[OWASP-ESAPI] ESAPI 2.0r6 web application failure
sean
sean at greymonk.net
Thu Apr 22 15:09:48 EDT 2010
Hello,
I am using ESAPI 2.0r6 with Tomcat 6.0.20, JDK 1.6.0_20. I have
configured esapi.properties and validation.properties. I am extending
PropertyPlaceholderConfigurer for Spring to decrypt a properties file.
eg.
package utils;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.util.Properties;
import org.owasp.esapi.EncryptedProperties;
import org.owasp.esapi.errors.EncryptionException;
import org.owasp.esapi.reference.crypto.DefaultEncryptedProperties;
import
org.springframework.beans.factory.config.PropertyPlaceholderConfigurer;
public class MyPropertyPlaceholderConfigurer extends
PropertyPlaceholderConfigurer {
// private final Properties _props;
public MyPropertyPlaceholderConfigurer() {
super();
}
// @Override
protected void loadProperties( final Properties props ) throws
IOException {
EncryptedProperties loader = new DefaultEncryptedProperties();
loader.load( new FileInputStream( new File( "jdbc.properties") ));
try {
props.setProperty( "database.driver", loader.getProperty(
"database.driver" ));
props.setProperty( "database.url", loader.getProperty(
"database.url" ));
props.setProperty( "database.username", loader.getProperty(
"database.username" ));
props.setProperty( "database.password", loader.getProperty(
"database.password" ));
} catch( EncryptionException ee ) {
ee.printStackTrace();
}
}
When I run my application, my application stalls and I get the following
error:
ERROR [SECURITY FAILURE Anonymous:null at unknown -> /<Application>/Base64]
Bad Base64 input character at 3: 46(decimal)
WARN [SECURITY FAILURE Anonymous:null at unknown ->
/<Application>/IntrusionDetector] Couldn't decrypt property
What am I doing wrong?
More information about the OWASP-ESAPI
mailing list