JSF Security

JSF Security

© 2011 Security Compass inc. 1

JSF Input Validation

abcd
<script>

24c;--

Validated Input


MyFaces: validateRegExpr Tag
<%@ taglib
uri="http://myfaces.apache.org/tomahawk"
prefix="t" %>
Using Apache Tomahawk tag library
<h:outputLabel for="zip1" value="Zip"/>
<t:inputText value="#{order.zipCode}"
id="zip1">
<t:validateRegExpr pattern="d{5}"
message="ZIP Code must be 5 digits"/>
</t:inputText>


Facelets Implementation
<html ...
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:t="http://myfaces.apache.org/tomahawk">

<h:inputText type="text" id="val“
value="#{SimpleBean.val}" required="true">
<t:validateRegExpr pattern="[a-zA-Z]{1,100}"
/>
</h:inputText>


Mojarra Validators
xmlns:mj=http://mojarra.dev.java.net/mojarra_ext

<h:inputText type="text" id="val“
value="#{SimpleBean.val}" required="true">
<mj:regexValidator
pattern="[a-zA-Z]{1,50}"/>
</h:inputText>

There also exists:
<mj:creditCardValidator/>


JSF 2.0 Validators
• Part of JSF 2.0 core tag library
• Can leverage:
– <f:validateLength …/>
– <f:validateLongRange …/>
– <f:validateDoubleRange …/>
– <f:validateRegex pattern=“…”/>


Other JSF Validation Techniques
• Validation in Action Controller
– Validation tied closely to biz logic
– Dependence between different fields

• Custom validation methods
– More complex validation (i.e. built-in JSF
validator doesn’t suit your need)


Output Encoding in JSF

<script>alert('xss')

< > (')


<h:outputText> & <h:outputFormat>
<h:outputText value="#{param.name}"/>

escape attribute is set
to “true” by default

<h:outputFormat value=“#{param.name}”/>


Output encoding with Facelets
<ui:define name="body">
This will safely encode as an HTML element
in a Facelet:
<h:outputText value="#{SimpleBean.val}">
</h:outputText>
</ui:define>
EL expression is
automatically encoded


But there’s a problem …
• <h:outputText> and <h:outputFormat>
cannot be used safely within:
– HTML attribute
– JavaScript or CSS

• Similar problem with: Facelets
${bean.name}


Problems with RichFaces
• Some tags can lead to XSS
• Never use user-supplied data with:
– <a4j:loadScript>
– <a4j:loadStyle>
– <rich:componentControl>
• Known vulnerabilities exist with:
<rich:editor>, <rich:effect>, <rich:gmap>,
<rich:virtualEarth>

Solution: OWASP ESAPI EL
<p>
<input type="text“
value="${esapi:encodeForHTMLAttribute(dangerous)}"/>
</p>

<p>
<script language="javascript">
var str=${esapi:encodeForJavaScript(dangerous)};
</script>
</p>


ESAPI AccessController
• Interface that provides access control for
– URLs
– Business functions
– Data services & files

• Contains:
– assertAuthorizedForURL(String URL)


Defending Against CSRF

Anti-CSRF tokens

What about JSF “view state”?
• javax.faces.STATE_SAVING_METHOD
– Can save and restore state of the view
between requests to server

STATE_SAVING_METHOD + JSESSIONID =
Anti-CSRF Token ???


Problem: Padding Oracle Attack
• Recently discovered exploit against CBC-
mode encryption with PKCS#5 padding
• Incorrect padding can result in
java.crypto.BadPaddingException
• Can use to decrypt
STATE_SAVING_METHOD


Solution: OWASP CSRF Guard
• Version 3 recently released!
• Library that injects per-session or per-
request tokens into HTML
• Can use 2 strategies to inject token:
– JavaScript DOM Manipulation
– JSP Tag Library


JSF Security

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to JSF Security

Similar to JSF Security (20)

More from Source Conference

More from Source Conference (20)

Recently uploaded

Recently uploaded (20)

JSF Security