Java tutorial
/* * Zed Attack Proxy (ZAP) and its related class files. * * ZAP is an HTTP/HTTPS proxy for assessing web application security. * * Copyright 2010 psiinon@gmail.com * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.zaproxy.zap.extension.httpsessions; import java.util.ArrayList; import java.util.Collections; import java.util.List; import org.apache.commons.configuration.ConversionException; import org.apache.commons.configuration.HierarchicalConfiguration; import org.apache.log4j.Logger; import org.parosproxy.paros.common.AbstractParam; import org.zaproxy.zap.extension.api.ZapApiIgnore; /** * The HttpSessionsParam is used to store the parameters (options) for the * {@link ExtensionHttpSessions} and related classes. */ public class HttpSessionsParam extends AbstractParam { /** The Constant defining the key for the default session tokens used in the application. */ private static final String DEFAULT_TOKENS_KEY = "httpsessions.tokens"; private static final String ALL_DEFAULT_TOKENS_KEY = DEFAULT_TOKENS_KEY + ".token"; private static final String TOKEN_NAME_KEY = "name"; private static final String TOKEN_ENABLED_KEY = "enabled"; /** The Constant PROXY_ONLY_KEY defining the key for the enabledProxyOnly option. */ private static final String PROXY_ONLY_KEY = "httpsessions.proxyOnly"; private static final String CONFIRM_REMOVE_TOKEN_KEY = "httpsessions.confirmRemoveToken"; /** The default tokens used when there are no saved tokens in the file. */ private static final String[] DEFAULT_TOKENS = { "asp.net_sessionid", "aspsessionid", "siteserver", "cfid", "cftoken", "jsessionid", "phpsessid", "sessid", "sid", "viewstate", "zenid" }; /** The Constant log. */ private static final Logger log = Logger.getLogger(HttpSessionsParam.class); /** The default tokens. */ private List<HttpSessionToken> defaultTokens = null; /** The default enabled tokens. */ private List<String> defaultTokensEnabled = null; /** Whether the HttpSessions extension is enabled for the proxy only. */ private boolean enabledProxyOnly = false; private boolean confirmRemove = true; /** * Instantiates a new http sessions param. * */ public HttpSessionsParam() { } @Override protected void parse() { // Parse the default token names try { List<HierarchicalConfiguration> fields = ((HierarchicalConfiguration) getConfig()) .configurationsAt(ALL_DEFAULT_TOKENS_KEY); this.defaultTokens = new ArrayList<>(fields.size()); this.defaultTokensEnabled = new ArrayList<>(fields.size()); List<String> tempTokensNames = new ArrayList<>(fields.size()); for (HierarchicalConfiguration sub : fields) { String name = sub.getString(TOKEN_NAME_KEY, ""); if (!"".equals(name) && !tempTokensNames.contains(name)) { boolean enabled = sub.getBoolean(TOKEN_ENABLED_KEY, true); this.defaultTokens.add(new HttpSessionToken(name, enabled)); tempTokensNames.add(name); if (enabled) { this.defaultTokensEnabled.add(name); } } } } catch (ConversionException e) { this.defaultTokens = new ArrayList<>(DEFAULT_TOKENS.length); log.error("Error while parsing config file: " + e.getMessage(), e); } if (this.defaultTokens.size() == 0) { for (String tokenName : DEFAULT_TOKENS) { this.defaultTokens.add(new HttpSessionToken(tokenName)); this.defaultTokensEnabled.add(tokenName); } } try { this.enabledProxyOnly = getConfig().getBoolean(PROXY_ONLY_KEY, false); } catch (ConversionException e) { log.error("Error while parsing config file: " + e.getMessage(), e); } try { this.confirmRemove = getConfig().getBoolean(CONFIRM_REMOVE_TOKEN_KEY, true); } catch (ConversionException e) { log.error("Error while parsing config file: " + e.getMessage(), e); } } /** * Gets the default tokens. * <p> * The list of default session tokens returned is read-only view of the * internal default session tokens representation and any modifications will * result in {@link UnsupportedOperationException}. No change should be done * to the {@code HttpSessionToken}s contained in the list. * </p> * * @return the default tokens */ public final List<HttpSessionToken> getDefaultTokens() { return Collections.unmodifiableList(defaultTokens); } /** * Gets the default tokens enabled. * <p> * The list of default session tokens enabled returned is read-only view of * the internal default session tokens representation and any modifications * will result in {@link UnsupportedOperationException}. * </p> * * @return the default tokens */ public final List<String> getDefaultTokensEnabled() { return Collections.unmodifiableList(defaultTokensEnabled); } /** * Sets the default tokens. * * @param tokens the new default tokens */ public void setDefaultTokens(final List<HttpSessionToken> tokens) { this.defaultTokens = tokens; ((HierarchicalConfiguration) getConfig()).clearTree(ALL_DEFAULT_TOKENS_KEY); ArrayList<String> enabledTokens = new ArrayList<>(tokens.size()); for (int i = 0, size = tokens.size(); i < size; ++i) { String elementBaseKey = ALL_DEFAULT_TOKENS_KEY + "(" + i + ")."; HttpSessionToken token = tokens.get(i); getConfig().setProperty(elementBaseKey + TOKEN_NAME_KEY, token.getName()); getConfig().setProperty(elementBaseKey + TOKEN_ENABLED_KEY, Boolean.valueOf(token.isEnabled())); if (token.isEnabled()) { enabledTokens.add(token.getName()); } } enabledTokens.trimToSize(); this.defaultTokensEnabled = enabledTokens; } /** * Checks if the extension is only processing Proxy messages. * * @return true, if is enabled for proxy only */ public boolean isEnabledProxyOnly() { return enabledProxyOnly; } /** * Sets if the extension is only processing Proxy messages. * * @param enabledProxyOnly the new enabled proxy only status */ public void setEnabledProxyOnly(boolean enabledProxyOnly) { this.enabledProxyOnly = enabledProxyOnly; getConfig().setProperty(PROXY_ONLY_KEY, Boolean.valueOf(enabledProxyOnly)); } @ZapApiIgnore public boolean isConfirmRemoveDefaultToken() { return this.confirmRemove; } @ZapApiIgnore public void setConfirmRemoveDefaultToken(boolean confirmRemove) { this.confirmRemove = confirmRemove; getConfig().setProperty(CONFIRM_REMOVE_TOKEN_KEY, Boolean.valueOf(confirmRemove)); } }