Page History

<script type="text/javascript">

  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-25371431-1']);
  _gaq.push(['_trackPageview']);

  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();

</script>

{rate:title=Rating|theme=dynamic|key=JspParameterObjectMappingPlugin}

Overview

JSP Parameter to Action Object Mapping (Security) Plugin

Many applications expose their internal object references to users. Attackers use parameter tampering to change references and violate the intended but unenforced access control policy. Frequently, these references point to file systems and databases, but any exposed application construct could be vulnerable.

The best protection is to avoid exposing direct object references to users by using an index, indirect reference map, or other indirect method that is easy to validate. If a direct object reference must be used, ensure that the user is authorized before using it.

• Avoid exposing your private object references to users whenever possible, such as primary keys or filenames
• Validate any private object references extensively with an "accept known good" approach
• Verify authorization to all referenced objects

So to avoid internal object implementation to end user, this plugin can be used.

Features

• Web Security constraint handled in this plugin for Direct Object reference attack

• Single HTML request parameter can be set in Action Object in multiple sub class object

Usage

Instructions how to use your plugin.

Example

This is a quick example of JSP Parameter to Action Object Mapping Plugin in action

You could also include screenshots by attaching the images to this page

Settings

The following settings can be customized. See the developer guide.

Installation

This plugin can be installed by copying the plugin jar into your application's /WEB-INF/lib directory. No other files need to be copied or created.

• Add new xml file in current Action class with filename like
  "<ActionName>-jspObjectMapping.xml"

• XML File format given below

  Code Block
  *DTD format*

• Code Block
  <?xml version="1.0" encoding="UTF-8"?> <\!DOCTYPE mapping \[ <\!ELEMENT mapping (requestParameter)> <\!ELEMENT requestParameter (objectMapping)> <\!ELEMENT objectMapping (property)> <\!ELEMENT property (#PCDATA)> \]>

• Code Block
  *XML Format*

• Code Block
  <?xml version="1.0" encoding="UTF-8"?> <mapping> <requestParameter name="userName"> <objectMapping> <property>user.userName</property> </objectMapping> </requestParameter> <requestParameter name="password"> <objectMapping> <property>user.password</property> </objectMapping> </requestParameter> </mapping>

• Extends package with name "jsp-parameter-object-mapping"

• Add interceptor on interceptor stack

  <interceptor-ref name="parameterToActionObjectMapping" />

Resources

• Links to any other documentation or related products

http://www.owasp.org/index.php/Top_10_2010-A4-Insecure_Direct_Object_References

Version History