Setting resource directory for ESAPI

Question

Working with OWASP's ESAPI, I found myself stuck at this particular line of code.

private static String customDirectory = System.getProperty("org.owasp.esapi.resources");

The code returns null as there is no such system property "org.owasp.esapi.resources" set on my computer. Is there any way to set this property on my computer permanently?

Answer 1

You need to pass it into your JVM as a command line property. Most application containers use the environment variable JAVA_OPTS as a "permanent" store of options that should be passed to the JVM. You can try to do something like this:

In *nix:

export JAVA_OPTS="-Dorg.owasp.esapi.resources=/path/to/esapi/configuration"

In windows:

set JAVA_OPTS="-Dorg.owasp.esapi.resources=C:\path\to\esapi\configuration"

You can add this to windows or linux as a startup command and it will always be set if you desire, or add it to your application's startup script for a more localized solution.

Answer 2

If you put the ESAPI.properties and Validation.properties inside the resources folder it will recognize automatically.

In case you need to specify s specific folder or sub-folders, one possibility is adding this property in your standalone.

<system-properties>
    <property name="org.owasp.esapi.resources" value="C:/.../resources/esapi"/>
<system-properties>

However, in unit tests, you have to specify before the tests.

@BeforeClass
public static void before() {    
   if(System.getProperty("org.owasp.esapi.resources") != null) {
      System.out.println(System.getProperty("org.owasp.esapi.resources"));
   } else  {
      System.setProperty("org.owasp.esapi.resources", "src/main/resources");
   }
}