Beispiel #1
0
        protected override bool AfterForwardEvent(EventHandler<RuntimeEventArgs> handler, object sender, RuntimeEventArgs args)
        {
            IContext top = args.PopContext();
            Debug.Assert(top == this);

            return base.AfterForwardEvent(handler, sender, args);
        }
 /// <summary>
 ///     After event is forwarded
 /// </summary>
 /// <param name="handler">Handler to which the event is forwarded</param>
 /// <param name="sender">Who's sending the event</param>
 /// <param name="args">Arguments</param>
 /// <returns></returns>
 /// <remarks>Override to be called after the event is forwarded</remarks>
 protected virtual bool AfterForwardEvent(
     EventHandler<RuntimeEventArgs> handler,
     object sender,
     RuntimeEventArgs args)
 {
     return false;
 }
Beispiel #3
0
        protected override bool ForwardEventFault(EventHandler<RuntimeEventArgs> handler, object sender, RuntimeEventArgs args, Exception exp)
        {
            IContext top = args.PopContext();
            Debug.Assert(top == this);

            return base.ForwardEventFault(handler, sender, args, exp);
        }
Beispiel #4
0
 protected override bool BeforeForwardEvent(EventHandler<RuntimeEventArgs> handler, object sender, RuntimeEventArgs args)
 {
     bool shouldContinue = !IsMatch(args);
     if (!shouldContinue) {
         args.PushContext(this);
     }
     return shouldContinue;
 }
        /// <summary>
        /// Verify CSRF guard before page executes
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        void OnPreRequestHandlerExecute(object sender, RuntimeEventArgs e)
        {
            // Get current page
            Page currentPage = (HttpContext.Current != null ?
                                    HttpContext.Current.CurrentHandler as Page :
                                    null);

            if (currentPage != null) {                
                // Add CSRF guard when page initializes
                currentPage.Init += new EventHandler((p, a) => Esapi.HttpUtilities.AddCsrfToken() );
            }            
        }
Beispiel #6
0
        /// <summary>
        /// Check if the context is matched
        /// </summary>
        /// <param name="args"></param>
        /// <returns></returns>
        private bool IsMatch(RuntimeEventArgs args)
        {
            bool isMatch = true;

            // Check context match cache first
            if (args.MatchCache.TryGetValue(this, out isMatch))
            {
                return(isMatch);
            }

            // Initialize condition arguments
            isMatch = true;
            ConditionArgs conditionArgs = new ConditionArgs()
            {
                RuntimeArgs = args
            };

            // Evaluate each condition
            foreach (IContextCondition contextCondition in _conditions)
            {
                bool result = true;

                // Check condition eval cache first
                if (!args.EvalCache.TryGetValue(contextCondition.Condition, out result))
                {
                    // Eval
                    result = (contextCondition.Condition.Evaluate(conditionArgs) == contextCondition.Result);
                    args.EvalCache.SetValue(contextCondition.Condition, result);
                }

                // Shortcut match if false
                if (!result)
                {
                    isMatch = false;
                    break;
                }
            }

            // Cache
            args.MatchCache.SetValue(this, isMatch);

            // Return
            return(isMatch);
        }
        /// <summary>
        /// Handle rule execution fault
        /// </summary>
        /// <param name="handler">
        /// A <see cref="EventHandler<RuntimeEventArgs>"/>
        /// </param>
        /// <param name="sender">
        /// A <see cref="System.Object"/>
        /// </param>
        /// <param name="args">
        /// A <see cref="RuntimeEventArgs"/>
        /// </param>
        /// <param name="exp">
        /// A <see cref="Exception"/>
        /// </param>
        /// <returns>
        /// A <see cref="System.Boolean"/>
        /// </returns>
        protected override bool ForwardEventFault(EventHandler<RuntimeEventArgs> handler, object sender, RuntimeEventArgs args, Exception exp)
        {
            // Init action args
            ActionArgs actionArgs = new ActionArgs() {
                FaultingRule = _rule,
                FaultException = exp,
                RuntimeArgs = args
            };

            try {
                // Run each action
                foreach (IAction action in _faultActions) {
                    action.Execute(actionArgs);
                }
            }
            catch (Exception) {
                // Nothing to do anymore, throw 
                throw;
            }

            return true;
        }
Beispiel #8
0
        /// <summary>
        /// Check if the context is matched
        /// </summary>
        /// <param name="args"></param>
        /// <returns></returns>
        private bool IsMatch(RuntimeEventArgs args)
        {
            bool isMatch = true;

            // Check context match cache first
            if (args.MatchCache.TryGetValue(this, out isMatch)) {
                return isMatch;
            }

            // Initialize condition arguments
            isMatch = true;
            ConditionArgs conditionArgs = new ConditionArgs() { RuntimeArgs = args };

            // Evaluate each condition
            foreach (IContextCondition contextCondition in _conditions) {
                bool result = true;

                // Check condition eval cache first
                if (!args.EvalCache.TryGetValue(contextCondition.Condition, out result)) {
                    // Eval
                    result = (contextCondition.Condition.Evaluate(conditionArgs) == contextCondition.Result);
                    args.EvalCache.SetValue(contextCondition.Condition, result);
                }

                // Shortcut match if false
                if (!result) {
                    isMatch = false;
                    break;
                }
            }

            // Cache
            args.MatchCache.SetValue(this, isMatch);

            // Return
            return isMatch;
        }
Beispiel #9
0
 /// <summary>
 /// Bridge method - after handler exec
 /// </summary>
 /// <param name="sender"></param>
 /// <param name="args"></param>
 private void OnPostRequestHandlerExecute(object sender, RuntimeEventArgs args)
 {
     ForwardEvent(PostRequestHandlerExecute, sender, args);
 }
Beispiel #10
0
        protected override bool AfterForwardEvent(EventHandler <RuntimeEventArgs> handler, object sender, RuntimeEventArgs args)
        {
            IContext top = args.PopContext();

            Debug.Assert(top == this);

            return(base.AfterForwardEvent(handler, sender, args));
        }
Beispiel #11
0
        protected override bool BeforeForwardEvent(EventHandler <RuntimeEventArgs> handler, object sender, RuntimeEventArgs args)
        {
            bool shouldContinue = !IsMatch(args);

            if (!shouldContinue)
            {
                args.PushContext(this);
            }
            return(shouldContinue);
        }
        /// <summary>
        /// Verify request rate
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        void OnPreRequestHandlerExecute(object sender, RuntimeEventArgs e)
        {
            HttpSessionState session = (HttpContext.Current != null ? HttpContext.Current.Session : null);

            // No session initialized yet
            if (session == null) {
                return;
            }
            // Get current and history requests
            List<DateTime> requestHistory = GetRequestHistory(session);
            Debug.Assert(requestHistory != null);

            DateTime currentTimestamp = DateTime.Now;

            // Lookup first in timespan
            int pos = -1;
            for (int i = 0; i < requestHistory.Count; ++i) {
               DateTime hit = requestHistory[i];
               if (currentTimestamp - hit <= _timespan) {
                   pos = i;
                   break;
               }
            }

            // Add current
            requestHistory.Add(currentTimestamp);

            // Check & cleanup
            if (pos != -1) {
               // Remove expired records
               for (int i = 0; i < pos; ++i) {
                   requestHistory.RemoveAt(0);
               }
               // Check interval
               if (requestHistory.Count >= _maxCount) {
                   throw new IntrusionException(EM.RequestThrottleRule_MaximumExceeded, EM.RequestThrottleRule_MaximumExceeded);
               }
            }
        }
Beispiel #13
0
        protected override bool ForwardEventFault(EventHandler <RuntimeEventArgs> handler, object sender, RuntimeEventArgs args, Exception exp)
        {
            IContext top = args.PopContext();

            Debug.Assert(top == this);

            return(base.ForwardEventFault(handler, sender, args, exp));
        }
Beispiel #14
0
        /// <summary>
        /// Forward event
        /// </summary>
        /// <param name="handler"></param>
        /// <param name="sender"></param>
        /// <param name="args"></param>
        private void ForwardEvent(EventHandler <RuntimeEventArgs> handler, object sender, RuntimeEventArgs args)
        {
            if (handler != null)
            {
                try {
                    if (BeforeForwardEvent(handler, sender, args))
                    {
                        return;
                    }

                    handler(sender, args);

                    if (AfterForwardEvent(handler, sender, args))
                    {
                        return;
                    }
                }
                catch (Exception exp) {
                    if (!ForwardEventFault(handler, sender, args, exp))
                    {
                        throw;
                    }
                }
            }
        }
        /// <summary>
        /// Add clickjack headers
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        void OnPostRequestHandlerExecute(object sender, RuntimeEventArgs e)
        {
            // Get response
            HttpResponse response = (HttpContext.Current != null ? HttpContext.Current.Response : null);
            if (response == null) {
                throw new InvalidOperationException();
            }

            // Add clickjack protection
            switch (_mode) {
                case FramingModeType.Deny:
                    response.AddHeader(HeaderName, DenyValue);
                    break;
                case FramingModeType.Sameorigin:
                    response.AddHeader(HeaderName, SameoriginValue);
                    break;
                default:
                    throw new ArgumentOutOfRangeException();
            }
        }
Beispiel #16
0
 /// <summary>
 /// After event is forwarded
 /// </summary>
 /// <param name="handler">Handler to which the event is forwarded</param>
 /// <param name="sender">Who's sending the event</param>
 /// <param name="args">Arguments</param>
 /// <returns></returns>
 /// <remarks>Override to be called after the event is forwarded</remarks>
 protected virtual bool AfterForwardEvent(EventHandler <RuntimeEventArgs> handler, object sender, RuntimeEventArgs args)
 {
     return(false);
 }
Beispiel #17
0
 /// <summary>
 /// Event forward operation failed (exception thrown)
 /// </summary>
 /// <param name="handler">Handler to which the event is forwarded</param>
 /// <param name="sender">Who's sending the event</param>
 /// <param name="args">Arguments</param>
 /// <param name="exp">Exception thrown</param>
 /// <returns>True is fault handled, false otherwise</returns>
 /// <remarks>Override to process forward exceptions</remarks>
 protected virtual bool ForwardEventFault(EventHandler <RuntimeEventArgs> handler, object sender, RuntimeEventArgs args, Exception exp)
 {
     return(false);
 }
        /// <summary>
        /// Handle rule execution fault
        /// </summary>
        /// <param name="handler">
        /// A <see cref="EventHandler<RuntimeEventArgs>"/>
        /// </param>
        /// <param name="sender">
        /// A <see cref="System.Object"/>
        /// </param>
        /// <param name="args">
        /// A <see cref="RuntimeEventArgs"/>
        /// </param>
        /// <param name="exp">
        /// A <see cref="Exception"/>
        /// </param>
        /// <returns>
        /// A <see cref="System.Boolean"/>
        /// </returns>
        protected override bool ForwardEventFault(EventHandler <RuntimeEventArgs> handler, object sender, RuntimeEventArgs args, Exception exp)
        {
            // Init action args
            ActionArgs actionArgs = new ActionArgs()
            {
                FaultingRule   = _rule,
                FaultException = exp,
                RuntimeArgs    = args
            };

            try {
                // Run each action
                foreach (IAction action in _faultActions)
                {
                    action.Execute(actionArgs);
                }
            }
            catch (Exception) {
                // Nothing to do anymore, throw
                throw;
            }

            return(true);
        }
 /// <summary>
 ///     Bridge method - before handler exec
 /// </summary>
 /// <param name="sender"></param>
 /// <param name="args"></param>
 private void OnPreRequestHandlerExecute(object sender, RuntimeEventArgs args)
 {
     this.ForwardEvent(this.PreRequestHandlerExecute, sender, args);
 }
        /// <summary>
        /// Forward event
        /// </summary>
        /// <param name="handler"></param>
        /// <param name="sender"></param>
        /// <param name="args"></param>
        private void ForwardEvent(EventHandler<RuntimeEventArgs> handler, object sender, RuntimeEventArgs args)
        {
            if (handler != null) {
                try {
                    if (BeforeForwardEvent(handler, sender, args)) {
                        return;
                    }

                    handler(sender, args);

                    if (AfterForwardEvent(handler, sender, args)) {
                        return;
                    }
                }
                catch (Exception exp) {
                    if (!ForwardEventFault(handler, sender, args, exp)) {
                        throw;
                    }
                }
            }
        }
 /// <summary>
 /// Event forward operation failed (exception thrown)
 /// </summary>
 /// <param name="handler">Handler to which the event is forwarded</param>
 /// <param name="sender">Who's sending the event</param>
 /// <param name="args">Arguments</param>
 /// <param name="exp">Exception thrown</param>
 /// <returns>True is fault handled, false otherwise</returns>
 /// <remarks>Override to process forward exceptions</remarks>
 protected virtual bool ForwardEventFault(EventHandler<RuntimeEventArgs> handler, object sender, RuntimeEventArgs args, Exception exp)
 {
     return false;
 }
 /// <summary>
 /// Bridge method - after handler exec
 /// </summary>
 /// <param name="sender"></param>
 /// <param name="args"></param>
 private void OnPostRequestHandlerExecute(object sender, RuntimeEventArgs args)
 {
     ForwardEvent(PostRequestHandlerExecute, sender, args);
 }