Java 在哪里可以找到 ESAPI.properties？

Where can I find ESAPI.properties?

提问by Pro

Am trying to use OWASP ESAPI library in my web app to escape request parameters in JSPs as below ESAPI.encoder().encodeForHTML(request.getParameter()).

我试图在我的网络应用程序中使用 OWASP ESAPI 库来转义 JSP 中的请求参数，如下 ESAPI.encoder().encodeForHTML(request.getParameter())。

I have added esapi-2.1.0.jar under WEB-INF/lib but I get the below exception

我在 WEB-INF/lib 下添加了 esapi-2.1.0.jar 但出现以下异常

org.owasp.esapi.errors.ConfigurationException: ESAPI.properties could not be loaded by any means. Fail. org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfiguration(DefaultSecurityConfiguration.java:439)

org.owasp.esapi.errors.ConfigurationException：无法以任何方式加载 ESAPI.properties。失败。org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfiguration(DefaultSecurityConfiguration.java:439)

But I couldnt find ESAPI.properties in the JAR file. Any idea where I can get this? Also where should I place this properties file? Please help.

但是我在 JAR 文件中找不到 ESAPI.properties。知道我在哪里可以得到这个吗？另外我应该在哪里放置这个属性文件？请帮忙。

回答by Deepesh verma

Here is the reference: ESAPI installation guide.

这是参考：ESAPI 安装指南。

You can download ESAPI.properties from here.

您可以从这里下载 ESAPI.properties 。

You can create ESAPI.properties file yourself and place the same content there. It should be placed in your 'src/main/resources' folder.

您可以自己创建 ESAPI.properties 文件并将相同的内容放在那里。它应该放在你的“src/main/resources”文件夹中。

Also you will need validation.properties file to handle XSS, which should be placed in 'src/test/resources' folder.

您还需要validation.properties 文件来处理XSS，它应该放在'src/test/resources' 文件夹中。

Please make sure to change the application name in these properties file to your application as in

请确保将这些属性文件中的应用程序名称更改为您的应用程序，如

Validator.Redirect=^\/test.*$

testshould be replaced with your application name.

test应替换为您的应用程序名称。

回答by Aniket Thakur

I was looking for the same file as while deploying my webapp I was getting -

我正在寻找与部署 webapp 时相同的文件 -

Mar 08, 2017 1:23:12 PM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet [mvc-dispatcher] in context with path [/WebDynamo] threw exception [org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException SecurityConfiguration class (org.owasp.esapi.reference.DefaultSecurityConfiguration) CTOR threw exception.] with root cause
java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.
    at org.owasp.esapi.reference.DefaultSecurityConfiguration.loadConfigurationFromClasspath(DefaultSecurityConfiguration.java:667)

Anyway for my webapp I just added ESAPI.properties in source root folder (src folder) (don't add it in any package). And the file is just empty. And web app works just fine. I see following logs in the webapp so if you are ever wondering where this file is being searched then refer this -

无论如何，对于我的 webapp，我只是在源根文件夹（src 文件夹）中添加了 ESAPI.properties（不要将它添加到任何包中）。而文件只是空的。网络应用程序运行良好。我在 webapp 中看到以下日志，因此如果您想知道正在搜索此文件的位置，请参考此 -

Attempting to load ESAPI.properties via file I/O.
Attempting to load ESAPI.properties as resource file via file I/O.
Not found in 'org.owasp.esapi.resources' directory or file not readable: /Applications/Eclipse.app/Contents/MacOS/ESAPI.properties
Not found in SystemResource Directory/resourceDirectory: .esapi/ESAPI.properties
Not found in 'user.home' (/Users/athakur) directory: /Users/athakur/esapi/ESAPI.properties
Loading ESAPI.properties via file I/O failed. Exception was: java.io.FileNotFoundException
Attempting to load ESAPI.properties via the classpath.
SUCCESSFULLY LOADED ESAPI.properties via the CLASSPATH from '/ (root)' using current thread context class loader!
SecurityConfiguration for Validator.ConfigurationFile not found in ESAPI.properties. Using default: validation.properties
Attempting to load validation.properties via file I/O.
Attempting to load validation.properties as resource file via file I/O.
Not found in 'org.owasp.esapi.resources' directory or file not readable: /Applications/Eclipse.app/Contents/MacOS/validation.properties
Not found in SystemResource Directory/resourceDirectory: .esapi/validation.properties
Not found in 'user.home' (/Users/athakur) directory: /Users/athakur/esapi/validation.properties
Loading validation.properties via file I/O failed.
Attempting to load validation.properties via the classpath.
validation.properties could not be loaded by any means. fail. Exception was: java.lang.IllegalArgumentException: Failed to load ESAPI.properties as a classloader resource.
SecurityConfiguration for ESAPI.printProperties not found in ESAPI.properties. Using default: false
SecurityConfiguration for Encryptor.CipherTransformation not found in ESAPI.properties. Using default: AES/CBC/PKCS5Padding
SecurityConfiguration for ESAPI.Encoder not found in ESAPI.properties. Using default: org.owasp.esapi.reference.DefaultEncoder
SecurityConfiguration for ESAPI.Logger not found in ESAPI.properties. Using default: org.owasp.esapi.reference.JavaLogFactory
SecurityConfiguration for Logger.LogApplicationName not found in ESAPI.properties. Using default: true
SecurityConfiguration for Logger.LogServerIP not found in ESAPI.properties. Using default: true
SecurityConfiguration for Logger.ApplicationName not found in ESAPI.properties. Using default: DefaultName

I am sure these are configurable and other files too you can add it src folder. Also I found this file in -

我确信这些是可配置的，其他文件也可以添加到 src 文件夹中。我也发现了这个文件 -

https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties

https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/WebContent/ESAPI.properties

The file is pretty big to paste it's contents here but based on default values it is setting as per logs above following things are required -

该文件非常大，无法将其内容粘贴到此处，但基于默认值，它根据上面的日志进行设置，需要以下内容-

ESAPI.printProperties=true
Encryptor.CipherTransformation=AES/CBC/PKCS5Padding
ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
# Log4JFactory Requires log4j.xml or log4j.properties in classpath - http://www.laliluna.de/log4j-tutorial.html
ESAPI.Logger=org.owasp.esapi.reference.Log4JLogFactory
# Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments.
Logger.LogApplicationName=true
# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
Logger.LogServerIP=true
# Set the application name if these logs are combined with other applications
Logger.ApplicationName=ExampleApplication

回答by Lonzak

Ok since the above links are all broken or will be outdated in a while (e.g. link to a specific version) here is the Github Link:

好的，因为以上链接都已损坏或将在一段时间内过时（例如链接到特定版本），这里是 Github 链接：

https://github.com/ESAPI/esapi-java-legacy/tree/develop/configuration/esapi

https://github.com/ESAPI/esapi-java-legacy/tree/develop/configuration/esapi