Dissecting Java Server Faces for Penetration Testing - SecNiche ...

to preserve integrity.• It is also possible to design custom CSRF filters with strong functionsthat generate random tokens. This is possible by creating a CSRF Sessionlistener class that overrides every request with HTTP listener class andappends a random token in every request for a particular session. Thereis also a possibility of adding an element in thetag that automatically initiates the CSRF protection. Framework thatsupports are Apache Shale, MyFaces and JBOSS Seam.• The real world examples will look like as presented in listing 3Listing 3: Implementing CSRF Tokens in JSF4.4 Security Descriptors Fallacy - ConfigurationThe declaration of security parameters in web.xml are imperative especially thesecurity elements that are used for preserving the confidentiality and integrityof the ViewState. It has been noticed that declaration of ”ALGORTIHM” inuppercase in ”org.apache.myfaces.ALGORITHM” does not initialize the InitializationVector (IV) in Apache MyFaces. This is a bad design practice and couldhave devastative impacts on the security of a JSF application. The source codeof the ”utils.StateUItils” class (which holds security configuration elements) aspresented in listing 4 which clearly reflects that these parameters have to be appliedin lower case but the documentation of various JSF versions is not writtenappropriately and is not inline with the real code. In other words, the documentationis misleading.p u b l i c s t a t i c f i n a l S t r i n g INIT PREFIX = ” org . apache . myfaces . ” ;p u b l i c s t a t i c f i n a l S t r i n g INIT ALGORITHM = INIT PREFIX + ”ALGORITHM” ;p r i v a t e s t a t i c S t r i n g findAlgorithm ( ExternalContext ctx ) {S t r i n g a l g o r i t h m = ctx . g e t I n i t P a r a m e t e r (INIT ALGORITHM) ;i f ( a l g o r i t h m == n u l l ){a l g o r i t h m = ctx . g e t I n i t P a r a m e t e r (INIT ALGORITHM .toLowerCase ( ) ) ;}r e t u r n findAlgorithm ( algorithm ) ;}. . Truncated . .Listing 4: Explicit Specification - Implementing to Lower Case14