Difference between revisions of "Germany/Projekte/Top 10 fuer Entwickler-2013/A4-Unsichere direkte Objektreferenzen"

InjectionChecker für Parameter Prüfung

public class InjectionChecker {
   public static void check(String value)
      throws InjectionCheckException {
      // see Topic A1
      ...
      if(checkFailed){
         throw new InjectionCheckException("...");
      }
   }
}

PermissionChecker für Prüfungung der Zugriffsrechte

public class PermissionChecker {
   public void check(String username, Action action,
          Class<? extends Object> objectType, String objectId)
      throws PermissionCheckException{
     ...
      if(checkFailed){
         throw new PermissionCheckException("...");
      }
   }
}

Pseudo Code für Zugriffsprüfung bei direkten Objektreferenzen

// Parameter Wert aus dem Request abfragen
String acct = request.getParameter("acct");
InjectionChecker.check(acct);


// Informationen für die Zugriffsprüfung zustammenstellen
String username = getUsername(request);
Action action = Action.READ; // (e.g. READ, WRITE, DELETE)
Class<? extends Object> objectType = ObjectBean.class;
String objectId = acct;


// Zufriffsprüfung durchführen
PermissionChecker permissionChecker = getPermissionChecker();
check(username, action, objectType, objectId);


// nach erfolgreicher Prüfung kann der Parameterwert
// verwendet werden
String query = "SELECT * FROM accts WHERE account_id = ?";
PreparedStatement pstmt = connection.prepareStatement(query , ... );
pstmt.setString( 1, acct);
ResultSet results = pstmt.executeQuery();

Set fileSet = new HashSet();
fileSet.addAll(...); // add direct references (e.g. File objects)
AccessReferenceMap map = new AccessReferenceMap( fileSet );
// store the map somewhere safe - like the session!
String indRef = map.getIndirectReference( file1 );
String secureHref = "http://www.your-URL.yourTLD/esapi?file=" + indRef );
...
// if the indirect reference doesn't exist, it's likely an attack
// getDirectReference throws an AccessControlException
// you should handle as appropriate
String indref = request.getParameter( "file" );
File file = (File)map.getDirectReference( indref );