Develop Reference

ESAPI not passing file validation

I am working with ESAPI to try and validate windows directory paths. For some reason, the part of my directory path named \14\ is getting converted into a CRLF. The error I am receiving is below, what am I not understanding correctly? I feel like my regex should be working.
WARN IntrusionDetector [SECURITY FAILURE Anonymous:null#unknown -> /project-test/IntrusionDetector] Invalid input: context=directoryPath, type(DirectoryName)=^[a-zA-Z0-9:/\\!##$%^&{}\[\]()_+\-=,.~'` ]{1,255}$, input=C:\UsersTESTUS~1AppDataLocalTempTestCase8002TempWorkSpace, orig=C:\Users\TESTUS~1\AppData\Local\Temp\14\TestCase8002TempWorkSpace
As you can see, I am using the regex:
^[a-zA-Z0-9:/\!##$%^&{}[]()_+-=,.~'` ]$
My input is:
C:\Users\TESTUS~1\AppData\Local\Temp\14\TestCase8002TempWorkSpace
Ouput, after ESAPI does canonicalization and validation:
C:\UsersTESTUS~1AppDataLocalTempTestCase8002TempWorkSpace
Here is the line of code that causes me to receive the error;
String validatedSourcePath = ESAPI.validator().getValidInput("directoryUnzip", directory, "DirectoryName", 255, false);
File validFile = new File(validatedSourcePath);

#C.Williams: I was about 30 minutes into writing up a detailed reply in an editor and accidentally excited my editor window. I'm too ticked off at my stupidity of not saving it to write it again, especially since I was only about 75% done.
However, if you want to email me I can arrange to talk to you via Google Hangouts or Signal to tell you want your problem is and how you can fix it. But it's long and complicated and partially related to a bug the ESAPI team just fixed but is not in any official release yet. But I am not going to take another 45 minutes or more trying to reply with any written text. My email address should be easy enough to find. Just google for my name and ESAPI. I am one of the project co-leaders on ESAPI.
-kevin wall

MGWT [ERROR] Trying to sink unknown event type webkitAnimationEnd

I'm currently developing a mgwt application using some techniques in showcase. Anyway, on a line when calling MGWTPlaceHistoryHandler.handleCurrentHistory method in entry point (initialization of first view) i got this error:
com.google.web.bindery.event.shared.UmbrellaException: Exception caught: (String)
#com.google.gwt.user.client.impl.DOMImplStandard::sinkBitlessEventImpl(Lcom/google/gwt/user/client/Element;Ljava/lang/String;)([JavaScript object(20), string: 'webkitAnimationEnd']): Trying to sink unknown event type webkitAnimationEnd
I can't figure out, what causes this type of error. The exception message is kinda vague - I'm not using any custom native methods affecting target DOM and JS code.
Any ideas ? I'm really clueless about this :(
PS: a part of code where this problem occurs:
AppPlaceHistoryMapper historyMapper= GWT.create(AppPlaceHistoryMapper.class);
AppHistoryObserver historyObserver= new AppHistoryObserver();
MGWTPlaceHistoryHandler historyHandler= new MGWTPlaceHistoryHandler(historyMapper,historyObserver);
historyHandler.register(clientFactory.getPlaceController(),clientFactory.getEventBus(),new MyDefaultPlace());
historyHandler.handleCurrentHistory(); //Exception thrown here
Any help or tips appreciated, I got stuck on this problem for a hours. Thanks in advance.

[SOLVED] - never EVER, EVER EVER use latest MGWT on older versions of GWT [2.5.1] ;)

Error in login/register system for Android using JSON

I am trying to create a simple login/register system for my Android app. I am following a tutorial by David Kelley (http://davidjkelley.net/?p=48). I downloaded the project David created and it works fine.
However, when I try making a copy of the project and change the relevant lines of code (and package name) to link to my own server, I get errors when I try registering a new user. The two main errors that show up in the logcat are:
<b>Fatal error</b>: Class 'DB_Functions' not found in <b>/home/paid2read13/paid2read.net/android_api/index.php</b> on line <b>18</b><br />`
- Error parsing data org.json.JSONException: Value db of type java.lang.String cannot be converted to JSONObject
...FATAL EXCEPTION: AsyncTask #1 ... java.lang.RuntimeException: An error occured while executing doInBackground()... Caused by: java.lang.NullPointerException at com.moneytree.RegisterTask.doInBackground(RegisterTask.java:85)...
In order for this post to be as useful as possible for me and anyone with similar issues, let me be very clear about what I changed from the code in the website given above:
In all of the classes in the main package (LoginTask.java, RegisterTask, etc.) AND the library (UserFunctions.java and DatabaseHandler.java), I changed loginURL = "http:// davidjkelley.net/android_api/" and registerURL = "http:// davidjkelley.net/android_api/" to loginURL = "http:// mydomainname.net/android_api/" and registerURL = "http:// mydomainname.net/android_api/", respectively. I also changed the database details in config.php to match my details; for the server name I put mysql.mydomainname.net because this link brings up my phpmyadmin console and it says server: mysql.mydomainname.net at the top of that page. So I think config.php is set up fine.
I don't know why the app "can't find DB_Functions" - I placed the files as instructed at the beginning of the aforementioned tutorial. I'm also not sure what exactly the null pointer issue is referring to.
I've been stuck on this for at least a week and have gone through all related issues; I found nothing similar. I would be very much grateful if anyone could help me with this - I wanna move ahead with my project. Thank you.

OCPsoft Rewrite Rule no longer works after Update from 1.0.5 to 1.1.0

When updating OCPsoft Rewrite from Version 1.0.5.Final to 1.1.0.Final the following Rule no longer works and I don't know how to fix it:
.addRule(
Join.path("/{i}/{d}")
.where("i").matches("[-_a-zA-Z0-9~*]{8}")
.where("d").matches("[-_a-zA-Z0-9~*]{32}")
.to("/resources/html/user/doSomething.html?i={i}&d={d}")
)
In the Rewrite changelog there is one point that could help you help me:
Configuration strings are now literal. Regular expressions must be configured through a >parameter such as: .defineRule().when(Path.matches("/{*}").where("*").matches(".*"))
The exception I get is the following one:
Exception starting filter OCPsoft Rewrite Filter
java.lang.NullPointerException
at org.ocpsoft.rewrite.servlet.config.rule.Join.where(Join.java:199)
at org.ocpsoft.rewrite.servlet.config.rule.Join.where(Join.java:47)
at com.myapp.util.RewriteConfigurationProvider.getConfiguration(RewriteConfigurationProvider.java:39)
...

The following did the trick, I just had to reorder the join clauses:
.addRule(
Join.path("/{i}/{d}")
.to("/resources/html/user/doSomething.html")
.where("i").matches("[-_a-zA-Z0-9~*]{8}")
.where("d").matches("[-_a-zA-Z0-9~*]{32}")
.withRequestBinding();
)
Thanks to Lincoln, who figured this out and answered my question on the Rewrite support forums.

Hmm.. that does look like a bug, I'll try to reproduce this, but you shouldn't need to re-define {i} and {d} in the target URL. Join will handle that for you automatically if you use request binding, like so:
.addRule(
Join.path("/{i}/{d}")
.where("i").matches("[-_a-zA-Z0-9~*]{8}")
.where("d").matches("[-_a-zA-Z0-9~*]{32}")
.to("/resources/html/user/doSomething.html").withRequestBinding();
)
I'm guessing if you do that, your problem will go away. You can also use .withInboundCorrection() if you'd like to redirect requests for the old .html URL to the new URL.
If you still have a problem with this, please post on the support forums and we'll get it figured out :)
Sorry you had trouble, hopefully it won't be trouble any more :)

Getting StringIndexOutOfBounds exception with Progress Database

I am getting the below exception when I am trying to retrieve data from Progress database.
Exception::java.lang.StringIndexOutOfBoundsException: String index out of range: -1
at java.lang.String.substring(String.java:1768)
at com.progress.sql.jdbc.JdbcProgressResultSet.reWordAsCountQuery(JdbcProgressResultSet.java:6634)
at com.progress.sql.jdbc.JdbcProgressResultSet.calculateRowCount(JdbcProgressResultSet.java:6427)
at com.progress.sql.jdbc.JdbcProgressResultSet.initialize(JdbcProgressResultSet.java:157)
at com.progress.sql.jdbc.JdbcProgressStatement.getResultSet(JdbcProgressStatement.java:435)
at com.progress.sql.jdbc.JdbcProgressPreparedStatement.executeQuery(JdbcProgressPreparedStatement.java:97)
at org.apache.commons.dbcp.DelegatingPreparedStatement.executeQuery(DelegatingPreparedStatement.java:93)
at com.esb.service.DBService.handleStatement(DBService.java:992)
One thing I noticed is if I put a space at the beginning or end of the query the query works fine.But this looks strange to me.
Can any one help me resolve this issue.
Thanks in Advance.

Given this bug report page, it looks like you basically need to update to a later release.