Difference between revisions of "Germany/Projekte/Top 10 fuer Entwickler-2013/A4-Unsichere direkte Objektreferenzen"

Set fileSet = new HashSet();
fileSet.addAll(...); // add direct references (e.g. File objects)
AccessReferenceMap map = new AccessReferenceMap( fileSet );
// store the map somewhere safe - like the session!
String indRef = map.getIndirectReference( file1 );
String secureHref = "http://www.your-URL.yourTLD/esapi?file=" + indRef );
...
// if the indirect reference doesn't exist, it's likely an attack
// getDirectReference throws an AccessControlException
// you should handle as appropriate
String indref = request.getParameter( "file" );
File file = (File)map.getDirectReference( indref );

public class InjectionChecker {

public static void check(String value)

throws InjectionCheckException {

// see Topic A1

...

if(checkFailed) {

throw new InjectionCheckException("...");

}

}

}

public class PermissionChecker {

public void check(String username, Action action,

Class<? extends Object> objectType, String objectId)

throws PermissionCheckException{

...

if(checkFailed) {

throw new PermissionCheckException("...");

}

}

}

// Parameter Wert aus dem Request abfragen
String acct = request.getParameter("acct");
InjectionChecker.check(acct);

// Informationen für die Zugriffsprüfung zustammenstellen
String username = getUsername(request);
Action action = Action.READ; // (e.g. READ, WRITE, DELETE)
Class<? extends Object> objectType = ObjectBean.class;
String objectId = acct;

// Zufriffsprüfung durchführen
PermissionChecker permissionChecker = getPermissionChecker();
check(username, action, objectType, objectId);

// nach erfolgreicher Prüfung kann der Parameterwert
// verwendet werden
String query = "SELECT * FROM accts WHERE account_id = ?";
PreparedStatement pstmt = connection.prepareStatement(query , ... );
pstmt.setString( 1, acct);
ResultSet results = pstmt.executeQuery();