[OWASP-ESAPI] ESAPI 2.0r6 web application failure

sean sean at greymonk.net
Thu Apr 22 15:09:48 EDT 2010


Hello,

I am using ESAPI 2.0r6 with Tomcat 6.0.20, JDK 1.6.0_20. I have 
configured esapi.properties and validation.properties. I am extending 
PropertyPlaceholderConfigurer for Spring to decrypt a properties file.

eg.

package utils;

import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.util.Properties;

import org.owasp.esapi.EncryptedProperties;
import org.owasp.esapi.errors.EncryptionException;
import org.owasp.esapi.reference.crypto.DefaultEncryptedProperties;
import 
org.springframework.beans.factory.config.PropertyPlaceholderConfigurer;

public class MyPropertyPlaceholderConfigurer extends 
PropertyPlaceholderConfigurer {
     // private final Properties _props;

     public MyPropertyPlaceholderConfigurer() {
         super();
     }

     // @Override
     protected void loadProperties( final Properties props ) throws 
IOException {
     EncryptedProperties loader = new DefaultEncryptedProperties();
     loader.load( new FileInputStream( new File( "jdbc.properties") ));

     try {
         props.setProperty( "database.driver", loader.getProperty( 
"database.driver" ));
         props.setProperty( "database.url", loader.getProperty( 
"database.url" ));
         props.setProperty( "database.username", loader.getProperty( 
"database.username" ));
         props.setProperty( "database.password", loader.getProperty( 
"database.password" ));
     } catch( EncryptionException ee ) {
         ee.printStackTrace();
     }
}

When I run my application, my application stalls and I get the following 
error:

ERROR [SECURITY FAILURE Anonymous:null at unknown -> /<Application>/Base64] 
Bad Base64 input character at 3: 46(decimal)
WARN  [SECURITY FAILURE Anonymous:null at unknown -> 
/<Application>/IntrusionDetector] Couldn't decrypt property

What am I doing wrong?


More information about the OWASP-ESAPI mailing list