public void contextInitialized(ServletContextEvent event) {
ServletContext context = event.getServletContext();
String appPath = event.getServletContext().getRealPath("");
String config = context.getInitParameter(CONFIG_PARAM);
String extensions = context.getInitParameter(CONFIG_EXTENSIONS_PARAM);
if (config == null) {
throw new RuntimeException(
String.format("failure to specify context init-param - %s", CONFIG_PARAM));
}
if (extensions == null) {
throw new RuntimeException(
String.format("failure to specify context init-param - %s", CONFIG_EXTENSIONS_PARAM));
}
InputStream is = null;
Properties properties = new Properties();
try {
is = getResourceStream(appPath + config, context);
properties.load(is);
addCsrfExcludeProperties(appPath + extensions, properties);
CsrfGuard.load(properties);
} catch (Exception e) {
throw new RuntimeException(e);
} finally {
Streams.close(is);
}
String printConfig = context.getInitParameter(CONFIG_PRINT_PARAM);
if (printConfig != null && Boolean.parseBoolean(printConfig)) {
context.log(CsrfGuard.getInstance().toString());
}
}
public static void load(Properties properties)
throws NoSuchAlgorithmException, InstantiationException, IllegalAccessException,
ClassNotFoundException, IOException, NoSuchProviderException {
CsrfGuard csrfGuard = SingletonHolder.instance;
/** load simple properties * */
csrfGuard.setLogger(
(ILogger)
Class.forName(
properties.getProperty(
"org.owasp.csrfguard.Logger", "org.owasp.csrfguard.log.ConsoleLogger"))
.newInstance());
csrfGuard.setTokenName(
properties.getProperty("org.owasp.csrfguard.TokenName", "OWASP_CSRFGUARD"));
csrfGuard.setTokenLength(
Integer.parseInt(properties.getProperty("org.owasp.csrfguard.TokenLength", "32")));
csrfGuard.setRotate(
Boolean.valueOf(properties.getProperty("org.owasp.csrfguard.Rotate", "false")));
csrfGuard.setTokenPerPage(
Boolean.valueOf(properties.getProperty("org.owasp.csrfguard.TokenPerPage", "false")));
csrfGuard.setTokenPerPagePrecreate(
Boolean.valueOf(
properties.getProperty("org.owasp.csrfguard.TokenPerPagePrecreate", "false")));
csrfGuard.setPrng(
SecureRandom.getInstance(
properties.getProperty("org.owasp.csrfguard.PRNG", "SHA1PRNG"),
properties.getProperty("org.owasp.csrfguard.PRNG.Provider", "SUN")));
csrfGuard.setNewTokenLandingPage(
properties.getProperty("org.owasp.csrfguard.NewTokenLandingPage"));
// default to false if newTokenLandingPage is not set; default to true if set.
if (csrfGuard.getNewTokenLandingPage() == null) {
csrfGuard.setUseNewTokenLandingPage(
Boolean.valueOf(
properties.getProperty("org.owasp.csrfguard.UseNewTokenLandingPage", "false")));
} else {
csrfGuard.setUseNewTokenLandingPage(
Boolean.valueOf(
properties.getProperty("org.owasp.csrfguard.UseNewTokenLandingPage", "true")));
}
csrfGuard.setSessionKey(
properties.getProperty("org.owasp.csrfguard.SessionKey", "OWASP_CSRFGUARD_KEY"));
csrfGuard.setAjax(Boolean.valueOf(properties.getProperty("org.owasp.csrfguard.Ajax", "false")));
csrfGuard.setProtect(
Boolean.valueOf(properties.getProperty("org.owasp.csrfguard.Protect", "false")));
/** first pass: instantiate actions * */
Map<String, IAction> actionsMap = new HashMap<String, IAction>();
for (Object obj : properties.keySet()) {
String key = (String) obj;
if (key.startsWith(ACTION_PREFIX)) {
String directive = key.substring(ACTION_PREFIX.length());
int index = directive.indexOf('.');
/** action name/class * */
if (index < 0) {
String actionClass = properties.getProperty(key);
IAction action = (IAction) Class.forName(actionClass).newInstance();
action.setName(directive);
actionsMap.put(action.getName(), action);
csrfGuard.getActions().add(action);
}
}
}
/** second pass: initialize action parameters * */
for (Object obj : properties.keySet()) {
String key = (String) obj;
if (key.startsWith(ACTION_PREFIX)) {
String directive = key.substring(ACTION_PREFIX.length());
int index = directive.indexOf('.');
/** action name/class * */
if (index >= 0) {
String actionName = directive.substring(0, index);
IAction action = actionsMap.get(actionName);
if (action == null) {
throw new IOException(
String.format("action class %s has not yet been specified", actionName));
}
String parameterName = directive.substring(index + 1);
String parameterValue = properties.getProperty(key);
action.setParameter(parameterName, parameterValue);
}
}
}
/** ensure at least one action was defined * */
if (csrfGuard.getActions().size() <= 0) {
throw new IOException("failure to define at least one action");
}
/** initialize protected, unprotected pages * */
for (Object obj : properties.keySet()) {
String key = (String) obj;
if (key.startsWith(PROTECTED_PAGE_PREFIX)) {
String directive = key.substring(PROTECTED_PAGE_PREFIX.length());
int index = directive.indexOf('.');
/** page name/class * */
if (index < 0) {
String pageUri = properties.getProperty(key);
csrfGuard.getProtectedPages().add(Pattern.compile(pageUri));
}
}
if (key.startsWith(UNPROTECTED_PAGE_PREFIX)) {
String directive = key.substring(UNPROTECTED_PAGE_PREFIX.length());
int index = directive.indexOf('.');
/** page name/class * */
if (index < 0) {
String pageUri = properties.getProperty(key);
csrfGuard.getUnprotectedPages().add(Pattern.compile(pageUri));
}
}
}
/** initialize protected methods * */
String methodList = properties.getProperty("org.owasp.csrfguard.ProtectedMethods");
if (methodList != null && methodList.trim().length() != 0) {
for (String method : methodList.split(",")) {
csrfGuard.getProtectedMethods().add(method.trim());
}
}
}
