public class CookieInterceptor extends AbstractInterceptor
CookiesAware
in order to have a Map
of filtered cookies set into it.
CookiesAware
.
<!-- This example will inject cookies named either 'cookie1' or 'cookie2' whose value could be either 'cookie1value' or 'cookie2value' into Struts' action. --> <action ... > <interceptor-ref name="cookie"> <param name="cookiesName">cookie1, cookie2</param> <param name="cookiesValue">cookie1value, cookie2value</param> </interceptor-ref> .... </action> <!-- This example will inject cookies named either 'cookie1' or 'cookie2' regardless of their value into Struts' action. --> <action ... > <interceptor-ref name="cookie"> <param name="cookiesName">cookie1, cookie2</param> <param name="cookiesValue">*</param> <interceptor-ref> ... </action> <!-- This example will inject cookies named either 'cookie1' with value 'cookie1value' or 'cookie2' with value 'cookie2value' into Struts' action. --> <action ... > <interceptor-ref name="cookie"> <param name="cookiesName">cookie1</param> <param name="cookiesValue">cookie1value</param> </interceptor-ref> <interceptor-ref name="cookie"> <param name="cookiesName"<cookie2</param> <param name="cookiesValue">cookie2value</param> </interceptor-ref> .... </action> <!-- This example will inject any cookies regardless of its value into Struts' action. --> <action ... > <interceptor-ref name="cookie"> <param name="cookiesName">*</param> <param name="cookiesValue">*</param> </interceptor-ref> ... </action>
CookiesAware
,
Serialized FormConstructor and Description |
---|
CookieInterceptor() |
Modifier and Type | Method and Description |
---|---|
protected void |
injectIntoCookiesAwareAction(Object action,
Map<String,String> cookiesMap)
Hook that set the
cookiesMap into action that implements
CookiesAware . |
String |
intercept(ActionInvocation invocation) |
protected boolean |
isAcceptableName(String name)
Checks if name of Cookie doesn't contain vulnerable code
|
protected boolean |
isAcceptableValue(String value)
Checks if value of Cookie doesn't contain vulnerable code
|
protected boolean |
isAccepted(String name)
Checks if name of Cookie match
acceptedPattern |
protected boolean |
isExcluded(String name)
Checks if name of Cookie match
excludedPatterns |
protected void |
populateCookieValueIntoStack(String cookieName,
String cookieValue,
Map<String,String> cookiesMap,
ValueStack stack)
Hook that populate cookie value into value stack (hence the action)
if the criteria is satisfied (if the cookie value matches with those configured).
|
void |
setAcceptCookieNames(String pattern)
Set the
acceptCookieNames pattern of allowed names of cookies to protect against remote command execution vulnerability |
void |
setCookiesName(String cookiesName)
Set the
cookiesName which if matched will allow the cookie
to be injected into action, could be comma-separated string. |
void |
setCookiesValue(String cookiesValue)
Set the
cookiesValue which if matched (together with matching
cookiesName) will caused the cookie to be injected into action, could be
comma-separated string. |
destroy, init
public void setCookiesName(String cookiesName)
cookiesName
which if matched will allow the cookie
to be injected into action, could be comma-separated string.cookiesName
- public void setCookiesValue(String cookiesValue)
cookiesValue
which if matched (together with matching
cookiesName) will caused the cookie to be injected into action, could be
comma-separated string.cookiesValue
- public void setAcceptCookieNames(String pattern)
acceptCookieNames
pattern of allowed names of cookies to protect against remote command execution vulnerabilitypattern
- used to check cookie name againstpublic String intercept(ActionInvocation invocation) throws Exception
intercept
in interface Interceptor
intercept
in class AbstractInterceptor
Exception
protected boolean isAcceptableValue(String value)
value
- of Cookieprotected boolean isAcceptableName(String name)
name
- of Cookieprotected boolean isAccepted(String name)
acceptedPattern
name
- of Cookieprotected boolean isExcluded(String name)
excludedPatterns
name
- of Cookieprotected void populateCookieValueIntoStack(String cookieName, String cookieValue, Map<String,String> cookiesMap, ValueStack stack)
cookieName
- cookieValue
- cookiesMap
- stack
- protected void injectIntoCookiesAwareAction(Object action, Map<String,String> cookiesMap)
cookiesMap
into action that implements
CookiesAware
.action
- cookiesMap
- Copyright © 2000-2014 Apache Software Foundation. All Rights Reserved.