Owasp ESAPI class not discoverable as bean in spring

Question

I'm using ESAPI library to encode name variable in my code.And my project is implemented on spring.

ESAPI.encoder().encodeForSQL( new OracleCodec(), name);

    import org.owasp.esapi.ESAPI;
import org.owasp.esapi.codecs.Codec;
import org.owasp.esapi.codecs.MySQLCodec;
import org.owasp.esapi.reference.DefaultEncoder;
    import org.springframework.jdbc.core.support.JdbcDaoSupport;

    public class StringJdbcDao extends JdbcDaoSupport{


    public void execute(){
            BufferedReader r = new BufferedReader(new InputStreamReader(sqlDDL));
                        try {
                            // read the first line, skipping any '--' comment lines
                            boolean firstLine = true;
                            StringBuffer buf = new StringBuffer();
                            for (String line = r.readLine(); line != null; line = r.readLine()) {
                                **line = ESAPI.encoder().encodeForSQL(new MySQLCodec(MySQLCodec.MYSQL_MODE), line.trim());**
                                getSpringJdbcTemplate().execute(line);
    }
    }

I get the below error.

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.sakaiproject.genericdao.test.GenericDaoTarget' defined in class path resource [spring-jdbc.xml]: Invocation of init method failed; nested exception is org.springframework.beans.factory.BeanInitializationException: Initialization of DAO failed; nested exception is org.owasp.esapi.errors.ConfigurationException: java.lang.reflect.InvocationTargetException SecurityConfiguration class (org.owasp.esapi.reference.DefaultSecurityConfiguration) CTOR threw exception. at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1338) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:473) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory$1.run(AbstractAutowireCapableBeanFactory.java:409) at java.security.AccessController.doPrivileged(Native Method) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:380) at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:264) at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222) at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:261) at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:185)

You haven't shown the code you're using to configure Spring to use the library. Also, it would be *much* wiser to rewrite the SQL to use PreparedStatements than to use the SQL encoder. — avgvstvs, Jul 27 '17 at 20:49
@avgvstvs im using SpringJdbcTemplate not PreparedStatements — Niranga Sandaruwan, Jul 28 '17 at 01:07
Will evaluate your question when I get home. In the meantime, that link should show you how to do prepared statement with spring jdbc template — avgvstvs, Jul 28 '17 at 01:19
Yeah, the code you've got here is just where you're instantiating it. I'm not seeing what you've done to set up the dependency injection for the ESAPI class. — avgvstvs, Jul 28 '17 at 14:12
I haven't done anything else.just calling ESAPI.encoder().encodeForSQL.I want to know how to set up dependency injection for ESAPI.Exaplain your solution with common example.I want to know any external library class to call as dependancy which not marked as spring bean type. — Niranga Sandaruwan, Aug 03 '17 at 04:09
Edit didn't help. https://dzone.com/articles/dependency-injection-an-introd — avgvstvs, Aug 09 '17 at 16:44

Owasp ESAPI class not discoverable as bean in spring

0 Answers0