Clever Geek Handbook

NullPointerException with Owasp.CsrfGuard.Test

Why am I getting:

java.lang.NullPointerException org.owasp.csrfguard.CsrfGuardFilter.doFilter(CsrfGuardFilter.java:53)

when trying to run 0wasp.CsrfGuard.Test application on Tomcat 5.5?

I am using the sample application exactly the same as I did when loading, but with the following changes to work around the errors listener

:

  • I downloaded the CsrfGuard 3.0.0 package and copied Owasp.CsrfGuard.jar

    over WEB-INF/lib

    to bypass the listeners that weren't found.

  • I changed the web.xml file to use the listener that comes with Owasp.CsrfGuard.jar

    , not the two listeners in the original web.xml

    that don't exist.

When I run the application, there are no errors, but when I point my browser to the page /Owasp.CsrfGuard.Test/index.html

, I get the above error.

Any ideas to try?

Updating ...

A few hours later and I got the job without error. I don't understand why, but the filter errors seem to persist even after stopping and restarting the webapp (in Tomcat at least). I had to rename this webapp directory, wait 10 seconds for Tomcat to automatically unpack it, rename it back to its original directory name and wait 10 seconds for Tomcat to recognize it as a new webapp. I also removed the "init-param" with the x-request from the web.xml file since I am not using AJAX. Don't know if it's really needed, but it works, so I leave it.

Now the "protect.html" file is indeed protected, but it is too secure. I can't get to him. If I try to go directly to the protect.html page it shouldn't allow that, which it doesn't. However, this should allow me to get there via the correct webpage flow, with all pages receiving the correct token (s).

The question now is how can I go to the protect.html page?

Thank.

+3


source to share


1 answer


Got! In case anyone is having problems, here is what I figured out to work with JavaScript DOM Manipulation.

All references in the .properties file MUST BE absolute with a reference to the web container (Tomcat in my case). Even if you put the .js and .jar files in a specific webapp and modify the webapp web.xml file with the appropriate settings for CSRFGuard (with relative links by the way), the entries in the .properties file should contain references to the webapp name. For example, it should be something like:

org.owasp.csrfguard.unprotected.Index = / someapp / index.html

not just



org.owasp.csrfguard.unprotected.Index = index.html

This is not intuitive, because unless you are dealing with the entire Tomcat container (i.e. the master web.xml file), you can usually remove the webapp name as it is implied for that webapp.

I will now consider another CSRFGuard JSP Tag Injection method as the JavaScript engine will not work if the user has disabled JavaScript in their browser.

+1


source






More articles:


All Articles