** + * This constant is used to store the default target file name (no extension). + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_NAME_ONLY_NOT_LOCAL = "eclipse"; - /** - * This constant is used to store the default target file name (no extension). + public static final String DEFAULT_TARGET_FILE_NAME_ONLY_NOT_LOCAL = "eclipse"; + + /** + * This constant is used to store the default target file name (no extension). + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_NAME_ONLY_ROOT_DIR = "boot"; - //Invalid - /** - * This constant is used to store an invalid target filename (only). + public static final String DEFAULT_TARGET_FILE_NAME_ONLY_ROOT_DIR = "boot"; + + // Invalid + /** + * This constant is used to store an invalid target filename (only). + * * @since 1.2 */ - public static final String DEFAULT_TARGET_FILE_NAME_ONLY_INVALID = "none892j3kd"; - /** - * This constant is used to store an invalid target extension (only). + public static final String DEFAULT_TARGET_FILE_NAME_ONLY_INVALID = "none892j3kd"; + + /** + * This constant is used to store an invalid target extension (only). + * * @since 1.2 */ - public static final String DEFAULT_EXTENSION_INVALID = "blabla"; - /** - * This constant is used to store an invalid target directory (only). + public static final String DEFAULT_EXTENSION_INVALID = "blabla"; + + /** + * This constant is used to store an invalid target directory (only). + * * @since 1.2 */ - public static final String DEFAULT_DIRECTORY_INVALID = "fdkj3jds7"; - - - //**************** - //* CONSTRUCTORS * - //**************** + public static final String DEFAULT_DIRECTORY_INVALID = "fdkj3jds7"; + + // **************** + // * CONSTRUCTORS * + // **************** /** - * The default constructor is disabled to prevent the creation - * of class instances. - * @throws Exception Default constructor not supported + * The default constructor is disabled to prevent the creation of class instances. + * + * @throws Exception Default constructor not supported * @since 1.0 */ private FileConstants() throws Exception { throw new Exception("Default constructor not supported"); - } //end of constructor -} //end of class + } // end of constructor +} // end of class diff --git a/src/com/sectooladdict/constants/SystemConstants.java b/src/com/sectooladdict/constants/SystemConstants.java index a014dd5..2b476b4 100644 --- a/src/com/sectooladdict/constants/SystemConstants.java +++ b/src/com/sectooladdict/constants/SystemConstants.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.constants; /** @@ -10,27 +8,27 @@ * @since 1.2 */ public final class SystemConstants { - - //******************* - //* MySQL CONSTANTS * - //******************* + + // ******************* + // * MySQL CONSTANTS * + // ******************* /** * This constant is used as a global debug flag (development). + * * @since 1.2 */ public static final boolean DEBUG_FLAG_DEFAULT_STATE = true; - - //**************** - //* CONSTRUCTORS * - //**************** + + // **************** + // * CONSTRUCTORS * + // **************** /** - * The default constructor is disabled to prevent the creation - * of class instances. - * @throws Exception Default constructor not supported + * The default constructor is disabled to prevent the creation of class instances. + * + * @throws Exception Default constructor not supported * @since 1.0 */ private SystemConstants() throws Exception { throw new Exception("Default constructor not supported"); - } //end of constructor - -} //end of class + } // end of constructor +} // end of class diff --git a/src/com/sectooladdict/database/ConnectionPoolManager.java b/src/com/sectooladdict/database/ConnectionPoolManager.java index 93a9cd7..f3c06ac 100644 --- a/src/com/sectooladdict/database/ConnectionPoolManager.java +++ b/src/com/sectooladdict/database/ConnectionPoolManager.java @@ -1,99 +1,84 @@ -/** - * - */ +/** */ package com.sectooladdict.database; +// connection pool management implementation +import com.sectooladdict.constants.DatabaseConstants; import java.sql.Connection; import java.sql.DriverManager; import java.sql.ResultSet; import java.sql.SQLException; - -//connection pool management implementation -import org.apache.commons.pool.ObjectPool; -import org.apache.commons.pool.impl.GenericObjectPool; import org.apache.commons.dbcp.ConnectionFactory; -import org.apache.commons.dbcp.PoolingDriver; -import org.apache.commons.dbcp.PoolableConnectionFactory; import org.apache.commons.dbcp.DriverManagerConnectionFactory; - -import com.sectooladdict.constants.DatabaseConstants; +import org.apache.commons.dbcp.PoolableConnectionFactory; +import org.apache.commons.dbcp.PoolingDriver; +import org.apache.commons.pool.ObjectPool; +import org.apache.commons.pool.impl.GenericObjectPool; /** - * The ConnectionPoolManager class uses the external package - * DBCP 1.4.x (Apache) for managing connection pools. + * The ConnectionPoolManager class uses the external package DBCP 1.4.x (Apache) for managing + * connection pools. * * @author Shay Chen * @since 1.0.2 */ public final class ConnectionPoolManager { - //***************** - //* Derby Methods * - //***************** - - public static Connection getDerbyConnection() throws Exception{ - Connection conn = null; - try { - Class.forName(DatabaseConstants.DERBY_DATABASE_DRIVER); - conn = DriverManager.getConnection(DatabaseConstants.DERBY_CONNECTION_STRING); - } catch (SQLException e) { - //invalid connection string, database is down or driver not loaded - try { - //Create new driver instance - Class.forName(DatabaseConstants.DERBY_DATABASE_DRIVER).newInstance(); - conn = DriverManager.getConnection(DatabaseConstants.DERBY_CONNECTION_STRING); - } catch (Exception e2) { - throw e2; - } - } catch (Exception e) { - throw e; - } //end of try-catch block - - return conn; - } - - - //********** - //* Fields * - //********** - /** - * A local counter meant to track the amount of exceptions in - * the closeConnection method. - */ + // ***************** + // * Derby Methods * + // ***************** + + public static Connection getDerbyConnection() throws Exception { + Connection conn = null; + try { + Class.forName(DatabaseConstants.DERBY_DATABASE_DRIVER); + conn = DriverManager.getConnection(DatabaseConstants.DERBY_CONNECTION_STRING); + } catch (SQLException e) { + // invalid connection string, database is down or driver not loaded + try { + // Create new driver instance + Class.forName(DatabaseConstants.DERBY_DATABASE_DRIVER).newInstance(); + conn = DriverManager.getConnection(DatabaseConstants.DERBY_CONNECTION_STRING); + } catch (Exception e2) { + throw e2; + } + } catch (Exception e) { + throw e; + } // end of try-catch block + + return conn; + } + + // ********** + // * Fields * + // ********** + /** A local counter meant to track the amount of exceptions in the closeConnection method. */ private static long closeConnectionExceptionCounter = 0; - /** - * A flag for storing the pool initialization state. - */ + + /** A flag for storing the pool initialization state. */ private static boolean isInitialized = false; - - //**************** - //* Constructors * - //**************** + // **************** + // * Constructors * + // **************** /** - * The default constructor is disabled to prevent programmers - * from using it to create class instances. + * The default constructor is disabled to prevent programmers from using it to create class + * instances. * * @throws Exception Default constructor not supported. * @since 1.0.2 */ @SuppressWarnings("unused") private ConnectionPoolManager() throws Exception { - throw new Exception("Default constructor is not supported in " - + this.getClass()); - } //end of constructor + throw new Exception("Default constructor is not supported in " + this.getClass()); + } // end of constructor - /** - * Initializes a common shared connection pool instance, - * by using a synchronized creation method to prevent - * the creation of multiple instances in case the method is - * simultaneously executed by multiple threads. + * Initializes a common shared connection pool instance, by using a synchronized creation method + * to prevent the creation of multiple instances in case the method is simultaneously executed + * by multiple threads. * - * Potential Problems: - * (1) Database may not be accessible (down, firewall, network, etc). - * (2) Improper database permissions. - * (3) lack of storage resources. + *
Potential Problems: (1) Database may not be accessible (down, firewall, network, etc). (2) + * Improper database permissions. (3) lack of storage resources. * * @throws java.lang.Exception Failed to create DatabaseLogWriter instance. * @since 1.0 @@ -104,107 +89,97 @@ private static void initialize() throws Exception { createNewInstance(); } } catch (Exception e) { - String exceptionDescripton = "Critical exception occurred in the " - + "ConnectionPoolManager getInstance method: " + e.toString(); + String exceptionDescripton = + "Critical exception occurred in the " + + "ConnectionPoolManager getInstance method: " + + e.toString(); System.out.println(exceptionDescripton); throw new Exception(exceptionDescripton); - } //end of try-catch block - - } //end of method - + } // end of try-catch block + } // end of method /** - * Initializes a common shared connection pool instance. - * The method is synchronized to prevent - * the creation of multiple instances in case the method is - * simultaneously executed by multiple threads. - * In the current implementation, if multiple threads will invoke the method - * simultaneously, then a new instance will be generated by the first thread - * and the rest will skip the "if" check, and get the existing instance. + * Initializes a common shared connection pool instance. The method is synchronized to prevent + * the creation of multiple instances in case the method is simultaneously executed by multiple + * threads. In the current implementation, if multiple threads will invoke the method + * simultaneously, then a new instance will be generated by the first thread and the rest will + * skip the "if" check, and get the existing instance. * - * Potential Problems: - * (1) Database may not be accessible (down, firewall, network, etc). - * (2) Improper database permissions. - * (3) lack of storage resources. + *
Potential Problems: (1) Database may not be accessible (down, firewall, network, etc). (2) + * Improper database permissions. (3) lack of storage resources. * * @throws java.lang.Exception Failed to create instance. * @since 1.0 */ private static synchronized void createNewInstance() throws Exception { try { - if (isInitialized == false) { - //initialize database access configuration (stored in derby DB) - loadDatabaseInfo(); - //initialize connection pool - initializePool(); - isInitialized = true; + if (isInitialized == false) { + // initialize database access configuration (stored in derby DB) + loadDatabaseInfo(); + // initialize connection pool + initializePool(); + isInitialized = true; } } catch (Exception e) { - String exceptionDescripton = "Critical exception occurred in the" - + " ConnectionPoolManager createNewInstance method: " - + e.toString(); + String exceptionDescripton = + "Critical exception occurred in the" + + " ConnectionPoolManager createNewInstance method: " + + e.toString(); System.out.println(exceptionDescripton); throw new Exception(exceptionDescripton); - } //end of try-catch block + } // end of try-catch block + } // end of method - } //end of method + // *********** + // * Methods * + // *********** - - //*********** - //* Methods * - //*********** - - /** - * - */ + /** */ public static void loadDatabaseInfo() { - try { - java.sql.Connection conn = ConnectionPoolManager.getDerbyConnection(); - - String sqlString = - "SELECT host,port,wavsep_username,wavsep_password " + - "FROM mysqlconfiguration " + - "WHERE id=?"; - java.sql.PreparedStatement pstmt = conn.prepareStatement(sqlString); - pstmt.setInt(1,DatabaseConstants.DERBY_DATABASE_CONFIGURATION_ID); - - ResultSet rs = pstmt.executeQuery(); - - if(rs.next()) { - DatabaseConstants.CONNECTION_STRING_WITHOUT_CREDENTIALS = - "jdbc:mysql://" + rs.getString(1) + ":" + - rs.getString(2) + "/wavsepDB"; - DatabaseConstants.USERNAME = rs.getString(3); - DatabaseConstants.PASSWORD = rs.getString(4); - - } else { - throw new Exception("database configuration was not initialized!\n"); - } - } catch (Exception e) { - //database configuration was not initialized - System.out.println("config db initialization error: "+e); - } - }//end of method - + try { + java.sql.Connection conn = ConnectionPoolManager.getDerbyConnection(); + + String sqlString = + "SELECT host,port,wavsep_username,wavsep_password " + + "FROM mysqlconfiguration " + + "WHERE id=?"; + java.sql.PreparedStatement pstmt = conn.prepareStatement(sqlString); + pstmt.setInt(1, DatabaseConstants.DERBY_DATABASE_CONFIGURATION_ID); + + ResultSet rs = pstmt.executeQuery(); + + if (rs.next()) { + DatabaseConstants.CONNECTION_STRING_WITHOUT_CREDENTIALS = + "jdbc:mysql://" + rs.getString(1) + ":" + rs.getString(2) + "/wavsepDB"; + DatabaseConstants.USERNAME = rs.getString(3); + DatabaseConstants.PASSWORD = rs.getString(4); + + } else { + throw new Exception("database configuration was not initialized!\n"); + } + } catch (Exception e) { + // database configuration was not initialized + System.out.println("config db initialization error: " + e); + } + } // end of method + /** - * Creates and initializes a new DBCP connection pool by manually - * registering it with a PoolingDriver and associating it with the - * alias defined in the database constants class. + * Creates and initializes a new DBCP connection pool by manually registering it with a + * PoolingDriver and associating it with the alias defined in the database constants class. * * @throws Exception Database support or access related error. * @since 1.0 */ private static void initializePool() throws Exception { - //load the database driver + // load the database driver Class.forName(DatabaseConstants.DATABASE_DRIVER); - + GenericObjectPool connectionPool = null; - //Code-level configuration is mainly used for testing - GenericObjectPool.Config poolConfig = - new GenericObjectPool.Config(); - poolConfig.lifo = true; //last idle connection -> first borrowed + // Code-level configuration is mainly used for testing + GenericObjectPool.Config poolConfig = new GenericObjectPool.Config(); + poolConfig.lifo = true; // last idle connection -> first borrowed poolConfig.maxActive = 15; poolConfig.maxIdle = 15; poolConfig.maxWait = 60000; @@ -220,28 +195,26 @@ private static void initializePool() throws Exception { connectionPool = new GenericObjectPool(null, poolConfig); - //A connection string without authentication is used for the connection - //factory creation, since the DriverManagerConnectionFactory - //integrates credentials separately. - ConnectionFactory connFactory = new DriverManagerConnectionFactory( - DatabaseConstants.CONNECTION_STRING_WITHOUT_CREDENTIALS, - DatabaseConstants.USERNAME, DatabaseConstants.PASSWORD); + // A connection string without authentication is used for the connection + // factory creation, since the DriverManagerConnectionFactory + // integrates credentials separately. + ConnectionFactory connFactory = + new DriverManagerConnectionFactory( + DatabaseConstants.CONNECTION_STRING_WITHOUT_CREDENTIALS, + DatabaseConstants.USERNAME, + DatabaseConstants.PASSWORD); PoolableConnectionFactory poolableConnectionFactory = - new PoolableConnectionFactory( - connFactory, connectionPool, null, null, false, true); + new PoolableConnectionFactory(connFactory, connectionPool, null, null, false, true); - //load the pool driver + // load the pool driver Class.forName("org.apache.commons.dbcp.PoolingDriver"); PoolingDriver poolDriver = new PoolingDriver(); - //set the pool name - poolDriver.registerPool(DatabaseConstants.CONNECTION_POOL_NAME, - connectionPool); - - } //end of method - + // set the pool name + poolDriver.registerPool(DatabaseConstants.CONNECTION_POOL_NAME, connectionPool); + } // end of method /** * Creates and returns a connection to the database. @@ -251,14 +224,13 @@ private static void initializePool() throws Exception { * @since 1.0 */ public static Connection getConnection() throws java.lang.Exception { - if (isInitialized == false) { - initialize(); - isInitialized = true; - } - return DriverManager.getConnection("jdbc:apache:commons:dbcp:" - + DatabaseConstants.CONNECTION_POOL_NAME); - } //end of method - + if (isInitialized == false) { + initialize(); + isInitialized = true; + } + return DriverManager.getConnection( + "jdbc:apache:commons:dbcp:" + DatabaseConstants.CONNECTION_POOL_NAME); + } // end of method /** * Returns an active connection to the pool. @@ -273,9 +245,8 @@ public static void closeConnection(final Connection conn) { } } catch (Exception e) { closeConnectionExceptionCounter++; - } //end of try-catch block - } //end of method - + } // end of try-catch block + } // end of method /** * Disposes of the connections in the pool. @@ -284,26 +255,21 @@ public static void closeConnection(final Connection conn) { * @since 1.0 */ public static void dispose() throws SQLException { - PoolingDriver driver = - (PoolingDriver) DriverManager.getDriver( - "jdbc:apache:commons:dbcp:"); + PoolingDriver driver = (PoolingDriver) DriverManager.getDriver("jdbc:apache:commons:dbcp:"); driver.closePool(DatabaseConstants.CONNECTION_POOL_NAME); closeConnectionExceptionCounter = 0; - } //end of method - + } // end of method /** - * Returns the number of of connection closing failures, since - * the last pool connection disposal. - * Used for maintenance purposes. + * Returns the number of of connection closing failures, since the last pool connection + * disposal. Used for maintenance purposes. * * @return The number of exceptions that occurred when closing connections. * @since 1.0 */ public static long getCloseConnectionExceptionCounter() { return closeConnectionExceptionCounter; - } //end of method - + } // end of method /** * Returns the number of of active connections. @@ -313,14 +279,11 @@ public static long getCloseConnectionExceptionCounter() { * @since 1.0 */ public static long getActiveConnectionCounter() throws Exception { - PoolingDriver driver = - (PoolingDriver) DriverManager.getDriver( - "jdbc:apache:commons:dbcp:"); - ObjectPool connectionPool = - driver.getConnectionPool(DatabaseConstants.CONNECTION_POOL_NAME); + PoolingDriver driver = (PoolingDriver) DriverManager.getDriver("jdbc:apache:commons:dbcp:"); + ObjectPool connectionPool = + driver.getConnectionPool(DatabaseConstants.CONNECTION_POOL_NAME); return connectionPool.getNumActive(); - } //end of method - + } // end of method /** * Returns the number of of idle connections. @@ -330,16 +293,9 @@ public static long getActiveConnectionCounter() throws Exception { * @since 1.0 */ public static long getIdleConnectionCounter() throws Exception { - PoolingDriver driver = - (PoolingDriver) DriverManager.getDriver( - "jdbc:apache:commons:dbcp:"); - ObjectPool connectionPool = - driver.getConnectionPool(DatabaseConstants.CONNECTION_POOL_NAME); + PoolingDriver driver = (PoolingDriver) DriverManager.getDriver("jdbc:apache:commons:dbcp:"); + ObjectPool connectionPool = + driver.getConnectionPool(DatabaseConstants.CONNECTION_POOL_NAME); return connectionPool.getNumIdle(); - } //end of method - - -} //end of class - - - + } // end of method +} // end of class diff --git a/src/com/sectooladdict/encoders/HtmlEncoder.java b/src/com/sectooladdict/encoders/HtmlEncoder.java index 938fcc1..7cfb8e6 100644 --- a/src/com/sectooladdict/encoders/HtmlEncoder.java +++ b/src/com/sectooladdict/encoders/HtmlEncoder.java @@ -1,38 +1,37 @@ package com.sectooladdict.encoders; + /** - * The HtmlEncoder class contains various methods to encode - * output containing HTML, JS and VBS syntax. + * The HtmlEncoder class contains various methods to encode output containing HTML, JS and VBS + * syntax. * - * The class contains various non-secure methods that are - * used for the purpose of testing web application scanners, - * and therefore, most of the methods in this class are NOT - * suitable for implementing efficient protection against - * scripting attacks. + *
The class contains various non-secure methods that are used for the purpose of testing web + * application scanners, and therefore, most of the methods in this class are NOT suitable for + * implementing efficient protection against scripting attacks. * * @author Shay Chen * @since 1.0 */ public final class HtmlEncoder { - //**************** - //* CONSTRUCTORS * - //**************** + // **************** + // * CONSTRUCTORS * + // **************** /** - * The default constructor is disabled (prevent the creation - * of class instances). - * @throws Exception Default constructor unsupported + * The default constructor is disabled (prevent the creation of class instances). + * + * @throws Exception Default constructor unsupported * @since 1.0 */ private HtmlEncoder() throws Exception { throw new Exception("Default constructor unsupported"); - } //end of constructor - + } // end of constructor - //*********** - //* METHODS * - //*********** + // *********** + // * METHODS * + // *********** /** * This method encodes only angle brackets (<,>). + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -50,11 +49,11 @@ public static String htmlEncodeAngleBrackets(final String s) { } } return buf.toString(); - } //end of method - + } // end of method /** * This method encodes only angle brackets (<,>) and single quotes ('). + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -70,17 +69,17 @@ public static String htmlEncodeAngleBracketsAndSingleQuotes(final String s) { } else if (c == '\'') { buf.append("'"); } else if (c == '`') { - buf.append("`"); + buf.append("`"); } else { buf.append(c); } } return buf.toString(); - } //end of method - + } // end of method /** * This method encodes only angle brackets (<,>) and double quotes ("). + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -100,11 +99,11 @@ public static String htmlEncodeAngleBracketsAndDoubleQuotes(final String s) { } } return buf.toString(); - } //end of method - + } // end of method /** * This method encodes only angle brackets (<,>) and quotes (',",`). + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -122,17 +121,17 @@ public static String htmlEncodeAngleBracketsAndQuotes(final String s) { } else if (c == '\'') { buf.append("'"); } else if (c == '`') { - buf.append("`"); + buf.append("`"); } else { buf.append(c); } } return buf.toString(); - } //end of method + } // end of method - /** * This method encodes only double quotes ("). + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -148,10 +147,11 @@ public static String htmlEncodeDoubleQuotes(final String s) { } } return buf.toString(); - } //end of method - + } // end of method + /** * This method encodes only single quotes (',`). + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -161,7 +161,7 @@ public static String htmlEncodeSingleQuotes(final String s) { for (int i = 0; i < s.length(); i++) { char c = s.charAt(i); if (c == '\'') { - buf.append("'"); + buf.append("'"); } else if (c == '`') { buf.append("`"); } else { @@ -169,10 +169,11 @@ public static String htmlEncodeSingleQuotes(final String s) { } } return buf.toString(); - } //end of method - + } // end of method + /** * This method encodes only CrLf characters (10,13,\n,\r). + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -182,22 +183,23 @@ public static String htmlEncodeCrLf(final String s) { for (int i = 0; i < s.length(); i++) { char c = s.charAt(i); if (c == '\n') { - //add nothing + // add nothing } else if (c == '\r') { - //add nothing + // add nothing } else if (c == 10) { - //add nothing + // add nothing } else if (c == 13) { - //add nothing + // add nothing } else { buf.append(c); } } return buf.toString(); - } //end of method - + } // end of method + /** * This method encodes only the equality sign (=). + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -213,11 +215,11 @@ public static String htmlEncodeEqualitySign(final String s) { } } return buf.toString(); - } //end of method - - + } // end of method + /** * This method encodes all the non alphanumeric characters. + * * @param s Input string. * @return Partially encoded version of the string (HTML). * @since 1.0 @@ -225,18 +227,13 @@ public static String htmlEncodeEqualitySign(final String s) { public static String htmlEncode(final String s) { StringBuilder buf = new StringBuilder(s.length()); for (int i = 0; i < s.length(); i++) { - char c = s.charAt( i ); - if ( c>='a' && c<='z' || c>='A' && c<='Z' || c>='0' && c<='9' ) - { - buf.append( c ); - } - else - { - buf.append( "&#" + (int)c + ";" ); + char c = s.charAt(i); + if (c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9') { + buf.append(c); + } else { + buf.append("&#" + (int) c + ";"); } } return buf.toString(); - - } //end of method - -} //end of class + } // end of method +} // end of class diff --git a/src/com/sectooladdict/enums/DefaultInputType.java b/src/com/sectooladdict/enums/DefaultInputType.java index 4b087bd..9abca20 100644 --- a/src/com/sectooladdict/enums/DefaultInputType.java +++ b/src/com/sectooladdict/enums/DefaultInputType.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -8,15 +6,15 @@ * * @author Shay Chen * @since 1.2 - * */ + */ public enum DefaultInputType { - FULL_PATH_INPUT, - RELATIVE_INPUT, - INVALID_INPUT, - EMPTY_INPUT, - PARTIAL_PATH_INPUT, - FULL_COMMAND_WITHOUT_OS_PREFIX, - FULL_COMMAND_WITH_OS_PREFIX, - PARTIAL_COMMAND, - COMMAND_POSTFIX + FULL_PATH_INPUT, + RELATIVE_INPUT, + INVALID_INPUT, + EMPTY_INPUT, + PARTIAL_PATH_INPUT, + FULL_COMMAND_WITHOUT_OS_PREFIX, + FULL_COMMAND_WITH_OS_PREFIX, + PARTIAL_COMMAND, + COMMAND_POSTFIX } diff --git a/src/com/sectooladdict/enums/FileAccessMethod.java b/src/com/sectooladdict/enums/FileAccessMethod.java index 6d47fe1..2bb6972 100644 --- a/src/com/sectooladdict/enums/FileAccessMethod.java +++ b/src/com/sectooladdict/enums/FileAccessMethod.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -10,23 +8,23 @@ * @since 1.2 */ public enum FileAccessMethod { - /*##############*/ - /*## LFI ONLY ##*/ - /*##############*/ - CONTEXT_STREAM, //Access via getServletContext().getResourceAsStream - FILE_CLASS, //Access via File or FileInputStream - /*##############*/ - /*## RFI ONLY ##*/ - /*##############*/ - URL_CLASS,//Access via URL - FTP_CLASS,//Access via FTP - NOT IMPLEMENTED - /*##################*/ - /*## CODE-FI ONLY ##*/ - /*##################*/ - INCLUDE,//Include via JSP Inclusion - /*#########################################################*/ - /*## FALSE POSITIVE FILE INCLUSION OR OPEN REDIRECT ONLY ##*/ - /*#########################################################*/ - REDIRECT,//JSP Redirect (302) - FORWARD; //JSP Forward + /*##############*/ + /*## LFI ONLY ##*/ + /*##############*/ + CONTEXT_STREAM, // Access via getServletContext().getResourceAsStream + FILE_CLASS, // Access via File or FileInputStream + /*##############*/ + /*## RFI ONLY ##*/ + /*##############*/ + URL_CLASS, // Access via URL + FTP_CLASS, // Access via FTP - NOT IMPLEMENTED + /*##################*/ + /*## CODE-FI ONLY ##*/ + /*##################*/ + INCLUDE, // Include via JSP Inclusion + /*#########################################################*/ + /*## FALSE POSITIVE FILE INCLUSION OR OPEN REDIRECT ONLY ##*/ + /*#########################################################*/ + REDIRECT, // JSP Redirect (302) + FORWARD; // JSP Forward } diff --git a/src/com/sectooladdict/enums/FileAccessRestriction.java b/src/com/sectooladdict/enums/FileAccessRestriction.java index b19ed04..3e3ffbb 100644 --- a/src/com/sectooladdict/enums/FileAccessRestriction.java +++ b/src/com/sectooladdict/enums/FileAccessRestriction.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -10,39 +8,38 @@ * @since 1.2 */ public enum FileAccessRestriction { - NONE, //No restriction - WHITE_LIST, //File/Domain/IP/URL white list - TRAVERSAL_REMOVAL_AND_WHITE_LIST, //Traversal Removal and File/Domain/IP/URL white list - ENUMERATION_ONLY, //Present status instead of content - IGNORE_INPUT, //Don't perform anything with the input (use a constant/server affected value) - /*################*/ - /*## NOT-IN-USE ##*/ - /*################*/ - PERMISSIONS, //Unprivileged file access - LOCAL_FOLDER_ONLY, //Access is limited to local folder (traversal characters removed); - /*##############*/ - /*## LFI ONLY ##*/ - /*##############*/ - UNIX_TRAVESAL_INPUT_VALIDATION, //Input Validation (../) - UNIX_TRAVESAL_INPUT_REMOVAL, //Input Removal (/../, ../) - WINDOWS_TRAVESAL_INPUT_VALIDATION, //Input Validation (../) - WINDOWS_TRAVESAL_INPUT_REMOVAL, //Input Removal (/../, ../) - SLASH_INPUT_VALIDATION, //Input Validation (/) - SLASH_INPUT_REMOVAL, //Input Removal (/) - BACKSLASH_INPUT_VALIDATION, //Input Validation (\) - BACKSLASH_INPUT_REMOVAL, //Input Removal (\) - /*#######################################*/ - /*## RFI AND UNVALIDATED REDIRECT ONLY ##*/ - /*#######################################*/ - HTTP_INPUT_VALIDATION, //Input Validation (http) - HTTP_INPUT_REMOVAL, //Input Removal (http) - CONCAT_DOMAIN_BASE_URL, //Concats the domain base URL to the input - /*###############################*/ - /*## OS COMMAND INJECTION ONLY ##*/ - /*###############################*/ - PIPE_INPUT_VALIDATION, - PIPE_INPUT_REMOVAL, - AMPERSAND_INPUT_VALIDATION, - AMPERSAND_INPUT_REMOVAL - + NONE, // No restriction + WHITE_LIST, // File/Domain/IP/URL white list + TRAVERSAL_REMOVAL_AND_WHITE_LIST, // Traversal Removal and File/Domain/IP/URL white list + ENUMERATION_ONLY, // Present status instead of content + IGNORE_INPUT, // Don't perform anything with the input (use a constant/server affected value) + /*################*/ + /*## NOT-IN-USE ##*/ + /*################*/ + PERMISSIONS, // Unprivileged file access + LOCAL_FOLDER_ONLY, // Access is limited to local folder (traversal characters removed); + /*##############*/ + /*## LFI ONLY ##*/ + /*##############*/ + UNIX_TRAVESAL_INPUT_VALIDATION, // Input Validation (../) + UNIX_TRAVESAL_INPUT_REMOVAL, // Input Removal (/../, ../) + WINDOWS_TRAVESAL_INPUT_VALIDATION, // Input Validation (../) + WINDOWS_TRAVESAL_INPUT_REMOVAL, // Input Removal (/../, ../) + SLASH_INPUT_VALIDATION, // Input Validation (/) + SLASH_INPUT_REMOVAL, // Input Removal (/) + BACKSLASH_INPUT_VALIDATION, // Input Validation (\) + BACKSLASH_INPUT_REMOVAL, // Input Removal (\) + /*#######################################*/ + /*## RFI AND UNVALIDATED REDIRECT ONLY ##*/ + /*#######################################*/ + HTTP_INPUT_VALIDATION, // Input Validation (http) + HTTP_INPUT_REMOVAL, // Input Removal (http) + CONCAT_DOMAIN_BASE_URL, // Concats the domain base URL to the input + /*###############################*/ + /*## OS COMMAND INJECTION ONLY ##*/ + /*###############################*/ + PIPE_INPUT_VALIDATION, + PIPE_INPUT_REMOVAL, + AMPERSAND_INPUT_VALIDATION, + AMPERSAND_INPUT_REMOVAL } diff --git a/src/com/sectooladdict/enums/FileInjectionContext.java b/src/com/sectooladdict/enums/FileInjectionContext.java index 7e24514..c49d2d8 100644 --- a/src/com/sectooladdict/enums/FileInjectionContext.java +++ b/src/com/sectooladdict/enums/FileInjectionContext.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -8,11 +6,12 @@ * * @author Shay Chen * @since 1.2 - * */ + */ public enum FileInjectionContext { - FULL_FILENAME, //The input is injected into filename.extension (nothing appended) - FILENAME_ONLY, //The input is injected into filename (fixed extension appended) - DIRECTORY, //The input is injected into directory (fixed filename & extension appended) - EXTENSION; //The input is injected into the extension (NOT IMPLEMENTED) - //Removed: FULL_PATH; //The input is injected into full path start / drive / dirs / file / extension (nothing appended, no prefix) + FULL_FILENAME, // The input is injected into filename.extension (nothing appended) + FILENAME_ONLY, // The input is injected into filename (fixed extension appended) + DIRECTORY, // The input is injected into directory (fixed filename & extension appended) + EXTENSION; // The input is injected into the extension (NOT IMPLEMENTED) + // Removed: FULL_PATH; //The input is injected into full path start / drive / dirs / file / + // extension (nothing appended, no prefix) } diff --git a/src/com/sectooladdict/enums/OsType.java b/src/com/sectooladdict/enums/OsType.java index 1d8c84f..13ebf8e 100644 --- a/src/com/sectooladdict/enums/OsType.java +++ b/src/com/sectooladdict/enums/OsType.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -10,5 +8,7 @@ * @since 1.2 */ public enum OsType { - WINDOWS, UNIX, ANY; + WINDOWS, + UNIX, + ANY; } diff --git a/src/com/sectooladdict/enums/PathType.java b/src/com/sectooladdict/enums/PathType.java index 12c648d..c3ef986 100644 --- a/src/com/sectooladdict/enums/PathType.java +++ b/src/com/sectooladdict/enums/PathType.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -8,16 +6,16 @@ * * @author Shay Chen * @since 1.2 - * */ + */ public enum PathType { - /*##############*/ - /*## LFI ONLY ##*/ - /*##############*/ - OS_PATH, //current os file path - FILE_DIRECTIVE_URL, //"file:/" or "file://" - /*##############*/ - /*## RFI ONLY ##*/ - /*##############*/ - FTP_URL, //"ftp:/" or "ftp://" - HTTP_URL, //"http://" or "https://" + /*##############*/ + /*## LFI ONLY ##*/ + /*##############*/ + OS_PATH, // current os file path + FILE_DIRECTIVE_URL, // "file:/" or "file://" + /*##############*/ + /*## RFI ONLY ##*/ + /*##############*/ + FTP_URL, // "ftp:/" or "ftp://" + HTTP_URL, // "http://" or "https://" } diff --git a/src/com/sectooladdict/enums/PrefixRequirement.java b/src/com/sectooladdict/enums/PrefixRequirement.java index 19ace76..fc8ee91 100644 --- a/src/com/sectooladdict/enums/PrefixRequirement.java +++ b/src/com/sectooladdict/enums/PrefixRequirement.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -8,26 +6,26 @@ * * @author Shay Chen * @since 1.2 - * */ + */ public enum PrefixRequirement { - ANY, //no path prefix - can be used with full, relative or local path - //will require "file:/" or "file://" in file directive - NONE, //There's a full path prefix with slash or backslash - SLASH_PREFIX, //There's a full path prefix WITHOUT slash - //use with File/URL access method - /*##############*/ - /*## LFI ONLY ##*/ - /*##############*/ - BACKSLASH_PREFIX, //There's a full path prefix WITHOUT backslash - //use with File access method (Windows) - /*##############*/ - /*## RFI ONLY ##*/ - /*##############*/ - FTP_DIRECTIVE, //requires "ftp:/" or "ftp://" - HTTP_DIRECTIVE, //requires "http://" or "https://" - /*###############################*/ - /*## UNVALIDATED REDIRECT ONLY ##*/ - /*###############################*/ - WEBPAGE_ADDRESS_WITHOUT_PROTOCOL //requires a web page address *without* "http://" or "https://" + ANY, // no path prefix - can be used with full, relative or local path + // will require "file:/" or "file://" in file directive + NONE, // There's a full path prefix with slash or backslash + SLASH_PREFIX, // There's a full path prefix WITHOUT slash + // use with File/URL access method + /*##############*/ + /*## LFI ONLY ##*/ + /*##############*/ + BACKSLASH_PREFIX, // There's a full path prefix WITHOUT backslash + // use with File access method (Windows) + /*##############*/ + /*## RFI ONLY ##*/ + /*##############*/ + FTP_DIRECTIVE, // requires "ftp:/" or "ftp://" + HTTP_DIRECTIVE, // requires "http://" or "https://" + /*###############################*/ + /*## UNVALIDATED REDIRECT ONLY ##*/ + /*###############################*/ + WEBPAGE_ADDRESS_WITHOUT_PROTOCOL // requires a web page address *without* "http://" or + // "https://" } - diff --git a/src/com/sectooladdict/enums/ResponseType.java b/src/com/sectooladdict/enums/ResponseType.java index 35cfe9b..46b94aa 100644 --- a/src/com/sectooladdict/enums/ResponseType.java +++ b/src/com/sectooladdict/enums/ResponseType.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -10,10 +8,10 @@ * @since 1.2 */ public enum ResponseType { - ERROR_500, //Server error response - ERROR_404, //File not found response - REDIRECT_302, //Redirect response - ERROR_200, //Error embedded into a valid response - VALID_200, //A valid response without erroneous information - IDENTICAL_200; //A valid response without any response differentiation + ERROR_500, // Server error response + ERROR_404, // File not found response + REDIRECT_302, // Redirect response + ERROR_200, // Error embedded into a valid response + VALID_200, // A valid response without erroneous information + IDENTICAL_200; // A valid response without any response differentiation } diff --git a/src/com/sectooladdict/enums/VulnerabilityType.java b/src/com/sectooladdict/enums/VulnerabilityType.java index c4fefe5..10d0574 100644 --- a/src/com/sectooladdict/enums/VulnerabilityType.java +++ b/src/com/sectooladdict/enums/VulnerabilityType.java @@ -1,6 +1,4 @@ -/** - * - */ +/** */ package com.sectooladdict.enums; /** @@ -10,15 +8,16 @@ * @since 1.2 */ public enum VulnerabilityType { - SQL_INJECTION, //SQL Injection - REFLECTED_XSS, //Reflected XSS - LFI, //Local File Inclusion (Content Theft, Local Code Exec in include - RFI, //Remote File Inclusion (XSS, Phishing, Remote Code Exec in include) - DIRECTORY_TRAVERSAL, //Directory Traversal (in path, not parameter) - CODE_LFI, //Local Code Inclusion (Local Code Exec in include - should be used alongside malicious file upload) - CODE_RFI, //Remote Code Inclusion (Remote Code Exec in include) - UNVALIDATED_REDIRECT, //Open / external / unvalidated redirect - OS_COMMAND_INJECTION, //OS Commanding / Command Injection / Command Execution - OBSOLETE_FILE, //OS Commanding / Command Injection / Command Execution - FALSE_POSITIVE; + SQL_INJECTION, // SQL Injection + REFLECTED_XSS, // Reflected XSS + LFI, // Local File Inclusion (Content Theft, Local Code Exec in include + RFI, // Remote File Inclusion (XSS, Phishing, Remote Code Exec in include) + DIRECTORY_TRAVERSAL, // Directory Traversal (in path, not parameter) + CODE_LFI, // Local Code Inclusion (Local Code Exec in include - should be used alongside + // malicious file upload) + CODE_RFI, // Remote Code Inclusion (Remote Code Exec in include) + UNVALIDATED_REDIRECT, // Open / external / unvalidated redirect + OS_COMMAND_INJECTION, // OS Commanding / Command Injection / Command Execution + OBSOLETE_FILE, // OS Commanding / Command Injection / Command Execution + FALSE_POSITIVE; } diff --git a/src/com/sectooladdict/filters/FakeHiddenFileCustomResponseFilter.java b/src/com/sectooladdict/filters/FakeHiddenFileCustomResponseFilter.java index 03ece17..9ba0586 100644 --- a/src/com/sectooladdict/filters/FakeHiddenFileCustomResponseFilter.java +++ b/src/com/sectooladdict/filters/FakeHiddenFileCustomResponseFilter.java @@ -1,70 +1,61 @@ package com.sectooladdict.filters; import java.io.IOException; -import java.io.InputStream; import java.io.PrintWriter; - import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; -import javax.servlet.http.HttpServletRequest; -/** - * Servlet Filter implementation class FakeHiddenFileCustomResponseFilter - */ +/** Servlet Filter implementation class FakeHiddenFileCustomResponseFilter */ public class FakeHiddenFileCustomResponseFilter implements Filter { - /** - * Default constructor. - */ + /** Default constructor. */ public FakeHiddenFileCustomResponseFilter() { // TODO Auto-generated constructor stub } - + + /** The local filter config object, used to access the local servlet context. */ + FilterConfig config; + /** - * The local filter config object, used to access the local servlet context. - */ - FilterConfig config; - - /** - * @see Filter#init(FilterConfig) - */ - public void init(FilterConfig fConfig) throws ServletException { - // TODO Auto-generated method stub - setFilterConfig(fConfig); - } - - public void setFilterConfig(FilterConfig newConfig) { - this.config = newConfig; - } - - public FilterConfig getFilterConfig() { - return this.config; - } + * @see Filter#init(FilterConfig) + */ + public void init(FilterConfig fConfig) throws ServletException { + // TODO Auto-generated method stub + setFilterConfig(fConfig); + } + + public void setFilterConfig(FilterConfig newConfig) { + this.config = newConfig; + } + + public FilterConfig getFilterConfig() { + return this.config; + } - /** - * @see Filter#destroy() - */ - public void destroy() { - // TODO Auto-generated method stub - } + /** + * @see Filter#destroy() + */ + public void destroy() { + // TODO Auto-generated method stub + } - /** - * @see Filter#doFilter(ServletRequest, ServletResponse, FilterChain) - */ - public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { - //Present a consistent static response, to any URL access - PrintWriter out = response.getWriter(); - out.println(""); - out.println("
The class contains various non-secure methods that are used for the purpose of testing web + * application scanners, and therefore, most of the methods in this class are NOT suitable for + * implementing efficient protection against injection / scripting attacks. * * @author Shay Chen * @since 1.0 */ public final class InputValidator { - //**************** - //* CONSTRUCTORS * - //**************** + // **************** + // * CONSTRUCTORS * + // **************** /** - * The default constructor is disabled (prevent the creation - * of class instances). - * @throws Exception Default constructor not supported + * The default constructor is disabled (prevent the creation of class instances). + * + * @throws Exception Default constructor not supported * @since 1.0 */ private InputValidator() throws Exception { throw new Exception("Default constructor not supported"); - } //end of constructor + } // end of constructor - - //*********** - //* METHODS * - //*********** + // *********** + // * METHODS * + // *********** /** - * This method attempts to verify that the input does not - * contain a semicolon character (;). + * This method attempts to verify that the input does not contain a semicolon character (;). + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.0 @@ -48,12 +43,11 @@ public static boolean validateSemicolon(final String s) { } else { return false; } - } //end of method + } // end of method - /** - * This method attempts to verify that the input does not - * contain quotes (',",`). + * This method attempts to verify that the input does not contain quotes (',",`). + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.0 @@ -64,210 +58,195 @@ public static boolean validateQuotes(final String s) { } else { return false; } - } //end of method - - + } // end of method + /** - * This method attempts to verify that the input does not - * contain characters that can compose SQL comments (--,#,/*). + * This method attempts to verify that the input does not contain characters that can compose + * SQL comments (--,#,/*). + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.0 */ public static boolean validatePotentialComments(final String s) { - if (s.contains("-") || s.contains("#") || s.contains("/") - || s.contains("*")) { + if (s.contains("-") || s.contains("#") || s.contains("/") || s.contains("*")) { return true; } else { return false; } - } //end of method - - + } // end of method + /** - * This method attempts to verify that the input does not - * contain quotes, comments and semicolons (',",`,--,#,/*,;). + * This method attempts to verify that the input does not contain quotes, comments and + * semicolons (',",`,--,#,/*,;). + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.0 */ public static boolean validateAll(final String s) { - if (validateQuotes(s) || - validatePotentialComments(s) || - validateSemicolon(s)) { + if (validateQuotes(s) || validatePotentialComments(s) || validateSemicolon(s)) { return true; } else { return false; } - } //end of method - - + } // end of method + /** - * This method attempts to verify that the input does not - * contain Unix directory traversal characters (../). - * Windows traversal characters were left out on purpose. + * This method attempts to verify that the input does not contain Unix directory traversal + * characters (../). Windows traversal characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static boolean validateUnixTraversal(final String s) { - if (s.contains("../")) { + if (s.contains("../")) { return true; } else { return false; } - } //end of method - - + } // end of method + /** - * This method attempts to remove instances of - * Unix directory traversal characters (/../,../) from the input. - * Windows traversal characters were left out on purpose. + * This method attempts to remove instances of Unix directory traversal characters (/../,../) + * from the input. Windows traversal characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static String removeUnixTraversal(final String s) { - //intentionally ignore parsing flaw exploits - String temp = null; - temp = s.replace("/../", ""); - temp = temp.replace("../", ""); - return temp; - } //end of method - - + // intentionally ignore parsing flaw exploits + String temp = null; + temp = s.replace("/../", ""); + temp = temp.replace("../", ""); + return temp; + } // end of method + /** - * This method attempts to verify that the input does not - * contain Windows directory traversal characters (..\). - * Unix traversal characters were left out on purpose. + * This method attempts to verify that the input does not contain Windows directory traversal + * characters (..\). Unix traversal characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static boolean validateWindowsTraversal(final String s) { - if (s.contains("..\\")) { + if (s.contains("..\\")) { return true; } else { return false; } - } //end of method - - + } // end of method + /** - * This method attempts to remove instances of - * Windows directory traversal characters (/../,../) from the input. - * Unix traversal characters were left out on purpose. + * This method attempts to remove instances of Windows directory traversal characters (/../,../) + * from the input. Unix traversal characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static String removeWindowsTraversal(final String s) { - //intentionally ignore parsing flaw exploits - String temp = null; - temp = s.replace("\\..\\", ""); - temp = temp.replace("..\\", ""); - return temp; - } //end of method - - + // intentionally ignore parsing flaw exploits + String temp = null; + temp = s.replace("\\..\\", ""); + temp = temp.replace("..\\", ""); + return temp; + } // end of method + /** - * This method attempts to verify that the input does not - * contain slash characters (/). - * backslash characters were left out on purpose. + * This method attempts to verify that the input does not contain slash characters (/). + * backslash characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.0 */ public static boolean validateSlash(final String s) { - if (s.contains("/")) { + if (s.contains("/")) { return true; } else { return false; } - } //end of method - - + } // end of method + /** - * This method attempts to remove instances of - * slash characters (/) from the input. - * backslash characters were left out on purpose. + * This method attempts to remove instances of slash characters (/) from the input. backslash + * characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static String removeSlash(final String s) { - //intentionally ignore parsing flaw exploits - return s.replace("/", ""); - } //end of method - - + // intentionally ignore parsing flaw exploits + return s.replace("/", ""); + } // end of method + /** - * This method attempts to verify that the input does not - * contain backslash characters (\). - * slash characters were left out on purpose. + * This method attempts to verify that the input does not contain backslash characters (\). + * slash characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.0 */ public static boolean validateBackSlash(final String s) { - if (s.contains("\\")) { + if (s.contains("\\")) { return true; } else { return false; } - } //end of method - - + } // end of method + /** - * This method attempts to remove instances of - * backslash characters (\) from the input. - * slash characters were left out on purpose. + * This method attempts to remove instances of backslash characters (\) from the input. slash + * characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static String removeBackSlash(final String s) { - //intentionally ignore parsing flaw exploits - return s.replace("\\", ""); - } //end of method - - + // intentionally ignore parsing flaw exploits + return s.replace("\\", ""); + } // end of method + /** - * This method attempts to verify that the input does not - * contain HTTP references. - * The inefficient validation is intentional - * (the input is not transformed to lower-case prior to validation, - * and there's no https/other protocol or evasion prevention) + * This method attempts to verify that the input does not contain HTTP references. The + * inefficient validation is intentional (the input is not transformed to lower-case prior to + * validation, and there's no https/other protocol or evasion prevention) + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.0 */ public static boolean validateHttp(final String s) { - //String tmp = s.toLowerCase(); - //intentionally ignore upper/lower case issues, so evasion can be used - if (s.contains("http:/") ) { + // String tmp = s.toLowerCase(); + // intentionally ignore upper/lower case issues, so evasion can be used + if (s.contains("http:/")) { return true; } else { return false; } - } //end of method - - + } // end of method + /** - * This method attempts to remove instances of - * HTTP references from the input. + * This method attempts to remove instances of HTTP references from the input. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static String removeHttp(final String s) { - //intentionally ignore upper/lower case issues, so evasion can be used - return s.replace("http://", ""); - } //end of method + // intentionally ignore upper/lower case issues, so evasion can be used + return s.replace("http://", ""); + } // end of method public static boolean validatePipe(String s) { - if (s.contains("|")) - return true; + if (s.contains("|")) return true; return false; } @@ -278,8 +257,7 @@ public static String removePipe(String s) { } public static boolean validateAmpersand(String s) { - if (s.contains("&")) - return true; + if (s.contains("&")) return true; return false; } @@ -290,62 +268,61 @@ public static String removeAmpersand(String s) { } /** - * This method attempts to remove instances of - * Unix local directory traversal characters (/./,./) from the input. - * Windows traversal characters were left out on purpose. + * This method attempts to remove instances of Unix local directory traversal characters + * (/./,./) from the input. Windows traversal characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static String removeUnixLocalTraversal(final String s) { - //intentionally ignore parsing flaw exploits - String temp = null; - temp = s.replace("/./", ""); - temp = temp.replace("./", ""); - return temp; - } //end of method - - + // intentionally ignore parsing flaw exploits + String temp = null; + temp = s.replace("/./", ""); + temp = temp.replace("./", ""); + return temp; + } // end of method + /** - * This method attempts to remove instances of - * Windows local directory traversal characters (\.\,.\) from the input. - * Windows traversal characters were left out on purpose. + * This method attempts to remove instances of Windows local directory traversal characters + * (\.\,.\) from the input. Windows traversal characters were left out on purpose. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static String removeWindowsLocalTraversal(final String s) { - //intentionally ignore parsing flaw exploits - String temp = null; - temp = s.replace("\\.\\", ""); - temp = temp.replace(".\\", ""); - return temp; - } //end of method + // intentionally ignore parsing flaw exploits + String temp = null; + temp = s.replace("\\.\\", ""); + temp = temp.replace(".\\", ""); + return temp; + } // end of method /** * This method attempts to remove various delimiters and tags from the input. + * * @param s Input string. * @return True to signify invalid input, or False for valid. * @since 1.2 */ public static String removeDelimitersAndTags(final String s) { - //intentionally ignore parsing flaw exploits - String temp = null; - temp = s.replace(";", ""); - temp = temp.replace("\n", ""); - temp = temp.replace("\r", ""); - temp = temp.replace("\t", ""); - temp = temp.replace("\\", ""); - temp = temp.replace("\"", ""); - temp = temp.replace("\'", ""); - temp = temp.replace("*", ""); - temp = temp.replace("<", ""); - temp = temp.replace(">", ""); - temp = temp.replace("(", ""); - temp = temp.replace(")", ""); - temp = temp.replace("]", ""); - temp = temp.replace("[", ""); - return temp; - } //end of method - -} //end of class \ No newline at end of file + // intentionally ignore parsing flaw exploits + String temp = null; + temp = s.replace(";", ""); + temp = temp.replace("\n", ""); + temp = temp.replace("\r", ""); + temp = temp.replace("\t", ""); + temp = temp.replace("\\", ""); + temp = temp.replace("\"", ""); + temp = temp.replace("\'", ""); + temp = temp.replace("*", ""); + temp = temp.replace("<", ""); + temp = temp.replace(">", ""); + temp = temp.replace("(", ""); + temp = temp.replace(")", ""); + temp = temp.replace("]", ""); + temp = temp.replace("[", ""); + return temp; + } // end of method +} // end of class