public class HttpUtil extends java.lang.Object implements JcmsConstants
As of current implementation, it is mainly a facade in front the OWASP ESAPI library.
Modifier and Type | Field and Description |
---|---|
static java.lang.String |
ALPHANUM_REGEX
Regular expression suitable for use in
getStringParameter(HttpServletRequest, String, String, String) . |
static java.lang.String |
CLASSNAME_REGEX
Regular expression suitable for use in
getStringParameter(HttpServletRequest, String, String, String) . |
static java.lang.String |
CSRF_TOKEN_HEADER_NAME
HTTP Header name from which CSRF token to be validated can be retrieved
|
static java.lang.String |
CSRF_TOKEN_MEMBER_EXTRADBDATA
ExtraDBData attribute name used to store the current and expected value of the CSRF token.
|
static java.lang.String |
CSRF_TOKEN_PARAMETER_NAME
Parameter name from which CSRF token to be validated can be retrieved
|
static java.lang.String |
CSRF_TOKEN_SESSION_ATTRIBUTE
Session attribute name used to store the current and expected value of the CSRF token.
|
static java.lang.String |
CSRF_TOKEN_TIME_MEMBER_EXTRADBDATA
ExtraDBData attribute name used to store the time at which member csrf token was saved (epoch time).
|
static java.lang.String |
DATAID_REGEX
Regular expression suitable for use in
getStringParameter(HttpServletRequest, String, String, String) . |
static java.lang.String |
PROPERTYNAME_REGEX
Regular expression suitable for use in
getStringParameter(HttpServletRequest, String, String, String) . |
static java.lang.String |
REVISION |
static java.lang.String |
TEMPLATEUSAGE_REGEX
Regular expression suitable for use in
getStringParameter(HttpServletRequest, String, String, String) . |
ADATE_SEARCH, ADMIN_NOTES_PROP, ADVANCED_TAB, ARCHIVES_DIR, ASCII_WIDTH, CATEGORY_TAB, CDATE_SEARCH, COMMON_ALARM, CONTENT_TAB, COOKIE_MAX_AGE, CTRL_TOPIC_INTERNAL, CTRL_TOPIC_REF, CTRL_TOPIC_VALUE, CTRL_TOPIC_WRITE, CUSTOM_PROP, DOCCHOOSER_HEIGHT, DOCCHOOSER_WIDTH, DOCS_DIR, EDATE_SEARCH, EMAIL_REGEXP, ERROR_MSG, FORBIDDEN_FILE_ACCESS, FORBIDDEN_REDIRECT, FORCE_REDIRECT, ICON_ARCHIVE, ICON_LOCK, ICON_LOCK_STRONG, ICON_WARN, ICON_WH_BOOK_CLOSED, ICON_WH_BOOK_OPEN, INFORMATION_MSG, JALIOS_JUNIT_PROP, JCMS_CADDY, JCMS_MSG_LIST, JSYNC_DOWNLOAD_DIR, JSYNC_SYNC_ALARM, LOG_FILE, LOG_TOPIC_SECURITY, LOGGER_PROP, LOGGER_XMLPROP, MBR_PHOTO_DIR, MDATE_SEARCH, MONITOR_XML, OP_CREATE, OP_CREATE_STR, OP_DEEP_COPY, OP_DEEP_COPY_STR, OP_DEEP_DELETE, OP_DEEP_DELETE_STR, OP_DELETE, OP_DELETE_STR, OP_MERGE, OP_MERGE_STR, OP_UPDATE, OP_UPDATE_STR, PDATE_SEARCH, PHOTO_DIR, PHOTO_ICON, PHOTO_ICON_HEIGHT, PHOTO_ICON_WIDTH, PHOTO_LARGE, PHOTO_LARGE_HEIGHT, PHOTO_LARGE_WIDTH, PHOTO_NORMAL, PHOTO_NORMAL_HEIGHT, PHOTO_NORMAL_WIDTH, PHOTO_SMALL, PHOTO_SMALL_HEIGHT, PHOTO_SMALL_WIDTH, PHOTO_TINY, PHOTO_TINY_HEIGHT, PHOTO_TINY_WIDTH, PREVIOUS_TAB, PRINT_VIEW, PRIVATE_FILE_ACCESS, PUBLIC_FILE_ACCESS, READ_RIGHT_TAB, SDATE_SEARCH, SEARCHENGINE_ALARM, SESSION_AUTHORIZED_FILENAMES_SET, STATS_REPORT_DIR, STATUS_PROP, STORE_XML, TEMPLATE_TAB, THUMBNAIL_LARGE_HEIGHT, THUMBNAIL_LARGE_WIDTH, THUMBNAIL_SMALL_HEIGHT, THUMBNAIL_SMALL_WIDTH, TYPES_ICON_ALT_PROP, TYPES_ICON_SUFFIX_PROP, TYPES_ICON_TITLE_PROP, TYPES_PREFIX_PROP, TYPES_THUMB_SUFFIX_PROP, UDATE_SEARCH, UPDATE_RIGHT_TAB, UPLOAD_DIR, URL_REGEXP, WARNING_MSG, WEBAPP_PROP, WFEXPRESS_ALARM, WFREMINDER_ALARM, WORKFLOW_TAB, WORKFLOW_XML
CRLF, MILLIS_IN_ONE_DAY, MILLIS_IN_ONE_HOUR, MILLIS_IN_ONE_MINUTE, MILLIS_IN_ONE_MONTH, MILLIS_IN_ONE_SECOND, MILLIS_IN_ONE_WEEK, MILLIS_IN_ONE_YEAR
Constructor and Description |
---|
HttpUtil() |
Modifier and Type | Method and Description |
---|---|
static void |
addCookie(javax.servlet.http.HttpServletResponse response,
javax.servlet.http.Cookie cookie)
Add a cookie to the response.
|
static boolean |
checkCSRF(javax.servlet.http.HttpServletRequest request)
Check if the specified request is valid against CSRF attack.
|
static void |
clearMemberCSRFToken(Member member)
Remove CSRF token of the specified member
|
static java.lang.String |
encodeForHTML(java.lang.String input)
Encode data for use in HTML using HTML entity encoding
Note that the following characters:
00-08, 0B-0C, 0E-1F, and 7F-9F
cannot be used in HTML.
|
static java.lang.String |
encodeForHTMLAttribute(java.lang.String input)
Encode data for use in HTML attributes.
|
static java.lang.String |
encodeForJavaScript(java.lang.String input)
Encode data for insertion inside a data value or function argument in JavaScript.
|
static java.lang.String |
encodeForURL(java.lang.String input)
Encode for use in a URL.
|
static java.lang.String |
encodeForXML(java.lang.String input)
Encode data for use in an XML element.
|
static java.lang.String |
encodeForXMLAttribute(java.lang.String input)
Encode data for use in an XML attribute.
|
static java.lang.String |
getAlphaNumParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.String defaultValue)
Retrieve a String value from specified HTTP request parameter.
|
static boolean |
getBooleanParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
boolean defaultValue)
Retrieve a boolean value from specified HTTP request parameter.
|
static Category |
getCategoryParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a Category from its id received in parameter.
|
static java.lang.String |
getChooserParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a verified targetInput, targetLabel or other target value used by JCMS Choosers inside javascript code.
|
static long |
getCSRFMemberTokenMaxAge()
Retrieve the duration in milliseconds above which a member token is considered invalid.
|
static java.lang.String |
getCSRFToken(javax.servlet.http.HttpServletRequest request)
Retrieve the value of CSRF token (both session & member) for the current request.
|
static java.lang.String |
getCurrentCSRFToken(javax.servlet.http.HttpServletRequest request)
Retrieve the current valid CSRF Token expected on critical requests of the current session.
|
static java.lang.String |
getCurrentCSRFToken(javax.servlet.http.HttpSession session)
Retrieve the current valid CSRF Token expected on critical requests of the current session.
|
static java.lang.String |
getCurrentMemberCSRFToken(Member member)
Retrieve the current valid CSRF Token expected on critical requests of the specified member.
|
static java.lang.String |
getDataIdParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a Data id from parameter.
|
static <T extends Data> |
getDataListParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.Class<T> clazz)
Retrieve a list of Data from ids received in only one value of the parameter (seperated with spaces or coma).
|
static Data |
getDataParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a Data from its id received in parameter.
|
static <T> T |
getDataParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.Class<T> clazz)
Retrieve a typed Data from its id received in parameter.
|
static java.util.Date |
getDateParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.text.DateFormat dateFormat,
java.util.Date defaultValue)
Retrieve a Date value from specified HTTP request parameter.
|
static java.util.Date |
getDateParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.String dateLanguage,
java.util.Date defaultValue)
Retrieve a Date (date only) value from specified HTTP request parameter.
|
static java.util.Date |
getDateTimeParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.String dateLanguage,
java.util.Date defaultValue)
Retrieve a Date (date and time) value from specified HTTP request parameter.
|
static double |
getDoubleParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
double defaultValue)
Retrieve a double value from specified HTTP request parameter.
|
static Group |
getGroupParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a Group from its id received in parameter.
|
static int |
getIntParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
int defaultValue)
Retrieve an integer value from specified HTTP request parameter.
|
static java.lang.String |
getJsonParameterFromRequest(javax.servlet.http.HttpServletRequest request)
Returns a String (json format) representing all parameters in the specified request.
|
static long |
getLongParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
long defaultValue)
Retrieve a long value from specified HTTP request parameter.
|
static Member |
getMemberParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a Member from its id received in parameter.
|
static Publication |
getPublicationParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a Publication from its id received in parameter.
|
static java.lang.String |
getStringEnumParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.String defaultValue,
java.lang.String... possibleValues)
Retrieve a String value from specified HTTP request parameter.
|
static java.lang.String |
getStringParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.String defaultValue,
java.lang.String regex)
Retrieve a String value from specified HTTP request parameter.
|
static java.lang.String[] |
getStringParameterValues(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.String regex)
Retrieve array of String values from specified HTTP request parameter.
|
static java.lang.String |
getUntrustedStringParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName,
java.lang.String defaultValue)
Retrieve any String value from the specified HTTP request parameter.
|
static java.lang.String |
getUrlWithCSRFToken(java.lang.String url,
javax.servlet.http.HttpServletRequest request,
boolean escapeAmpersand)
Adds the current CSRF token to the specified URL and returns it.
|
static java.lang.String |
getValidHttpUrl(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a verified URL parameter value.
|
static Workspace |
getWorkspaceParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Retrieve a Workspace from its id received in parameter.
|
static boolean |
hasParameter(javax.servlet.http.HttpServletRequest request,
java.lang.String parameterName)
Check if a parameter was received in the specified request.
|
static void |
initializeCSRFToken(javax.servlet.http.HttpSession session)
Initialize a new CSRF Token for the current session (if any)
|
static void |
initializeMemberCSRFToken(Member member,
javax.servlet.http.HttpServletRequest request)
Initialize the CSRF Token for the specified member from the current CSRF token of the request (if any)
|
static boolean |
isCSRFEnabled()
Check if CSRF attack prevention is enabled for site.
|
static boolean |
isCSRFMemberTokenAllowed()
Check if CSRF token should be allowed through different session
in order to allow a submition after session expiration.
|
static boolean |
isValidDisplayServletPath(java.lang.String displayServletPath)
Check if the specified path is valid for use by the display servlet
|
static boolean |
isValidHttpUrl(java.lang.String url)
Check that the specified URL (absolute or relative) is a valid URL authorized
for use in redirection.
|
static java.lang.String |
validateHttpUrl(java.lang.String url)
Validate an URL and returns it.
|
static java.lang.String |
validateString(java.lang.String value,
java.lang.String regex)
Validate a String value against specified regular expression.
|
static java.lang.String[] |
validateStringValues(java.lang.String[] values,
java.lang.String regex)
Validate each value in the specified array of String values against specified regular expression.
|
public static final java.lang.String REVISION
public static final java.lang.String DATAID_REGEX
getStringParameter(HttpServletRequest, String, String, String)
.
Match all characters which could be used as a JCMS data id (JStore/JcmsDB), this includes virtual id such as "$channel.root-cat" : "^\\$?[0-9a-zA-Z_\\-\\.]+$". Beware that this regex does not validate that the id matchs a valid data.
public static final java.lang.String ALPHANUM_REGEX
getStringParameter(HttpServletRequest, String, String, String)
.
Match all alpha-numeric characters and the underscore (_ as in perl regex) and the dash (-): "^[0-9a-zA-Z_\\-]+$".
public static final java.lang.String CLASSNAME_REGEX
getStringParameter(HttpServletRequest, String, String, String)
.
Match Java class names, such as com.jalios.jcms.Content
.
public static final java.lang.String PROPERTYNAME_REGEX
getStringParameter(HttpServletRequest, String, String, String)
.
Match JCMS property names, such as $channel.root-category
, some.important-property.foo_bar22/zig
.
public static final java.lang.String TEMPLATEUSAGE_REGEX
getStringParameter(HttpServletRequest, String, String, String)
.
Match JCMS template usage name, such as box
, full
, front
, query
, ...
public static final java.lang.String CSRF_TOKEN_SESSION_ATTRIBUTE
Do not use directly, instead use initializeCSRFToken(HttpSession)
.
public static final java.lang.String CSRF_TOKEN_MEMBER_EXTRADBDATA
Do not use directly, instead use initializeMemberCSRFToken(Member, HttpServletRequest)
.
public static final java.lang.String CSRF_TOKEN_TIME_MEMBER_EXTRADBDATA
Do not use directly, instead use initializeMemberCSRFToken(Member, HttpServletRequest)
.
public static final java.lang.String CSRF_TOKEN_PARAMETER_NAME
public static final java.lang.String CSRF_TOKEN_HEADER_NAME
public static java.lang.String encodeForXML(java.lang.String input)
The use of a real XML parser is strongly encouraged. However, in the hopefully rare case that you need to make sure that data is safe for inclusion in an XML document and cannot use a parse, this method provides a safe mechanism to do so.
input
- the text to encode for XMLpublic static java.lang.String encodeForXMLAttribute(java.lang.String input)
The use of a real XML parser is highly encouraged. However, in the hopefully rare case that you need to make sure that data is safe for inclusion in an XML document and cannot use a parse, this method provides a safe mechanism to do so.
input
- the text to encode for use as an XML attributepublic static java.lang.String encodeForHTML(java.lang.String input)
Note that the following characters: 00-08, 0B-0C, 0E-1F, and 7F-9F
cannot be used in HTML.
input
- the text to encode for HTMLpublic static java.lang.String encodeForHTMLAttribute(java.lang.String input)
input
- the text to encode for an HTML attributepublic static java.lang.String encodeForJavaScript(java.lang.String input)
input
- the text to encode for JavaScriptpublic static java.lang.String encodeForURL(java.lang.String input)
input
- the text to encode for use in a URLpublic static java.lang.String getValidHttpUrl(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
String redirect = getValidHttpUrl(request, "redirect");
request
- the request from which the parameter will be readparameterName
- the name of the HTTP parameter to be retrievedpublic static java.lang.String validateHttpUrl(java.lang.String url)
Example :
String redirect = validateHttpUrl("http://www.example.com/");
url
- the value to be verifiedpublic static boolean isValidHttpUrl(java.lang.String url)
As of current implementation, the following behavior applies :
All URLs are accepted (NO verification performed) when JCMS propery
channel.security.validate-redirect
is set to false (default is true).
Otherwise, the following rules are required :
JCMSRedirectURL
configured in ESAPI.properties
(prevent HTTPSplitting)channel.security.authorized-redirect.*
are accepted
You can enable TRACE
logging on this class for detailed information of validation being performed.
<logger name="com.jalios.jcms.HttpUtil"> <level value="TRACE" /> </logger>
url
- the URL to checkpublic static boolean isValidDisplayServletPath(java.lang.String displayServletPath)
displayServletPath
- a servlet path such as "/jcms/c_42/foo-bar"public static java.lang.String getChooserParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
String targetInput = getChooserParameter("targetInput"); String targetLabel = getChooserParameter("targetLabel");
request
- HttpServletRequest from which parameter must be readparameterName
- the name of the HTTP parameter to be retrievedpublic static <T> T getDataParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.Class<T> clazz)
Examples :
Portal portal = getDataParameter(request, "portal", Portal.class); SmallNews sm = getDataParameter(request, "id", SmallNews.class);
T
- the expected class of Datarequest
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data id will be retrieved, must not be nullclazz
- the expected class of Datapublic static <T extends Data> java.util.List<T> getDataListParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.Class<T> clazz)
Examples :
ListgroupList = getDataListParameter(request, "groups", Portal.class); SmallNews sm = getDataParameter(request, "id", SmallNews.class);
T
- the expected class of Datarequest
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data ids will be retrieved, must not be nullclazz
- the expected class of Datapublic static Data getDataParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
Data data = getDataParameter(request, "id");
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data id will be retrieved, must not be nullpublic static Workspace getWorkspaceParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
Workspace ws = getWorkspaceParameter(request, "ws");
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data id will be retrieved, must not be nullpublic static Category getCategoryParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
Category cat = getCategoryParameter(request, "cid");
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data id will be retrieved, must not be nullpublic static Publication getPublicationParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
Publication pub = getPublicationParameter(request, "id");
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data id will be retrieved, must not be nullpublic static Member getMemberParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
Member mbr = getMemberParameter(request, "mbrId");
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data id will be retrieved, must not be nullpublic static Group getGroupParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
Group grp = getGroupParameter(request, "grpId");
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data id will be retrieved, must not be nullpublic static boolean hasParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Example :
if (hasParameter(request, "opRefresh")) { //... }This method is the same as doing :
String value = getUntrustedStringParameter(request, parameterName); // request.getParameter(parameterName); return value != null;
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nullpublic static boolean getBooleanParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, boolean defaultValue)
Important remark regarding behavior on missing/invalid parameter :
false
when parameter value contains invalid data (neither "true" nor "false").Util.toBoolean(Object, boolean)
.request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nulldefaultValue
- the default value to use if parameter is missing or invalidpublic static int getIntParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, int defaultValue)
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nulldefaultValue
- the default value to use if parameter is missing or invalidpublic static long getLongParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, long defaultValue)
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nulldefaultValue
- the default value to use if parameter is missing, empty or invalidpublic static double getDoubleParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, double defaultValue)
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nulldefaultValue
- the default value to use if parameter is missing, empty or invalidpublic static java.util.Date getDateTimeParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.String dateLanguage, java.util.Date defaultValue)
The parameter will be parsed using date format specified in property date-time-format
of the specified language.
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be parsed, must not be nulldateLanguage
- the language in which the received parameter will be parseddefaultValue
- the default value to use if parameter is missing, empty or invalidChannel.getDateTimeFormat(String)
public static java.util.Date getDateParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.String dateLanguage, java.util.Date defaultValue)
The parameter will be parsed using date format specified in property date-format
of the specified language.
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be parsed, must not be nulldateLanguage
- the language in which the received parameter will be parseddefaultValue
- the default value to use if parameter is missing, empty or invalidChannel.getDateFormat(String)
public static java.util.Date getDateParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.text.DateFormat dateFormat, java.util.Date defaultValue)
The parameter will be parsed using the specified date format
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be parsed, must not be nulldateFormat
- the DateFormat to use to parse the date parameter, must not be nulldefaultValue
- the default value to use if parameter is missing, empty or invalidChannel.getDateFormat(String)
public static java.lang.String getStringEnumParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.String defaultValue, java.lang.String... possibleValues)
The parameter value must match one of the possible value specified, otherwise default value is used.
Example, read the "align" parameter expecting only values from authorized HTML table align :
getStringEnumParameter(request, "align", "left", new String[] { "left", "center", "right" });Verification is case sensitive.
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nulldefaultValue
- the default value to use if parameter is missing or invalidpossibleValues
- the values authorized, must not be nullpublic static java.lang.String getAlphaNumParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.String defaultValue)
The parameter value must match the alpha numeric regular expression ALPHANUM_REGEX
.
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nulldefaultValue
- the default value to use if parameter is missing or invalidpublic static java.lang.String getDataIdParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName)
Contrary to most get*Parameter
method in HttpUtil, this method
returns an empty string if parameter value was missing, empty or invalid.
Beware that this method will NOT check that the id match an existing or valid data.
Example :
In Java : String id = HttpUtil.getDataIdParameter(request, "id"); In JSP : <input name="id" value="<%= getDataIdParameter("id") %>"/>This method is the same as doing :
String id = HttpUtil.getStringParameter(request, parameterName, "", HttpUtil.DATAID_REGEX);
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- the name of the HTTP parameter from which data id will be retrieved, must not be nullpublic static java.lang.String getStringParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.String defaultValue, java.lang.String regex)
The parameter value must match the specified regular expression.
You are encouraged to use predefined constants for regular expression :
ALPHANUM_REGEX
for alpha numeric characters (eg FooBar_42
) CLASSNAME_REGEX
for Java class names (eg com.jalios.jcms.Content
)PROPERTYNAME_REGEX
for JCMS property key (eg channel.data-write.enabled
)TEMPLATEUSAGE_REGEX
for JCMS template usage name (eg box
, full
, front
, query
)request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nulldefaultValue
- the default value to use if parameter is missing or invalidregex
- the regular expression the string is expected to match, must not be nullpublic static java.lang.String validateString(java.lang.String value, java.lang.String regex)
You are encouraged to use predefined constants for regular expression :
ALPHANUM_REGEX
for alpha numeric characters (eg FooBar_42
) CLASSNAME_REGEX
for Java class names (eg com.jalios.jcms.Content
)PROPERTYNAME_REGEX
for JCMS property key (eg channel.data-write.enabled
)TEMPLATEUSAGE_REGEX
for JCMS template usage name (eg box
, full
, front
, query
)value
- value to validateregex
- the regular expression the string is expected to matchn, must not be nullpublic static java.lang.String[] getStringParameterValues(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.String regex)
The parameter values must match the specified regular expression.
You are encouraged to use predefined constants for regular expression :
ALPHANUM_REGEX
for alpha numeric characters (eg FooBar_42
) CLASSNAME_REGEX
for Java class names (eg com.jalios.jcms.Content
)PROPERTYNAME_REGEX
for JCMS property key (eg channel.data-write.enabled
)TEMPLATEUSAGE_REGEX
for JCMS template usage name (eg box
, full
, front
, query
)request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nullregex
- the regular expression strings are expected to match, must not be nullpublic static java.lang.String[] validateStringValues(java.lang.String[] values, java.lang.String regex)
You are encouraged to use predefined constants for regular expression :
ALPHANUM_REGEX
for alpha numeric characters (eg FooBar_42
) CLASSNAME_REGEX
for Java class names (eg com.jalios.jcms.Content
)PROPERTYNAME_REGEX
for JCMS property key (eg channel.data-write.enabled
)TEMPLATEUSAGE_REGEX
for JCMS template usage name (eg box
, full
, front
, query
)values
- the values to validateregex
- the regular expression strings are expected to match, must not be nullpublic static java.lang.String getUntrustedStringParameter(javax.servlet.http.HttpServletRequest request, java.lang.String parameterName, java.lang.String defaultValue)
This method should be AVOIDED AT ALL COST, and used only on last restort, make sure you PROPERLY ENCODE the returned value in the output..
request
- HttpServletRequest from which parameter must be read, must not be nullparameterName
- name of the HTTP parameter from which value will be read, must not be nulldefaultValue
- the default value to use if parameter is missingpublic static void addCookie(javax.servlet.http.HttpServletResponse response, javax.servlet.http.Cookie cookie)
If the JCMS property channel.security.check-cookie.enabled
is
set to false, this method will simply use the underlying JavaEE implementation of
HttpServletResponse.addCookie(Cookie)
.
If property is set to true (which is the default behavior), this method will provide additionnal security check :
Validator.HTTPCookieName= Validator.HTTPCookieValue=
HttpUtilities.ForceHttpOnlyCookies=true HttpUtilities.ForceSecureCookies=true
response
- the HttpServletResponse in which to send the cookiecookie
- the cookie to send in the responsepublic static boolean isCSRFEnabled()
public static java.lang.String getCSRFToken(javax.servlet.http.HttpServletRequest request)
request
- the curren HttpServletRequestpublic static void initializeCSRFToken(javax.servlet.http.HttpSession session)
session
- the HttpSession in which CSRF token is addedpublic static java.lang.String getCurrentCSRFToken(javax.servlet.http.HttpSession session)
session
- the current HttpSessionpublic static java.lang.String getCurrentCSRFToken(javax.servlet.http.HttpServletRequest request)
request
- the curren HttpServletRequestpublic static boolean isCSRFMemberTokenAllowed()
Initialized from property channel.security.csrf.allow-token-through-session
If enabled, security is decreased as it allows more time for an attacker to retrieve the token, but usability increase as the end user is allowed to submit a form after session expiration.
public static long getCSRFMemberTokenMaxAge()
Initialized from property channel.security.csrf.member-token-max-age
public static void initializeMemberCSRFToken(Member member, javax.servlet.http.HttpServletRequest request)
member
- the logged Memberrequest
- the current HttpServletRequestpublic static void clearMemberCSRFToken(Member member)
member
- the member for which CSRF token should be removedpublic static java.lang.String getCurrentMemberCSRFToken(Member member)
This method must be used only if "token through session" option has been enabled.
member
- the current MemberisCSRFMemberTokenAllowed()
public static boolean checkCSRF(javax.servlet.http.HttpServletRequest request)
request
- the HttpServletRequest to validatepublic static java.lang.String getUrlWithCSRFToken(java.lang.String url, javax.servlet.http.HttpServletRequest request, boolean escapeAmpersand)
If CSRF is disable, URL is returned as is.
url
- the URL to completerequest
- the current request used to find the current CSRF tokenescapeAmpersand
- will use "&" if true, "&" if falsepublic static java.lang.String getJsonParameterFromRequest(javax.servlet.http.HttpServletRequest request)
request
- the HttpServletRequest
Copyright © 2001-2010 Jalios SA. All Rights Reserved.