Error when using Esapi validation

Question

I hope someone could help me with some issue.

I'm using OWASP ESAPI 2.1.0 with JavaEE, to help me to validate some entries in a web application. At some point I needed to validate a Windows file path, so I added a new property entry in the 'validation.properties' like this one:

Validator.PathFile=^([a-zA-Z]:)?(\\\\[\\w. -]+)+$

When I try to validate, for example, a string like "C:\TEMP\file.txt" via ESAPI, I get a ValidationException:

ESAPI.validator().getValidInput("PathFile", "C:\\TEMP\\file.txt", "PathFile", 100, false);

Alternatively, I also tried the java.util.regex.Pattern class to test the same regular expression with the same string example and it works OK:

Pattern.matches("^([a-zA-Z]:)?(\\\\[\\w. -]+)+$", "C:\\TEMP\\file.txt")

I must say that I added other regex in 'validation.properties' and worked OK. Why this one is so hard? Could anyone help me out with this one?

Answer 1

This is happening because the call to validator().getValidInput("PathFile", "C:\\TEMP\\file.txt", "PathFile", 100, false); wraps a call to ESAPI.encoder().canonicalize() that is transforming the input to the char sequence (Not literal String!) C:TEMP'0x0C'ile.txt before it passes to the regex engine.

Except for the second "\" getting converted to the char 0x0c this is normally desired behavior. That could be a bug in ESAPI.

What you want, is to make a call to ESAPI.validator().getValidDirectoryPath()