src/main/resources/ESAPI.properties - KorAP/Kustvakt - Gitiles

 #
 # OWASP Enterprise Security API (ESAPI) Properties file -- PRODUCTION Version
 #
 # This file is part of the Open Web de.ids_mannheim.korap.news.Application Security Project (OWASP)
 # Enterprise Security API (ESAPI) project. For details, please see
 # http://www.owasp.org/index.php/ESAPI.
 #
 # Copyright (c) 2008,2009 - The OWASP Foundation
 #
 # DISCUSS: This may cause a major backwards compatibility issue, etc. but
 #		   from a name space perspective, we probably should have prefaced
 #		   all the property names with ESAPI or at least OWASP. Otherwise
 #		   there could be problems is someone loads this properties file into
 #		   the System properties.  We could also put this file into the
 #		   esapi.jar file (perhaps as a ResourceBundle) and then allow an external
 #		   ESAPI properties be defined that would overwrite these defaults.
 #		   That keeps the application's properties relatively simple as usually
 #		   they will only want to override a few properties. If looks like we
 #		   already support multiple override levels of this in the
 #		   DefaultSecurityConfiguration class, but I'm suggesting placing the
 #		   defaults in the esapi.jar itself. That way, if the jar is signed,
 #		   we could detect if those properties had been tampered with. (The
 #		   code to isSystem the jar signatures is pretty simple... maybe 70-90 LOC,
 #		   but off course there is an execution penalty (similar to the way
 #		   that the separate sunjce.jar used to be when a class from it was
 #		   first loaded). Thoughts?
 ###############################################################################

 ESAPI.Randomizer=org.owasp.esapi.reference.DefaultRandomizer
 ESAPI.Validator=org.owasp.esapi.reference.DefaultValidator

 #===========================================================================
 # ESAPI Encoder
 #
 # ESAPI canonicalizes input before validation to prevent bypassing filters with encoded attacks.
 # Failure to canonicalize input is a very common mistake when implementing validation schemes.
 # Canonicalization is automatic when using the ESAPI Validator, but you can also use the
 # following code to canonicalize data.
 #
 #      ESAPI.Encoder().canonicalize( "%22hello world&#x22;" );
 #
 # Multiple encoding is when a single encoding format is applied multiple times. Allowing
 # multiple encoding is strongly discouraged.
 Encoder.AllowMultipleEncoding=false

 # Mixed encoding is when multiple different encoding formats are applied, or when
 # multiple formats are nested. Allowing multiple encoding is strongly discouraged.
 Encoder.AllowMixedEncoding=false

 # The default list of codecs to apply when canonicalizing untrusted data. The list should include the codecs
 # for all downstream interpreters or decoders. For example, if the data is likely to end up in a URL, HTML, or
 # inside JavaScript, then the list of codecs below is appropriate. The order of the list is not terribly important.
 Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec


 #===========================================================================
 # ESAPI Encryption
 #
 # The ESAPI Encryptor provides basic cryptographic functions with a simplified API.
 # To get started, generate a new key using java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor
 # There is not currently any support for key rotation, so be careful when changing your key and salt as it
 # will invalidate all signed, encrypted, and hashed data.
 #
 # WARNING: Not all combinations of algorithms and key lengths are supported.
 # If you choose to use a key length greater than 128, you MUST download the
 # unlimited strength policy files and install in the lib directory of your JRE/JDK.
 # See http://java.sun.com/javase/downloads/index.jsp for more information.
 #
 # Backward compatibility with ESAPI Java 1.4 is supported by the two deprecated API
 # methods, Encryptor.encrypt(String) and Encryptor.decrypt(String). However, whenever
 # possible, these methods should be avoided as they use ECB cipher mode, which in almost
 # all circumstances a poor choice because of it's weakness. CBC cipher mode is the default
 # for the new Encryptor encrypt / decrypt methods for ESAPI Java 2.0.  In general, you
 # should only use this compatibility setting if you have persistent data encrypted with
 # version 1.4 and even then, you should ONLY set this compatibility mode UNTIL
 # you have decrypted all of your old encrypted data and then re-encrypted it with
 # ESAPI 2.0 using CBC mode. If you have some reason to mix the deprecated 1.4 mode
 # with the new 2.0 methods, make sure that you use the same cipher algorithm for both
 # (256-bit AES was the default for 1.4; 128-bit is the default for 2.0; see below for
 # more details.) Otherwise, you will have to use the new 2.0 encrypt / decrypt methods
 # where you can specify a SecretKey. (Note that if you are using the 256-bit AES,
 # that requires downloading the special jurisdiction policy files mentioned above.)
 #
 #		***** IMPORTANT: Do NOT forget to replace these with your own values! *****
 # To calculate these values, you can run:
 #		java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor
 #
 #Encryptor.MasterKey=
 ## default key
 #Encryptor.MasterSalt=434fsdferbs7sdf5sdf+d23=a

 #==============================================================
 Encryptor.MasterKey=Nowq7w96tBckpYCPkoBtjQ==
 Encryptor.MasterSalt=vRaKzzh7hLp9v3CXi7KDI/1yO3A=
 #==============================================================

 #===========================================================================
 # ESAPI Intrusion Detection
 #
 # Each event has a base to which .count, .interval, and .action are added
 # The IntrusionException will fire if we receive "count" events within "interval" seconds
 # The IntrusionDetector is configurable to take the following actions: log, logout, and disable
 #  (multiple actions separated by commas are allowed e.g. event.test.actions=log,disable
 #
 # Custom Events
 # Names must start with "event." as the base
 # Use IntrusionDetector.addEvent( "test" ) in your code to trigger "event.test" here
 # You can also disable intrusion detection completely by changing
 # the following parameter to true
 #
 IntrusionDetector.Disable=false
 #
 IntrusionDetector.event.test.count=2
 IntrusionDetector.event.test.interval=10
 IntrusionDetector.event.test.actions=disable,log

 # Exception Events
 # All EnterpriseSecurityExceptions are registered automatically
 # Call IntrusionDetector.getInstance().addException(e) for Exceptions that do not extend EnterpriseSecurityException
 # Use the fully qualified classname of the exception as the base

 # any intrusion is an attack
 IntrusionDetector.org.owasp.esapi.errors.IntrusionException.count=1
 IntrusionDetector.org.owasp.esapi.errors.IntrusionException.interval=1
 IntrusionDetector.org.owasp.esapi.errors.IntrusionException.actions=log,disable,logout

 # for test purposes
 # CHECKME: Shouldn't there be something in the property name itself that designates
 #		   that these are for testing???
 IntrusionDetector.org.owasp.esapi.errors.IntegrityException.count=10
 IntrusionDetector.org.owasp.esapi.errors.IntegrityException.interval=5
 IntrusionDetector.org.owasp.esapi.errors.IntegrityException.actions=log,disable,logout

 # rapid validation errors indicate scans or attacks in progress
 org.owasp.esapi.errors.ValidationException.count=10
 org.owasp.esapi.errors.ValidationException.interval=10
 org.owasp.esapi.errors.ValidationException.actions=log,logout

 # sessions jumping between hosts indicates session hijacking
 IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.count=2
 IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.interval=10
 IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.actions=log,logout


 #===========================================================================
 # ESAPI Validation
 #
 # The ESAPI Validator works on regular expressions with defined names. You can define names
 # either here, or you may define application specific patterns in a separate file defined below.
 # This allows enterprises to specify both organizational standards as well as application specific
 # validation rules.
 #
 Validator.ConfigurationFile=validation.properties

 # Validators used by ESAPI
 Validator.AccountName=^[a-zA-Z0-9]{3,20}$
 Validator.SystemCommand=^[a-zA-Z\\-\\/]{1,64}$
 Validator.RoleName=^[a-z]{1,20}$

 #the word TEST below should be changed to your application
 #name - only relative URL's are supported
 Validator.Redirect=^\\/test.*$

 # Global HTTP Validation Rules
 # Values with Base64 encoded data (e.g. encrypted state) will need at least [a-zA-Z0-9\/+=]
 Validator.HTTPScheme=^(http|https)$
 Validator.HTTPServerName=^[a-zA-Z0-9_.\\-]*$
 Validator.HTTPParameterName=^[a-zA-Z0-9_]{1,32}$
 Validator.HTTPParameterValue=^[a-zA-Z0-9.\\-\\/+=@_ ]*$
 Validator.HTTPCookieName=^[a-zA-Z0-9\\-_]{1,32}$
 Validator.HTTPCookieValue=^[a-zA-Z0-9\\-\\/+=_ ]*$
 Validator.HTTPHeaderName=^[a-zA-Z0-9\\-_]{1,32}$
 Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$
 Validator.HTTPContextPath=^\\/?[a-zA-Z0-9.\\-\\/_]*$
 Validator.HTTPServletPath=^[a-zA-Z0-9.\\-\\/_]*$
 Validator.HTTPPath=^[a-zA-Z0-9.\\-_]*$
 Validator.HTTPQueryString=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ %]*$
 Validator.HTTPURI=^[a-zA-Z0-9()\\-=\\*\\.\\?;,+\\/:&_ ]*$
 Validator.HTTPURL=^.*$
 Validator.HTTPJSESSIONID=^[A-Z0-9]{10,30}$

 # Validation of file related input
 Validator.FileName=^[a-zA-Z0-9!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$
 Validator.DirectoryName=^[a-zA-Z0-9:/\\\\!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$

 # Validation of dates. Controls whether or not 'lenient' dates are accepted.
 # See DataFormat.setLenient(boolean flag) for further details.
 Validator.AcceptLenientDates=false
	#
	# OWASP Enterprise Security API (ESAPI) Properties file -- PRODUCTION Version
	#
	# This file is part of the Open Web de.ids_mannheim.korap.news.Application Security Project (OWASP)
	# Enterprise Security API (ESAPI) project. For details, please see
	# http://www.owasp.org/index.php/ESAPI.
	#
	# Copyright (c) 2008,2009 - The OWASP Foundation
	#
	# DISCUSS: This may cause a major backwards compatibility issue, etc. but
	# from a name space perspective, we probably should have prefaced
	# all the property names with ESAPI or at least OWASP. Otherwise
	# there could be problems is someone loads this properties file into
	# the System properties. We could also put this file into the
	# esapi.jar file (perhaps as a ResourceBundle) and then allow an external
	# ESAPI properties be defined that would overwrite these defaults.
	# That keeps the application's properties relatively simple as usually
	# they will only want to override a few properties. If looks like we
	# already support multiple override levels of this in the
	# DefaultSecurityConfiguration class, but I'm suggesting placing the
	# defaults in the esapi.jar itself. That way, if the jar is signed,
	# we could detect if those properties had been tampered with. (The
	# code to isSystem the jar signatures is pretty simple... maybe 70-90 LOC,
	# but off course there is an execution penalty (similar to the way
	# that the separate sunjce.jar used to be when a class from it was
	# first loaded). Thoughts?
	###############################################################################

	ESAPI.Randomizer=org.owasp.esapi.reference.DefaultRandomizer
	ESAPI.Validator=org.owasp.esapi.reference.DefaultValidator

	#===========================================================================
	# ESAPI Encoder
	#
	# ESAPI canonicalizes input before validation to prevent bypassing filters with encoded attacks.
	# Failure to canonicalize input is a very common mistake when implementing validation schemes.
	# Canonicalization is automatic when using the ESAPI Validator, but you can also use the
	# following code to canonicalize data.
	#
	# ESAPI.Encoder().canonicalize( "%22hello world"" );
	#
	# Multiple encoding is when a single encoding format is applied multiple times. Allowing
	# multiple encoding is strongly discouraged.
	Encoder.AllowMultipleEncoding=false

	# Mixed encoding is when multiple different encoding formats are applied, or when
	# multiple formats are nested. Allowing multiple encoding is strongly discouraged.
	Encoder.AllowMixedEncoding=false

	# The default list of codecs to apply when canonicalizing untrusted data. The list should include the codecs
	# for all downstream interpreters or decoders. For example, if the data is likely to end up in a URL, HTML, or
	# inside JavaScript, then the list of codecs below is appropriate. The order of the list is not terribly important.
	Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec


	#===========================================================================
	# ESAPI Encryption
	#
	# The ESAPI Encryptor provides basic cryptographic functions with a simplified API.
	# To get started, generate a new key using java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor
	# There is not currently any support for key rotation, so be careful when changing your key and salt as it
	# will invalidate all signed, encrypted, and hashed data.
	#
	# WARNING: Not all combinations of algorithms and key lengths are supported.
	# If you choose to use a key length greater than 128, you MUST download the
	# unlimited strength policy files and install in the lib directory of your JRE/JDK.
	# See http://java.sun.com/javase/downloads/index.jsp for more information.
	#
	# Backward compatibility with ESAPI Java 1.4 is supported by the two deprecated API
	# methods, Encryptor.encrypt(String) and Encryptor.decrypt(String). However, whenever
	# possible, these methods should be avoided as they use ECB cipher mode, which in almost
	# all circumstances a poor choice because of it's weakness. CBC cipher mode is the default
	# for the new Encryptor encrypt / decrypt methods for ESAPI Java 2.0. In general, you
	# should only use this compatibility setting if you have persistent data encrypted with
	# version 1.4 and even then, you should ONLY set this compatibility mode UNTIL
	# you have decrypted all of your old encrypted data and then re-encrypted it with
	# ESAPI 2.0 using CBC mode. If you have some reason to mix the deprecated 1.4 mode
	# with the new 2.0 methods, make sure that you use the same cipher algorithm for both
	# (256-bit AES was the default for 1.4; 128-bit is the default for 2.0; see below for
	# more details.) Otherwise, you will have to use the new 2.0 encrypt / decrypt methods
	# where you can specify a SecretKey. (Note that if you are using the 256-bit AES,
	# that requires downloading the special jurisdiction policy files mentioned above.)
	#
	# *** IMPORTANT: Do NOT forget to replace these with your own values! ***
	# To calculate these values, you can run:
	# java -classpath esapi.jar org.owasp.esapi.reference.crypto.JavaEncryptor
	#
	#Encryptor.MasterKey=
	## default key
	#Encryptor.MasterSalt=434fsdferbs7sdf5sdf+d23=a

	#==============================================================
	Encryptor.MasterKey=Nowq7w96tBckpYCPkoBtjQ==
	Encryptor.MasterSalt=vRaKzzh7hLp9v3CXi7KDI/1yO3A=
	#==============================================================

	#===========================================================================
	# ESAPI Intrusion Detection
	#
	# Each event has a base to which .count, .interval, and .action are added
	# The IntrusionException will fire if we receive "count" events within "interval" seconds
	# The IntrusionDetector is configurable to take the following actions: log, logout, and disable
	# (multiple actions separated by commas are allowed e.g. event.test.actions=log,disable
	#
	# Custom Events
	# Names must start with "event." as the base
	# Use IntrusionDetector.addEvent( "test" ) in your code to trigger "event.test" here
	# You can also disable intrusion detection completely by changing
	# the following parameter to true
	#
	IntrusionDetector.Disable=false
	#
	IntrusionDetector.event.test.count=2
	IntrusionDetector.event.test.interval=10
	IntrusionDetector.event.test.actions=disable,log

	# Exception Events
	# All EnterpriseSecurityExceptions are registered automatically
	# Call IntrusionDetector.getInstance().addException(e) for Exceptions that do not extend EnterpriseSecurityException
	# Use the fully qualified classname of the exception as the base

	# any intrusion is an attack
	IntrusionDetector.org.owasp.esapi.errors.IntrusionException.count=1
	IntrusionDetector.org.owasp.esapi.errors.IntrusionException.interval=1
	IntrusionDetector.org.owasp.esapi.errors.IntrusionException.actions=log,disable,logout

	# for test purposes
	# CHECKME: Shouldn't there be something in the property name itself that designates
	# that these are for testing???
	IntrusionDetector.org.owasp.esapi.errors.IntegrityException.count=10
	IntrusionDetector.org.owasp.esapi.errors.IntegrityException.interval=5
	IntrusionDetector.org.owasp.esapi.errors.IntegrityException.actions=log,disable,logout

	# rapid validation errors indicate scans or attacks in progress
	org.owasp.esapi.errors.ValidationException.count=10
	org.owasp.esapi.errors.ValidationException.interval=10
	org.owasp.esapi.errors.ValidationException.actions=log,logout

	# sessions jumping between hosts indicates session hijacking
	IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.count=2
	IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.interval=10
	IntrusionDetector.org.owasp.esapi.errors.AuthenticationHostException.actions=log,logout


	#===========================================================================
	# ESAPI Validation
	#
	# The ESAPI Validator works on regular expressions with defined names. You can define names
	# either here, or you may define application specific patterns in a separate file defined below.
	# This allows enterprises to specify both organizational standards as well as application specific
	# validation rules.
	#
	Validator.ConfigurationFile=validation.properties

	# Validators used by ESAPI
	Validator.AccountName=^[a-zA-Z0-9]{3,20}$
	Validator.SystemCommand=^[a-zA-Z\\-\\/]{1,64}$
	Validator.RoleName=^[a-z]{1,20}$

	#the word TEST below should be changed to your application
	#name - only relative URL's are supported
	Validator.Redirect=^\\/test.*$

	# Global HTTP Validation Rules
	# Values with Base64 encoded data (e.g. encrypted state) will need at least [a-zA-Z0-9\/+=]
	Validator.HTTPScheme=^(http\|https)$
	Validator.HTTPServerName=^[a-zA-Z0-9_.\\-]*$
	Validator.HTTPParameterName=^[a-zA-Z0-9_]{1,32}$
	Validator.HTTPParameterValue=^[a-zA-Z0-9.\\-\\/+=@_ ]*$
	Validator.HTTPCookieName=^[a-zA-Z0-9\\-_]{1,32}$
	Validator.HTTPCookieValue=^[a-zA-Z0-9\\-\\/+=_ ]*$
	Validator.HTTPHeaderName=^[a-zA-Z0-9\\-_]{1,32}$
	Validator.HTTPHeaderValue=^[a-zA-Z0-9()\\-=\\\\.\\?;,+\\/:&_ ]$
	Validator.HTTPContextPath=^\\/?[a-zA-Z0-9.\\-\\/_]*$
	Validator.HTTPServletPath=^[a-zA-Z0-9.\\-\\/_]*$
	Validator.HTTPPath=^[a-zA-Z0-9.\\-_]*$
	Validator.HTTPQueryString=^[a-zA-Z0-9()\\-=\\\\.\\?;,+\\/:&_ %]$
	Validator.HTTPURI=^[a-zA-Z0-9()\\-=\\\\.\\?;,+\\/:&_ ]$
	Validator.HTTPURL=^.*$
	Validator.HTTPJSESSIONID=^[A-Z0-9]{10,30}$

	# Validation of file related input
	Validator.FileName=^[a-zA-Z0-9!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$
	Validator.DirectoryName=^[a-zA-Z0-9:/\\\\!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$

	# Validation of dates. Controls whether or not 'lenient' dates are accepted.
	# See DataFormat.setLenient(boolean flag) for further details.
	Validator.AcceptLenientDates=false