esapi-java-legacy icon indicating copy to clipboard operation
esapi-java-legacy copied to clipboard

Determine way to deal with OS specific path names in ESAPI.properties

Open kwwall opened this issue 5 years ago • 1 comments

There are at least these 2 properties in the ESAPI.properties file that are OS-specific path names:

# Default file upload location (remember to escape backslashes with \\)
HttpUtilities.UploadDir=C:\\ESAPI\\testUpload
HttpUtilities.UploadTempDir=C:\\temp

(There as also these specific properties, but their defaults have been removed:

Executor.WorkingDirectory=
Executor.ApprovedExecutables=

as they refer generally refer to full path names, but must be explicitly set if they need to be used.)

Ideally, we ESAPI should determine the OS at runtime using the System property os.name and then use that to construct appropriate path names. That would allow us to chose an ESAPI property for Windows and for *nix / MacOS and choose the appropriate one at runtime.

For example, rather than:

HttpUtilities.UploadTempDir=C:\\temp

we might use:

HttpUtilities.UploadTempDir.windows=C:\\temp
HttpUtilities.UploadTempDir.unix=/tmp

and from that, choose the appropriate HttpUtilities.UploadTempDir at runtime, but it would allow ESAPI to still provide reasonable default settings for each.

kwwall avatar Jan 27 '19 02:01 kwwall