forked from Hackademic/hackademic
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathESAPI.php
More file actions
executable file
·444 lines (403 loc) · 13 KB
/
Copy pathESAPI.php
File metadata and controls
executable file
·444 lines (403 loc) · 13 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
<?php
/**
* OWASP Enterprise Security API (ESAPI)
*
* This file is part of the Open Web Application Security Project (OWASP)
* Enterprise Security API (ESAPI) project.
*
* PHP version 5.2
*
* LICENSE: This source file is subject to the New BSD license. You should read
* and accept the LICENSE before you use, modify, and/or redistribute this
* software.
*
* @category OWASP
* @package ESAPI
* @author Andrew van der Stock <vanderaj@owasp.org>
* @author Bipin Upadhyay <bipin.code@gmail.com>
* @author Mike Boberski <boberski_michael@bah.com>
* @copyright 2009-2010 The OWASP Foundation
* @license http://www.opensource.org/licenses/bsd-license.php New BSD license
* @version SVN: $Id$
* @link http://www.owasp.org/index.php/ESAPI
*/
/**
* Use this class to get and set ESAPI security controls.
*
* This class is also known as the "ESAPI locator class". Before you
* can use an ESAPI security control, you must first use this class to
* get an instance of the security control. You can use the set functions
* to override default security control implementations.
*
* @category OWASP
* @package ESAPI
* @author Andrew van der Stock <vanderaj@owasp.org>
* @author Bipin Upadhyay <bipin.code@gmail.com>
* @author Mike Boberski <boberski_michael@bah.com>
* @copyright 2009-2010 The OWASP Foundation
* @license http://www.opensource.org/licenses/bsd-license.php New BSD license
* @version Release: @package_version@
* @link http://www.owasp.org/index.php/ESAPI
*/
class ESAPI
{
private static $_accessController = null;
private static $_encoder = null;
private static $_encryptor = null;
private static $_executor = null;
private static $_httpUtilities = null;
private static $_intrusionDetector = null;
private static $_defaultAuditor = null;
private static $_auditorFactory= null;
private static $_randomizer = null;
private static $_securityConfiguration = null;
private static $_validator = null;
private static $_sanitizer = null;
/**
* This is the locator class' constructor, which prevents instantiation of this
* class.
*
* @param string $path the path of the ESAPI.xml configuration file.
*/
public function __construct($path = '')
{
self::getSecurityConfiguration($path);
self::getAuditor("ESAPI Startup");
self::getIntrusionDetector();
}
/**
* Get the current HTTP Servlet Request being processed.
*
* @return the current HTTP Servlet Request.
*/
public static function currentRequest()
{
return self::getHttpUtilities()->getCurrentRequest();
}
/**
* Get the current HTTP Servlet Response being generated.
*
* @return the current HTTP Servlet Response.
*/
public static function currentResponse()
{
return self::getHttpUtilities()->getCurrentResponse();
}
/**
* Get the current ESAPI AccessController object being used to maintain the
* access control rules for this application.
*
* @return the current ESAPI AccessController.
*/
public static function getAccessController()
{
if ( is_null(self::$_accessController) ) {
include_once dirname(__FILE__).
'/reference/FileBasedAccessController.php';
self::$_accessController = new FileBasedAccessController();
}
return self::$_accessController;
}
/**
* Set the current ESAPI AccessController object being used to maintain the
* access control rules for this application.
*
* @param AccessController $accessController the new ESAPI AccessController.
*
* @return does not return a value.
*/
public static function setAccessController($accessController)
{
self::$_accessController = $accessController;
}
/**
* Get the current ESAPI Encoder object being used to encode and decode data for
* this application
*
* @return the current ESAPI Encoder.
*/
public static function getEncoder()
{
if ( is_null(self::$_encoder) ) {
include_once dirname(__FILE__).
'/reference/DefaultEncoder.php';
self::$_encoder = new DefaultEncoder();
}
return self::$_encoder;
}
/**
* Set the current ESAPI Encoder object being used to encode and decode data
* for this application.
*
* @param Encoder $encoder the new ESAPI AccessController.
*
* @return does not return a value.
*/
public static function setEncoder($encoder)
{
self::$_encoder = $encoder;
}
/**
* Get the current ESAPI Encryptor object being used to encrypt and decrypt data
* for this application.
*
* @return the current ESAPI Encryptor.
*/
public static function getEncryptor()
{
throw new EnterpriseSecurityException(
'Method Not implemented',
'Encryptor not implemented'
);
}
/**
* Set the current ESAPI Encryptor object being used to encrypt and decrypt
* data for this application.
*
* @param Encryptor $encryptor the new ESAPI Encryptor.
*
* @return does not return a value.
*/
public static function setEncryptor($encryptor)
{
throw new EnterpriseSecurityException(
'Method Not implemented',
'Encryptor not implemented'
);
}
/**
* Get the current ESAPI Executor object being used to safely execute OS
* commands for this application.
*
* @return the current ESAPI Executor.
*/
public static function getExecutor()
{
if ( is_null(self::$_executor) ) {
include_once dirname(__FILE__).
'/reference/DefaultExecutor.php';
self::$_executor = new DefaultExecutor();
}
return self::$_executor;
}
/**
* Set the current ESAPI Executor object being used to safely execute OS
* commands for this application.
*
* @param Executor $executor the new ESAPI Executor.
*
* @return does not return a value.
*/
public static function setExecutor($executor)
{
self::$_executor = $executor;
}
/**
* Get the current ESAPI HTTPUtilities object being used to safely access HTTP
* requests and responses for this application.
*
* @return the current ESAPI HTTPUtilities.
*/
public static function getHttpUtilities()
{
if ( is_null(self::$_httpUtilities) ) {
include_once dirname(__FILE__).
'/reference/DefaultHTTPUtilities.php';
self::$_httpUtilities = new DefaultHTTPUtilities();
}
return self::$_httpUtilities;
}
/**
* Set the current ESAPI HttpUtilities object being used to safely access HTTP
* requests and responses for this application.
*
* @param HttpUtilities $httpUtilities the new ESAPI HttpUtilities.
*
* @return does not return a value.
*/
public static function setHttpUtilities($httpUtilities)
{
self::$_httpUtilities = $httpUtilities;
}
/**
* Get the current ESAPI IntrusionDetector object being used to monitor for
* intrusions in this application.
*
* @return the current ESAPI IntrusionDetector.
*/
public static function getIntrusionDetector()
{
if ( is_null(self::$_intrusionDetector) ) {
include_once dirname(__FILE__).
'/reference/DefaultIntrusionDetector.php';
self::$_intrusionDetector = new DefaultIntrusionDetector();
}
return self::$_intrusionDetector;
}
/**
* Set the current ESAPI AccessController object being used to to monitor for
* intrusions in this application.
*
* @param IntrusionDetector $intrusionDetector the new ESAPI IntrusionDetector.
*
* @return does not return a value.
*/
public static function setIntrusionDetector($intrusionDetector)
{
self::$_intrusionDetector = $intrusionDetector;
}
/**
* Set then get the current ESAPI Logger factory object being used to create
* the ESAPI Logger for this application.
*
* @param string $logger the new ESAPI Auditor factory name.
*
* @return the current ESAPI Logger.
*/
public static function getAuditor($logger)
{
if (self::$_auditorFactory == null) {
include_once dirname(__FILE__).
'/reference/DefaultAuditorFactory.php';
self::setAuditorFactory(new DefaultAuditorFactory());
}
return self::$_auditorFactory->getLogger($logger);
}
/**
* Get the current ESAPI Auditor object being used to to audit security-relevant
* events for this application.
*
* @return the current ESAPI Logger.
*/
public static function log()
{
if (self::$_defaultAuditor == null) {
self::$_defaultAuditor = self::$_auditorFactory->getLogger("DefaultLogger");
}
return self::$_defaultAuditor;
}
/**
* Set the current ESAPI Logger factory object being used to create
* the ESAPI Logger for this application.
*
* @param string $factory the new ESAPI Logger factory.
*
* @return does not return a value.
*/
public static function setAuditorFactory($factory)
{
self::$_auditorFactory = $factory;
}
/**
* Get the current ESAPI Randomizer object being used to generate random numbers
* for this application.
*
* @return the current ESAPI Randomizer.
*/
public static function getRandomizer()
{
if ( is_null(self::$_randomizer) ) {
include_once dirname(__FILE__).
'/reference/DefaultRandomizer.php';
self::$_randomizer = new DefaultRandomizer();
}
return self::$_randomizer;
}
/**
* Set the current ESAPI Randomizer object being used to generate random numbers
* for this application.
*
* @param Randomizer $randomizer the new ESAPI Randomizer.
*
* @return does not return a value.
*/
public static function setRandomizer($randomizer)
{
self::$_randomizer = $randomizer;
}
/**
* Get the current ESAPI SecurityConfiguration object being used to manage the
* security configuration for this application.
*
* @param string $path the path of the ESAPI.xml configuration file.
*
* @return the current ESAPI SecurityConfiguration.
*/
public static function getSecurityConfiguration($path = '')
{
if ( is_null(self::$_securityConfiguration) ) {
include_once dirname(__FILE__).
'/reference/DefaultSecurityConfiguration.php';
self::$_securityConfiguration = new DefaultSecurityConfiguration($path);
}
return self::$_securityConfiguration;
}
/**
* Set the current ESAPI SecurityConfiguration object being used to manage the
* security configuration for this application.
*
* @param SecurityConfiguration $securityConfiguration the new ESAPI
* SecurityConfiguration.
*
* @return does not return a value.
*/
public static function setSecurityConfiguration($securityConfiguration)
{
self::$_securityConfiguration = $securityConfiguration;
}
/**
* Get the current ESAPI Validator object being used to validate data for this
* application.
*
* @return the current ESAPI Validator.
*/
public static function getValidator()
{
if ( is_null(self::$_validator) ) {
include_once dirname(__FILE__).
'/reference/DefaultValidator.php';
self::$_validator = new DefaultValidator();
}
return self::$_validator;
}
/**
* Set the current ESAPI Validator object being used to validate data for
* this application.
*
* @param Validator $validator the new ESAPI Validator.
*
* @return does not return a value.
*/
public static function setValidator($validator)
{
self::$_validator = $validator;
}
/**
* Get the current ESAPI Sanitizer object being used to sanitize data for
* this application.
*
* @return the current ESAPI Sanitizer.
*/
public static function getSanitizer()
{
if ( is_null(self::$_sanitizer) ) {
include_once dirname(__FILE__).
'/reference/DefaultSanitizer.php';
self::$_sanitizer = new DefaultSanitizer();
}
return self::$_sanitizer;
}
/**
* Set the current ESAPI Sanitizer object being used to sanitize data for
* this application.
*
* @param Sanitizer $sanitizer the new ESAPI Sanitizer.
*
* @return does not return a value.
*/
public static function setSanitizer($sanitizer)
{
self::$_sanitizer = $sanitizer;
}
}
?>