Changeset 410 for trunk/EventBenchConsole/src/de

Timestamp:

04/03/12 10:24:49 (13 years ago)

Author:

sherbold

Message:

• improved detection of invalid sequences in de.ugoe.cs.eventbench.web.WeblogParser?

File:

• trunk/EventBenchConsole/src/de/ugoe/cs/eventbench/web/WeblogParser.java (modified) (4 diffs)

trunk/EventBenchConsole/src/de/ugoe/cs/eventbench/web/WeblogParser.java

@@ -297 +297 @@
                                         String path = uri.getPath();
                                         List<String> getVars = extractGetVarsFromUri(uri);
-
+                                        
                                         WebEvent event = new WebEvent(url, path, timestamp,
                                                         postedVars, getVars);
@@ -446 +446 @@
          *            URI that is parsed
          * @return a list with all GET variables
-         */
-        private List<String> extractGetVarsFromUri(URI uri) {
+         * @throws URISyntaxException
+         *             thrown if one of the variables seems to indicate that the
+         *             request is a malicious attack on the web application
+         */
+        private List<String> extractGetVarsFromUri(URI uri)
+                        throws URISyntaxException {
                 List<String> getVars = new ArrayList<String>();
                 String query = uri.getQuery();
@@ -455 +459 @@
                                 String[] paramSplit = paramPair.split("=");
                                 if (!isBrokenVariable(paramSplit[0])) {
+                                        for (int i = 1; i < paramSplit.length; i++) {
+                                                checkForAttack(paramSplit[i]);
+                                        }
                                         getVars.add(paramSplit[0]);
                                 }
@@ -473 +480 @@
          */
         private boolean isBrokenVariable(String var) {
-                // TODO improve filtering of broken variables
                 return var.contains("and");
         }
+
+        /**
+         * <p>
+         * Checks if the variable name send with a request seems like an attack on the server.
+         * </p>
+         * @param value
+         * @throws URISyntaxException
+         */
+        private void checkForAttack(String value) throws URISyntaxException {
+                if (value.contains("UNION+") || value.contains("SELECT+")) {
+                        throw new URISyntaxException(value, "possible injection attack");
+                }
+        }
 }