skyview.request

Class SkyViewDetainter

java.lang.Object

skyview.request.Detainter

skyview.request.SkyViewDetainter

public class SkyViewDetainter
extends Detainter

This class defines string patterns and rules that are used to do taint checking for Skyview CGI calls. A hash map of acceptable character patterns is created upon construction and are matched against user input associated with each CGI parameter. If the pattern for a CGI parameter is not found the input is checked for characters that are not allowed. Some parameters such as survey name are checked against a pattern of allowed characters and then checked again to make sure certain sequences of allowed characters are not present.

Constructor Summary

Constructors

Constructor and Description
SkyViewDetainter()

Method Summary

Modifier and Type	Method and Description
boolean	checkInvalid(java.util.regex.Pattern pattern, java.lang.String name, java.lang.String input)
boolean	isValid(java.util.regex.Pattern pattern, java.lang.String name, java.lang.String input)
static void	registerVariables(java.lang.String[] vars, java.lang.String[]... patterns) Maps given CGI variables to a list of regex patterns to match against.
boolean	validate(java.lang.String name, java.lang.String input)
boolean	validateRule(java.util.regex.Pattern pattern, java.lang.String name, java.lang.String input, java.lang.String condition) Dependent on the condition flag, checks if input matches or does not match a given pattern

Methods inherited from class skyview.request.Detainter

addPattern, getPattern

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SkyViewDetainter

public SkyViewDetainter()

Method Detail

registerVariables

public static void registerVariables(java.lang.String[] vars,
                                     java.lang.String[]... patterns)

Maps given CGI variables to a list of regex patterns to match against. Patterns are provided as a series of two-length arrays: First index: Name of the regex pattern (registered by Detainter.addPattern) Second index: Condition to test regex pattern against (Match = "true", Do not match = "false") If a pattern set contains multiple pairs of patterns and corresponding conditions, the entire group will be interpreted as an OR operation (only one of the set must pass) (e.g.) ["Pattern 1", "true", "Pattern 2", "false", ...]

Parameters:

vars - Array of CGI vars to assign the provided set of patterns

patterns - Array of patterns and their expected check condition

validate

public boolean validate(java.lang.String name,
                        java.lang.String input)
                 throws java.lang.Exception

Specified by:

validate in class Detainter

Throws:

java.lang.Exception

isValid

public boolean isValid(java.util.regex.Pattern pattern,
                       java.lang.String name,
                       java.lang.String input)
                throws java.lang.Exception

Throws:

java.lang.Exception

checkInvalid

public boolean checkInvalid(java.util.regex.Pattern pattern,
                            java.lang.String name,
                            java.lang.String input)
                     throws java.lang.Exception

Throws:

java.lang.Exception

validateRule

public boolean validateRule(java.util.regex.Pattern pattern,
                            java.lang.String name,
                            java.lang.String input,
                            java.lang.String condition)
                     throws java.lang.Exception

Dependent on the condition flag, checks if input matches or does not match a given pattern

Parameters:

pattern - Regex pattern to match against

name - Name of the provided argument, for error reporting purposes

input - the input text to check against

condition - Whether to check if the input matches (true) or does not match (false) the pattern

Returns:

true if matches pattern dependent on condition flag

Throws:

java.lang.Exception