kwwall
commented
8 years ago If you mark a percent symbol as "immune" as in "do not encode or decode" the API will encode it anyway.
Okay, but I guess I have to ask if that even makes sense for the PercentCodec, that it to make '%' immune, when it is '%' that does the encoding. If you did make '%' immune, then how would you decode something like "http%3A%2F%2Fwww.owasp.org%2F" ??? Maybe I'm missing something here (plus, I've never worked on encoders except for trivial bug fixes), so I don't see how you can legitimately make the actual quoting character (in this case, a '%') an character immune to encoding or decoding. If you really want something like that, then I think you really need to implement you own custom class that extends Codec to do exactly what you want and then add that to the ArrayList of codecs being used.
@planetlevel - What say you? You wrote this stuff and I've never really deeply dug into it.
-kevin
On Fri, Jan 29, 2016 at 2:37 PM, Matt Seil notifications@github.com wrote:
The following unit test from @jeremiahjstacey https://github.com/jeremiahjstacey reproduces the problem: If you mark a percent symbol as "immune" as in "do not encode or decode" the API will encode it anyway.
package org.owasp.esapi.codecs;
import java.util.ArrayList; import java.util.Arrays; import java.util.Collection; import java.util.List; import org.junit.Assert; import org.junit.Test; import org.junit.runner.RunWith; import org.junit.runners.Parameterized; import org.junit.runners.Parameterized.Parameters; import org.owasp.esapi.codecs.*;
/* \ Parameterized test to verify that the Immunity parameter for a codec encode/decode event works
- as expected on a series of special characters. * * @author jeremiah.j.stacey@gmail.com *
- @since Jan 29, 2016 * */ @RunWith(Parameterized.class) public class CodecImmunityTest { @Parameters(name = "{0}")
public static Collection<Object[]> getParams() { Collection
knownCodecs = new ArrayList (); knownCodecs.add(new CSSCodec()); knownCodecs.add(new DB2Codec()); knownCodecs.add(new HTMLEntityCodec()); knownCodecs.add(new JavaScriptCodec()); knownCodecs.add(new MySQLCodec(0)); //Standard knownCodecs.add(new MySQLCodec(1)); //ANSI knownCodecs.add(new OracleCodec()); knownCodecs.add(new PercentCodec()); knownCodecs.add(new UnixCodec()); knownCodecs.add(new VBScriptCodec()); knownCodecs.add(new WindowsCodec()); knownCodecs.add(new XMLEntityCodec()); //XXX: Add more strings here!! List sampleStrings = Arrays.asList("%De", "&"); Collection<Object[]> params = new ArrayList<Object[]>(); for (Codec codec : knownCodecs) { for (String sample : sampleStrings) { params.add(new Object[]{codec.getClass().getSimpleName() + " " + sample, codec, sample}); } } return params; }private final Codec codec; private final String string; private final char[] immunityList; public CodecImmunityTest(String ignored, Codec codec, String toTest) { this.codec = codec; this.string = toTest; /* * The Immunity character array is every character in the String we're testing. * / this.immunityList = toTest.toCharArray(); } @Test public void testImmuneEncode() { String encoded = codec.encode(immunityList, string); Assert.assertEquals(string, encoded); }
@Test public void testImmuneDecode() { String decoded = codec.decode(string); Assert.assertEquals(string, decoded); }}
— Reply to this email directly or view it on GitHub https://github.com/ESAPI/esapi-java-legacy/issues/359.
Blog: http://off-the-wall-security.blogspot.com/ | Twitter: @KevinWWall NSA: All your crypto bit are belong to us.
jeremiahjstacey
xeno6696
planetlevel
The following unit test from @jeremiahjstacey reproduces the problem: If you mark a percent symbol as "immune" as in "do not encode or decode" the API will encode it anyway.