forked from Hackademic/hackademic
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathSecurityConfiguration.php
More file actions
executable file
·371 lines (334 loc) · 12 KB
/
Copy pathSecurityConfiguration.php
File metadata and controls
executable file
·371 lines (334 loc) · 12 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
<?php
/**
* OWASP Enterprise Security API (ESAPI)
*
* This file is part of the Open Web Application Security Project (OWASP)
* Enterprise Security API (ESAPI) project.
*
* PHP version 5.2
*
* LICENSE: This source file is subject to the New BSD license. You should read
* and accept the LICENSE before you use, modify, and/or redistribute this
* software.
*
* @category OWASP
* @package ESAPI
* @author Andrew van der Stock <vanderaj@owasp.org>
* @author Mike Boberski <boberski_michael@bah.com>
* @copyright 2009-2010 The OWASP Foundation
* @license http://www.opensource.org/licenses/bsd-license.php New BSD license
* @version SVN: $Id$
* @link http://www.owasp.org/index.php/ESAPI
*/
/**
* Use this ESAPI security control to manage ESAPI security control
* functions.
*
* The idea behind this interface is to centralize ESAPI security control
* management.
*
* @category OWASP
* @package ESAPI
* @author Andrew van der Stock <vanderaj@owasp.org>
* @author Mike Boberski <boberski_michael@bah.com>
* @copyright 2009-2010 The OWASP Foundation
* @license http://www.opensource.org/licenses/bsd-license.php New BSD license
* @version Release: @package_version@
* @link http://www.owasp.org/index.php/ESAPI
*/
interface SecurityConfiguration
{
/**
* Gets the application name, used for logging
*
* @return string the name of the current application
*/
function getApplicationName();
/**
* Gets the master password. This password can be used to encrypt/decrypt other
* files or types of data that need to be protected by your application.
*
* @return string the current master password
*/
function getMasterKey();
/**
* Gets the master salt that is used to salt stored password hashes and any
* other location where a salt is needed.
*
* @return string the current master salt
*/
function getMasterSalt();
/**
* Gets the allowed file extensions for files that are uploaded to this
* application.
*
* @return array a list of the current allowed file extensions
*/
function getAllowedFileExtensions();
/**
* Gets the maximum allowed file upload size.
*
* @return int the current allowed file upload size
*/
function getAllowedFileUploadSize();
/**
* Gets the name of the password parameter used during user authentication.
*
* @return string the name of the password parameter
*/
function getPasswordParameterName();
/**
* Gets the name of the username parameter used during user authentication.
*
* @return string the name of the username parameter
*/
function getUsernameParameterName();
/**
* Gets the encryption algorithm used by ESAPI to protect data.
*
* @return string the current encryption algorithm
*/
function getEncryptionAlgorithm();
/**
* Gets the hashing algorithm used by ESAPI to hash data.
*
* @return string the current hashing algorithm
*/
function getHashAlgorithm();
/**
* Gets the character encoding scheme supported by this application. This is
* used to set the character encoding scheme on requests and responses when
* setCharacterEncoding() is called on SafeRequests and SafeResponses. This
* scheme is also used for encoding/decoding URLs and any other place where
* the current encoding scheme needs to be known.
* <br><br>
* Note: This does not get the configured response content type. That is
* accessed by calling getResponseContentType().
*
* @return string the current character encoding scheme
*/
function getCharacterEncoding();
/**
* Gets the digital signature algorithm used by ESAPI to generate and verify
* signatures.
*
* @return string the current digital signature algorithm
*/
function getDigitalSignatureAlgorithm();
/**
* Gets the random number generation algorithm used to generate random numbers
* where needed.
*
* @return string the current random number generation algorithm
*/
function getRandomAlgorithm();
/**
* Gets the number of login attempts allowed before the user's account is
* locked. If this many failures are detected within the alloted time period,
* the user's account will be locked.
*
* @return int the number of failed login attempts that cause an account to be
* locked
*/
function getAllowedLoginAttempts();
/**
* getAllowedIncludes returns an array of include files that are allowed to be
* included by PHP. This is a ESAPI extension for PHP
*
* @return array an array of allowed includes
*/
function getAllowedIncludes();
/**
* getAllowedResources returns an array of resources (files) that are permitted.
* This is a new addition for the ESAPI for PHP project, but may be relevant
* for other ports, too.
*
* @return array an array of allowed resources
*/
function getAllowedResources();
/**
* Gets the maximum number of old password hashes that should be retained.
* These hashes can be used to ensure that the user doesn't reuse the specified
* number of previous passwords when they change their password.
*
* @return int the number of old hashed passwords to retain
*/
function getMaxOldPasswordHashes();
/**
* Gets the intrusion detection quota for the specified event.
*
* @param string $eventName the name of the event whose quota is desired
*
* @return int the Quota that has been configured for the specified type of
* event
*/
function getQuota($eventName);
/**
* Allows for complete disabling of all intrusion detection mechanisms.
*
* @return bool true if intrusion detection should be disabled.
*/
function getDisableIntrusionDetection();
/**
* Gets the name of the ESAPI resource directory as a String.
*
* @return string The ESAPI resource directory.
*/
function getResourceDirectory();
/**
* Sets the ESAPI resource directory.
*
* @param string $dir The location of the resource directory.
*
* @return Does not return a value.
*/
function setResourceDirectory($dir);
/**
* Gets the content type for responses used when setSafeContentType() is called.
* <br><br>
* Note: This does not get the configured character encoding scheme. That is
* accessed by calling getCharacterEncoding().
*
* @return string The current content-type set for responses.
*/
function getResponseContentType();
/**
* Gets the length of the time to live window for remember me tokens (in
* milliseconds).
*
* @return int The time to live length for generated remember me tokens.
*/
function getRememberTokenDuration();
/**
* Gets the idle timeout length for sessions (in milliseconds). This is the
* amount of time that a session can live before it expires due to lack of
* activity. Applications or frameworks could provide a reauthenticate
* function that enables a session to continue after reauthentication.
*
* @return int The session idle timeout length.
*/
function getSessionIdleTimeoutLength();
/**
* Gets the absolute timeout length for sessions (in milliseconds). This is
* the amount of time that a session can live before it expires regardless
* of the amount of user activity. Applications or frameworks could provide a
* reauthenticate function that enables a session to continue after
* reauthentication.
*
* @return int The session absolute timeout length.
*/
function getSessionAbsoluteTimeoutLength();
/**
* Returns whether HTML entity encoding should be applied to log entries.
*
* @return bool True if log entries are to be HTML Entity encoded. False
* otherwise.
*/
function getLogEncodingRequired();
/**
* Get the log level specified in the ESAPI configuration properties file.
* Return a default value if it is not specified in the properties file.
*
* @return int the logging level defined in the properties file. If none is
* specified, the default of Logger.WARNING is returned.
*/
function getLogLevel();
/**
* Get the name of the log file specified in the ESAPI configuration properties
* file. Return a default value if it is not specified.
*
* @return string the log file name defined in the properties file.
*/
function getLogFileName();
/**
* Get the maximum size of a single log file from the ESAPI configuration
* properties file. Return a default value if it is not specified. Once the
* log hits this file size, it will roll over into a new log.
*
* @return int the maximum size of a single log file (in bytes).
*/
function getMaxLogFileSize();
/**
* Get the specified validation pattern from the ESAPI configuration properties
* file.
*
* @param string $type validation pattern name
*
* @return string the regular expression.
*/
function getValidationPattern($type);
/**
* getWorkingDirectory returns the default directory where processes will be
* executed by the Executor.
*
* @return string working directory name
*/
function getWorkingDirectory();
/**
* getAllowedExecutables returns an array of executables that are allowed to
* be run by the Executor.
*
* @return array an array of executable names
*/
function getAllowedExecutables();
}
/**
* Models a simple threshold as a count and an interval, along with a set of
* actions to take if the threshold is exceeded.
*
* These thresholds are used to define when the accumulation of a particular
* event has met a set number within the specified time period. Once a threshold
* value has been met, various actions can be taken at that point.
*
* PHP version 5.2
*
* @category OWASP
* @package ESAPI
* @author Jeff Williams <jeff.williams@aspectsecurity.com>
* @author Andrew van der Stock <vanderaj@owasp.org>
* @author Mike Boberski <boberski_michael@bah.com>
* @author jah <jah@jahboite.co.uk>
* @copyright 2009-2010 The OWASP Foundation
* @license http://www.opensource.org/licenses/bsd-license.php New BSD license
* @version Release: @package_version@
* @link http://www.owasp.org/index.php/ESAPI
*/
class Threshold
{
/** The name of this threshold. */
public $name = null;
/** The count at which this threshold is triggered. */
public $count = 0;
/**
* The time frame within which 'count' number of actions has to be detected in
* order to trigger this threshold.
*/
public $interval = 0;
/**
* The list of actions to take if the threshold is met. It is expected that
* this is a list of Strings, but your implementation could have this be a
* list of any type of 'actions' you wish to define.
*/
public $actions = null;
/**
* Constructs a threshold that is composed of its name, its threshold count,
* the time window for the threshold, and the actions to take if the threshold
* is triggered.
*
* @param string $name The name of this threshold.
* @param int $count The count at which this threshold is triggered.
* @param int $interval The time frame within which 'count' number of actions
* has to be detected in order to trigger this threshold.
* @param array $actions The list of actions to take if the threshold is met.
*
* @return Does not return a value.
*/
function __construct($name, $count, $interval, $actions)
{
$this->name = $name;
$this->count = $count;
$this->interval = $interval;
$this->actions = $actions;
}
}
?>