|
| 1 | +import javax.servlet.http.HttpServlet; |
| 2 | +import javax.servlet.http.HttpServletResponse; |
| 3 | +import javax.servlet.http.Cookie; |
| 4 | +import org.owasp.esapi.Encoder; |
| 5 | +import java.nio.charset.StandardCharsets; |
| 6 | +import java.util.Base64; |
| 7 | +import java.security.MessageDigest; |
| 8 | +import java.net.PasswordAuthentication; |
| 9 | + |
| 10 | +public class CleartextStorageCookieTest extends HttpServlet { |
| 11 | + HttpServletResponse response; |
| 12 | + String name = "user"; |
| 13 | + String password = "BP@ssw0rd"; // $ Source |
| 14 | + |
| 15 | + public void doGet() throws Exception { |
| 16 | + { |
| 17 | + Cookie nameCookie = new Cookie("name", name); |
| 18 | + nameCookie.setValue(name); |
| 19 | + response.addCookie(nameCookie); // Safe |
| 20 | + Cookie passwordCookie = new Cookie("password", password); |
| 21 | + passwordCookie.setValue(password); |
| 22 | + response.addCookie(passwordCookie); // $ Alert |
| 23 | + Cookie encodedPasswordCookie = new Cookie("password", encrypt(password)); |
| 24 | + encodedPasswordCookie.setValue(encrypt(password)); |
| 25 | + response.addCookie(encodedPasswordCookie); // Safe |
| 26 | + } |
| 27 | + { |
| 28 | + io.netty.handler.codec.http.Cookie nettyNameCookie = |
| 29 | + new io.netty.handler.codec.http.DefaultCookie("name", name); |
| 30 | + nettyNameCookie.setValue(name); // Safe |
| 31 | + |
| 32 | + io.netty.handler.codec.http.Cookie nettyPasswordCookie = |
| 33 | + new io.netty.handler.codec.http.DefaultCookie("password", password); |
| 34 | + nettyPasswordCookie.setValue(password); // $ MISSING: Alert (netty not supported by query) |
| 35 | + |
| 36 | + io.netty.handler.codec.http.cookie.Cookie nettyEncodedPasswordCookie = |
| 37 | + new io.netty.handler.codec.http.cookie.DefaultCookie("password", encrypt(password)); |
| 38 | + nettyEncodedPasswordCookie.setValue(encrypt(password)); // Safe |
| 39 | + } |
| 40 | + { |
| 41 | + Encoder enc = null; |
| 42 | + String value = enc.encodeForHTML(password); |
| 43 | + Cookie cookie = new Cookie("password", value); |
| 44 | + response.addCookie(cookie); // $ Alert |
| 45 | + } |
| 46 | + { |
| 47 | + String data; |
| 48 | + PasswordAuthentication credentials = new PasswordAuthentication(name, password.toCharArray()); |
| 49 | + data = credentials.getUserName() + ":" + new String(credentials.getPassword()); |
| 50 | + |
| 51 | + // BAD: store data in a cookie in cleartext form |
| 52 | + response.addCookie(new Cookie("auth", data)); // $ Alert |
| 53 | + } |
| 54 | + { |
| 55 | + String data; |
| 56 | + PasswordAuthentication credentials = |
| 57 | + new PasswordAuthentication(name, password.toCharArray()); |
| 58 | + String salt = "ThisIsMySalt"; |
| 59 | + MessageDigest messageDigest = MessageDigest.getInstance("SHA-512"); |
| 60 | + messageDigest.reset(); |
| 61 | + String credentialsToHash = |
| 62 | + credentials.getUserName() + ":" + new String(credentials.getPassword()); |
| 63 | + byte[] hashedCredsAsBytes = |
| 64 | + messageDigest.digest((salt+credentialsToHash).getBytes("UTF-8")); |
| 65 | + data = new String(hashedCredsAsBytes); |
| 66 | + |
| 67 | + // GOOD: store data in a cookie in encrypted form |
| 68 | + response.addCookie(new Cookie("auth", data)); // Safe |
| 69 | + } |
| 70 | + } |
| 71 | + |
| 72 | + |
| 73 | + private static String encrypt(String cleartext) throws Exception { |
| 74 | + MessageDigest digest = MessageDigest.getInstance("SHA-256"); |
| 75 | + byte[] hash = digest.digest(cleartext.getBytes(StandardCharsets.UTF_8)); |
| 76 | + String encoded = Base64.getEncoder().encodeToString(hash); |
| 77 | + return encoded; |
| 78 | + } |
| 79 | +} |
0 commit comments