0

I am using ESAPI to encode the string, when using with Oracle JDBC. I Get following error even though i have ESAPI.Properties in my project.

 final var queryString =
                String.format("SELECT * FROM %1$s WHERE %2$s = '%3$s'",
                        ESAPI.encoder().encodeForSQL(new OracleCodec(),tableName),
                        ESAPI.encoder().encodeForSQL(new OracleCodec(),columnName),
                        ESAPI.encoder().encodeForSQL(new OracleCodec(),columnValue));




Caused by: java.lang.ClassNotFoundException: org.owasp.encoder.esapi.ESAPIEncoder
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
    at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:520)
    at java.base/java.lang.Class.forName0(Native Method)
    at java.base/java.lang.Class.forName(Class.java:375)
    at org.owasp.esapi.util.ObjFactory.loadClassByStringName(ObjFactory.java:158)
    at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:81)
    ... 108 common frames omitted

Here is my project structure.

enter image description here

Version:

 implementation 'org.owasp.esapi:esapi:2.2.1.1'

here is my ESAPI.properties file

# Properties based on ESAPI 2.2.1.1's configuration/esapi/ESAPI.properties file.

ESAPI.Encoder=org.owasp.encoder.esapi.ESAPIEncoder

# Log4JFactory Requires log4j.xml or log4j.properties in classpath - http://www.laliluna.de/log4j-tutorial.html
# Note that this is now considered deprecated!
#ESAPI.Logger=org.owasp.esapi.logging.log4j.Log4JLogFactory

# To use JUL, you need to obtain ESAPI's esapi-java-logging.properties and drop
# it somewhere into your class path. You can get it from the ESAPI configuration
# jar. (See Release 2.2.1.1 under GitHub for ESAPI/esapi-java-legacy.)
ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory

# To use the new SLF4J logger in ESAPI (see GitHub issue #129), set
#ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
# and do whatever other normal SLF4J configuration that you normally would do for your application.

# Note: The uncommented out ones are those needed for SLF4J. Others may be
# needed if you change the ESAPI logger.
#===========================================================================
# ESAPI Logging
# Set the application name if these logs are combined with other applications
Logger.ApplicationName=sql-service
# If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true
Logger.LogEncodingRequired=false
# Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments.
Logger.LogApplicationName=true
# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
Logger.LogServerIP=false
# LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you
# want to place it in a specific directory.
#Logger.LogFileName=ESAPI_logging_file
# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)
#Logger.MaxLogFileSize=10000000
# Determines whether ESAPI should log the user info.
Logger.UserInfo=false
# Determines whether ESAPI should log the session id and client IP
Logger.ClientInfo=false

Any Help would be appreciated.

Rocky4Ever
  • 828
  • 3
  • 12
  • 35
  • Before I attempt to answer, why are you using ESAPI's Encoder.encodeForSQL() here rather than just using PreparedStatement and bound parameterized types? That's the preferred way. The encodeForSQL() method is a last resort. See the javadoc at https://www.javadoc.io/doc/org.owasp.esapi/esapi/latest/org/owasp/esapi/Encoder.html#encodeForSQL-org.owasp.esapi.codecs.Codec-java.lang.String- – Kevin W. Wall Feb 20 '23 at 22:33
  • Also, assuming there's a reason way PreparedStatement won't work, in order for us to diagnose this, we will need the COMPLETE exception stack trace. There's likely to be a 'Caused by' that is missing and that contains important information that we're missing. E.g., it may be similar to this: https://stackoverflow.com/questions/68305702/esapi-getting-classnotfoundexception-with-esapi-2-2-3-1/68332784#68332784 – Kevin W. Wall Feb 20 '23 at 22:36

0 Answers0