com.neurosys.cluzo.filters

Class DefaultSecurityFilter

java.lang.Object

com.neurosys.cluzo.filters.DefaultSecurityFilter

All Implemented Interfaces:

javax.servlet.Filter

public class DefaultSecurityFilter
extends Object
implements javax.servlet.Filter

A Filter that uses the DefaultSecurityContext and uses default app settings.

You may override the filter or write a new one. It is for consumption and demonstration purposes.

Author:

Arjun Dhar

See Also:

http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/filters/ESAPIFilter.java?r=927 (apply only whats relevant)

Constructor Summary

Constructors

Constructor and Description
DefaultSecurityFilter()

Method Summary

Modifier and Type	Method and Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
void	init(javax.servlet.FilterConfig config)
protected boolean	XSSPass(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse) Check for Reflective XSS.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultSecurityFilter

public DefaultSecurityFilter()

Method Detail

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

init

public void init(javax.servlet.FilterConfig config)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

XSSPass

protected boolean XSSPass(javax.servlet.http.HttpServletRequest httpRequest,
                          javax.servlet.http.HttpServletResponse httpResponse)
                   throws IOException,
                          OperationNotSupportedException

Check for Reflective XSS. TODO: Add Persistent XSS check by scanning Form fields also

Parameters:

httpRequest -

httpResponse -

Throws:

IOException

OperationNotSupportedException