Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ESAPI.properties file not being built / deployed as part of production downloads #314

Open
meg23 opened this issue Nov 13, 2014 · 6 comments

Comments

@meg23
Copy link

meg23 commented Nov 13, 2014

From kevin.w.wall@gmail.com on October 22, 2013 13:04:40

The 'configuration/esapi/ESAPI.properties' file and all other files under the 'configuration/esapi' directory are missing from the ESAPI production builds. (E.g., it is missing from the 2.1.0 release.)

This is causing some to use the ESAPI.properties file found in 'src/test/resources/esapi/ESAPI.properties' which has some (intentionally) insecure additional property values (e.g., Encryptor.cipher_modes.additional_allowed=CBC,ECB -- ECB mode is normally not there). It also increases the likelihood that developers are using the test versions of Encryptor.MasterKey and Encryptor.MasterSalt property values.

Original issue: http://code.google.com/p/owasp-esapi-java/issues/detail?id=309

@meg23
Copy link
Author

meg23 commented Nov 13, 2014

From gli...@gmail.com on May 20, 2014 01:43:47

Agreed.

I started using the test properties file until during setup I realised it was definitely needing production tweaks before use.

Are these production files available anywhere else?

Many thanks for the product guys.

@meg23
Copy link
Author

meg23 commented Nov 13, 2014

From gli...@gmail.com on May 20, 2014 02:17:22

I also can't seem to see the files here. https://owasp-esapi-java.googlecode.com/svn/tags/esapi-2.1.0/src/main/ https://owasp-esapi-java.googlecode.com/svn/branches/2.1/ Not sure if I am looking in the right area, but this seems that the production files are not even committed to the version control?

@meg23
Copy link
Author

meg23 commented Nov 13, 2014

From kevin.w.wall@gmail.com on May 20, 2014 21:47:02

You can find the latest configuration files under 'trunk/configuration/esapi'.
If you want to use SVN from the command line,
svn checkout https://owasp-esapi-java.googlecode.com/svn/trunk/configuration/esapi esapi-config-files

should work. If you want to directly browse for them, start here: https://code.google.com/p/owasp-esapi-java/source/browse/#svn%2Ftrunk%2Fconfiguration%2Fesapi Hope that helps. And if you know how to fix this issue, I'm all ears.
-kevin wall

@meg23
Copy link
Author

meg23 commented Nov 13, 2014

From gli...@gmail.com on May 20, 2014 22:27:52

Hi Kevin

Many thanks for the reply and info, will go and check it out right now.

Thanks again.

@meg23
Copy link
Author

meg23 commented Nov 13, 2014

From craig.fl...@gmail.com on July 17, 2014 17:13:33

Pretty sure you can fix this by updating your dist.xml file under src/main/assembly. Currently your looking for configuration/.esapi instead of configuration/esapi like it is in source.

configuration configuration .esapi/**/* log4j.dtd log4j.xml properties/**/*

@kwwall
Copy link
Contributor

kwwall commented Dec 27, 2018

As near as I can tell, this seems to be a duplicate of issue #341 and if not, I think commit 068cecb fixes this issue as well.

Short of actually deploying a new production release to Maven Central, is there a way that I can test this via a Maven command line? E.g., some mvn goal that would create these artifacts that I can inspect?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants