Package org.owasp.esapi.reference

Class DefaultAccessController

    • Field Summary

      Fields 
      Modifier and Type Field Description
      protected Logger logger  

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods Deprecated Methods 
      Modifier and Type Method Description
      void assertAuthorized​(java.lang.Object key, java.lang.Object runtimeParameter)
      assertAuthorized executes the AccessControlRule that is identified by key and listed in the resources/ESAPI-AccessControlPolicy.xml file.
      void assertAuthorizedForData​(java.lang.String action, java.lang.Object data)
      Checks if the current user is authorized to access the referenced data.
      void assertAuthorizedForFile​(java.lang.String filepath)
      Deprecated. 
      void assertAuthorizedForFunction​(java.lang.String functionName)
      Checks if the current user is authorized to access the referenced function.
      void assertAuthorizedForService​(java.lang.String serviceName)
      Checks if the current user is authorized to access the referenced service.
      void assertAuthorizedForURL​(java.lang.String url)
      Checks if the current user is authorized to access the referenced URL.
      static AccessController getInstance()  
      boolean isAuthorized​(java.lang.Object key, java.lang.Object runtimeParameter)
      isAuthorized executes the AccessControlRule that is identified by key and listed in the resources/ESAPI-AccessControlPolicy.xml file.
      boolean isAuthorizedForData​(java.lang.String action, java.lang.Object data)
      Checks if the current user is authorized to access the referenced data, represented as an Object.
      boolean isAuthorizedForFile​(java.lang.String filepath)
      Checks if the current user is authorized to access the referenced file.
      boolean isAuthorizedForFunction​(java.lang.String functionName)
      Checks if the current user is authorized to access the referenced function.
      boolean isAuthorizedForService​(java.lang.String serviceName)
      Checks if the current user is authorized to access the referenced service.
      boolean isAuthorizedForURL​(java.lang.String url)
      Checks if the current user is authorized to access the referenced URL.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • logger

        protected final Logger logger

    • Method Detail

      • isAuthorized

        public boolean isAuthorized​(java.lang.Object key,
                            java.lang.Object runtimeParameter)
        isAuthorized executes the AccessControlRule that is identified by key and listed in the resources/ESAPI-AccessControlPolicy.xml file. It returns true if the AccessControlRule decides that the operation should be allowed. Otherwise, it returns false. Any exception thrown by the AccessControlRule must result in false. If key does not map to an AccessControlRule, then false is returned. Developers should call isAuthorized to control execution flow. For example, if you want to decide whether to display a UI widget in the browser using the same logic that you will use to enforce permissions on the server, then isAuthorized is the method that you want to use. Typically, assertAuthorized should be used to enforce permissions on the server.
        Specified by:
        isAuthorized in interface AccessController
        Parameters:
        key - key maps to <AccessControlPolicy><AccessControlRules> <AccessControlRule name="key"
        runtimeParameter - runtimeParameter can contain anything that the AccessControlRule needs from the runtime system.
        Returns:
        Returns true if and only if the AccessControlRule specified by key exists and returned true. Otherwise returns false

      • assertAuthorized

        public void assertAuthorized​(java.lang.Object key,
                             java.lang.Object runtimeParameter)
                      throws AccessControlException
        assertAuthorized executes the AccessControlRule that is identified by key and listed in the resources/ESAPI-AccessControlPolicy.xml file. It does nothing if the AccessControlRule decides that the operation should be allowed. Otherwise, it throws an org.owasp.esapi.errors.AccessControlException. Any exception thrown by the AccessControlRule will also result in an AccesControlException. If key does not map to an AccessControlRule, then an AccessControlException is thrown. Developers should call assertAuthorized to enforce privileged access to the system. It should be used to answer the question: "Should execution continue." Ideally, the call to assertAuthorized should be integrated into the application framework so that it is called automatically.
        Specified by:
        assertAuthorized in interface AccessController
        Parameters:
        key - key maps to <AccessControlPolicy><AccessControlRules> <AccessControlRule name="key"
        runtimeParameter - runtimeParameter can contain anything that the AccessControlRule needs from the runtime system.
        Throws:
        AccessControlException

      • assertAuthorizedForData

        public void assertAuthorizedForData​(java.lang.String action,
                                    java.lang.Object data)
                             throws AccessControlException
        Checks if the current user is authorized to access the referenced data. This method simply returns if access is authorized. It throws an AccessControlException if access is not authorized, or if the referenced data does not exist.

        Specification: The implementation should do the following:

        1. Check to see if the resource exists and if not, throw an AccessControlException
        2. Use available information to make an access control decision
          1. Ideally, this policy would be data driven
          2. You can use the current User, roles, data type, data name, time of day, etc.
          3. Access control decisions must deny by default
        3. If access is not permitted, throw an AccessControlException with details
        Specified by:
        assertAuthorizedForData in interface AccessController
        Parameters:
        action - The action to verify for an access control decision, such as a role, or an action being performed on the object (e.g., Read, Write, etc.), or the name of the function the data is being passed to.
        data - The actual object or object identifier being accessed or a reference to the object being accessed.
        Throws:
        AccessControlException - if access is not permitted

      • assertAuthorizedForFile

        @Deprecated
public void assertAuthorizedForFile​(java.lang.String filepath)
                             throws AccessControlException
        Deprecated.
        Checks if the current user is authorized to access the referenced file. The implementation should validate and canonicalize the input to be sure the filepath is not malicious.

        This method throws an AccessControlException if access is not authorized, or if the referenced File does not exist. If the User is authorized, this method simply returns.

        Specification: The implementation should do the following:

        1. Check to see if the File exists and if not, throw an AccessControlException
        2. Use available information to make an access control decision
          1. Ideally, this policy would be data driven
          2. You can use the current User, roles, data type, data name, time of day, etc.
          3. Access control decisions must deny by default
        3. If access is not permitted, throw an AccessControlException with details
        Specified by:
        assertAuthorizedForFile in interface AccessController
        Parameters:
        filepath - Path to the file to be checked
        Throws:
        AccessControlException - if access is denied

      • assertAuthorizedForFunction

        public void assertAuthorizedForFunction​(java.lang.String functionName)
                                 throws AccessControlException
        Checks if the current user is authorized to access the referenced function. The implementation should define the function "namespace" to be enforced. Choosing something simple like the class name of action classes or menu item names will make this implementation easier to use.

        This method throws an AccessControlException if access is not authorized, or if the referenced function does not exist. If the User is authorized, this method simply returns.

        Specification: The implementation should do the following:

        1. Check to see if the function exists and if not, throw an AccessControlException
        2. Use available information to make an access control decision
          1. Ideally, this policy would be data driven
          2. You can use the current User, roles, data type, data name, time of day, etc.
          3. Access control decisions must deny by default
        3. If access is not permitted, throw an AccessControlException with details
        Specified by:
        assertAuthorizedForFunction in interface AccessController
        Parameters:
        functionName - the function name
        Throws:
        AccessControlException - if access is not permitted

      • assertAuthorizedForService

        public void assertAuthorizedForService​(java.lang.String serviceName)
                                throws AccessControlException
        Checks if the current user is authorized to access the referenced service. This can be used in applications that provide access to a variety of backend services.

        This method throws an AccessControlException if access is not authorized, or if the referenced service does not exist. If the User is authorized, this method simply returns.

        Specification: The implementation should do the following:

        1. Check to see if the service exists and if not, throw an AccessControlException
        2. Use available information to make an access control decision
          1. Ideally, this policy would be data driven
          2. You can use the current User, roles, data type, data name, time of day, etc.
          3. Access control decisions must deny by default
        3. If access is not permitted, throw an AccessControlException with details
        Specified by:
        assertAuthorizedForService in interface AccessController
        Parameters:
        serviceName - the service name
        Throws:
        AccessControlException - if access is not permitted

      • assertAuthorizedForURL

        public void assertAuthorizedForURL​(java.lang.String url)
                            throws AccessControlException
        Checks if the current user is authorized to access the referenced URL. The implementation should allow access to be granted to any part of the URL. Generally, this method should be invoked in the application's controller or a filter as follows: 
        ESAPI.accessController().assertAuthorizedForURL(request.getRequestURI().toString());
        This method throws an AccessControlException if access is not authorized, or if the referenced URL does not exist. If the User is authorized, this method simply returns.

        Specification: The implementation should do the following:

        1. Check to see if the resource exists and if not, throw an AccessControlException
        2. Use available information to make an access control decision
          1. Ideally, this policy would be data driven
          2. You can use the current User, roles, data type, data name, time of day, etc.
          3. Access control decisions must deny by default
        3. If access is not permitted, throw an AccessControlException with details
        Specified by:
        assertAuthorizedForURL in interface AccessController
        Parameters:
        url - the URL as returned by request.getRequestURI().toString()
        Throws:
        AccessControlException - if access is not permitted

      • isAuthorizedForData

        public boolean isAuthorizedForData​(java.lang.String action,
                                   java.lang.Object data)
        Checks if the current user is authorized to access the referenced data, represented as an Object. The implementation of this method should call assertAuthorizedForData(String action, Object data), and if an AccessControlException is not thrown, this method should return true.
        Specified by:
        isAuthorizedForData in interface AccessController
        Parameters:
        action - The action to verify for an access control decision, such as a role, or an action being performed on the object (e.g., Read, Write, etc.), or the name of the function the data is being passed to.
        data - The actual object or object identifier being accessed or a reference to the object being accessed.
        Returns:
        true, if is authorized for the data

      • isAuthorizedForFile

        public boolean isAuthorizedForFile​(java.lang.String filepath)
        Checks if the current user is authorized to access the referenced file. The implementation of this method should call assertAuthorizedForFile(String filepath), and if an AccessControlException is not thrown, this method should return true.
        Specified by:
        isAuthorizedForFile in interface AccessController
        Parameters:
        filepath - the path of the file to be checked, including filename
        Returns:
        true, if is authorized for the file

      • isAuthorizedForFunction

        public boolean isAuthorizedForFunction​(java.lang.String functionName)
        Checks if the current user is authorized to access the referenced function. The implementation of this method should call assertAuthorizedForFunction(String functionName), and if an AccessControlException is not thrown, this method should return true.
        Specified by:
        isAuthorizedForFunction in interface AccessController
        Parameters:
        functionName - the name of the function
        Returns:
        true, if is authorized for function

      • isAuthorizedForService

        public boolean isAuthorizedForService​(java.lang.String serviceName)
        Checks if the current user is authorized to access the referenced service. This can be used in applications that provide access to a variety of back end services. The implementation of this method should call assertAuthorizedForService(String serviceName), and if an AccessControlException is not thrown, this method should return true.
        Specified by:
        isAuthorizedForService in interface AccessController
        Parameters:
        serviceName - the service name
        Returns:
        true, if is authorized for the service

      • isAuthorizedForURL

        public boolean isAuthorizedForURL​(java.lang.String url)
        Checks if the current user is authorized to access the referenced URL. Generally, this method should be invoked in the application's controller or a filter as follows: 
        ESAPI.accessController().isAuthorizedForURL(request.getRequestURI().toString());
        The implementation of this method should call assertAuthorizedForURL(String url), and if an AccessControlException is not thrown, this method should return true. This way, if the user is not authorized, false would be returned, and the exception would be logged.
        Specified by:
        isAuthorizedForURL in interface AccessController
        Parameters:
        url - the URL as returned by request.getRequestURI().toString()
        Returns:
        true, if is authorized for URL