Skip to content

Handle null name and value in SecurityWrapperResponse.setHeader #924

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
VolodymyrLinuxovich wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Handle null name and value in SecurityWrapperResponse.setHeader #924

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions src/main/java/org/owasp/esapi/filters/SecurityWrapperResponse.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -491,10 +491,16 @@ public void setDateHeader(String name, long date) {
* linear white space with a single SP before interpreting the field value
* or forwarding the message downstream."
* http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2
* @param name
* @param value
* <p>
* As in the Servlet specification, a {@code null} name is ignored and a
* {@code null} value removes the header.
* @param name the header name; if {@code null}, nothing is done
* @param value the header value; if {@code null}, the header is removed
*/
public void setHeader(String name, String value) {
if (name == null) {
return;
}
SecurityConfiguration sc = ESAPI.securityConfiguration();
String strippedName = StringUtilities.stripControls(name);
String strippedValue = StringUtilities.stripControls(value);
Expand All @@ -506,6 +512,13 @@ public void setHeader(String name, String value) {
logger.warning(Logger.SECURITY_FAILURE, "Attempt to set invalid header NAME denied: HTTPHeaderName:"+ name, e);
}

if (value == null) {
if (StringUtilities.notNullOrEmpty(safeName, true)) {
getHttpServletResponse().setHeader(safeName, null);
}
return;
}

try {
safeValue = ESAPI.validator().getValidInput("setHeader", strippedValue, "HTTPHeaderValue", sc.getIntProp("HttpUtilities.MaxHeaderValueSize"), false);
} catch (ValidationException e) {
Expand Down
30 changes: 30 additions & 0 deletions src/test/java/org/owasp/esapi/filters/SecurityWrapperResponseTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,36 @@ public void setup() throws Exception {
}
}

@Test
public void testSetHeaderNullValueRemovesHeader() throws Exception {
PowerMockito.when(mockValidator.getValidInput(anyString(), ArgumentMatchers.eq(goodHeaderName),
ArgumentMatchers.eq(HEADER_NAME_CONTEXT),
ArgumentMatchers.eq(SecurityWrapperRequestTest.SECURITY_CONFIGURATION_TEST_LENGTH),
ArgumentMatchers.eq(false))).thenReturn(goodHeaderName);

PowerMockito.when(mockSecConfig.getIntProp(SEC_CTX_MAX_HEADER_NAME_SIZE_ATTR)).thenReturn(
SecurityWrapperRequestTest.SECURITY_CONFIGURATION_TEST_LENGTH);

SecurityWrapperResponse response = new SecurityWrapperResponse(mockResponse);

response.setHeader(goodHeaderName, null);

verify(mockValidator, times(0)).getValidInput(anyString(), ArgumentMatchers.isNull(), ArgumentMatchers.eq(HEADER_VALUE_CONTEXT), ArgumentMatchers.anyInt(), ArgumentMatchers.anyBoolean());
verify(mockResponse, times(1)).setHeader(goodHeaderName, null);
verify(mockLogger, times(0)).warning(ArgumentMatchers.any(org.owasp.esapi.Logger.EventType.class), anyString(), ArgumentMatchers.any(Exception.class));
}

@Test
public void testSetHeaderNullNameIsIgnored() throws Exception {
SecurityWrapperResponse response = new SecurityWrapperResponse(mockResponse);

response.setHeader(null, goodHeaderValue);

verify(mockValidator, times(0)).getValidInput(anyString(), ArgumentMatchers.any(), anyString(), ArgumentMatchers.anyInt(), ArgumentMatchers.anyBoolean());
verify(mockResponse, times(0)).setHeader(ArgumentMatchers.any(), ArgumentMatchers.any());
verify(mockLogger, times(0)).warning(ArgumentMatchers.any(org.owasp.esapi.Logger.EventType.class), anyString(), ArgumentMatchers.any(Exception.class));
}

@Test
public void testSetHeaderHappyPath() throws Exception {
String validateNameResponse = goodHeaderName;
Expand Down