Input Validation Error

Nelo Angelo
Ranch Hand

Joined: Jul 25, 2011
Posts: 44

I like...

posted

Hi there,

I was trying an input validation example taken from the OWASP ESAPI and I am getting the following error:

Error: Cannot make a static reference to the non-static method getValidInput(String, String, String, int, boolean) from the type Validator

Html:

Servlet

package com.example.web;

import java.io.IOException;
import java.io.PrintWriter;
import org.owasp.esapi.*;
import org.owasp.esapi.errors.ValidationException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class InputValidation extends HttpServlet {
private static final long serialVersionUID = 1L;
   
    public InputValidation() {
        super();
        // TODO Auto-generated constructor stub
    }

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		response.setContentType("text/html");
		PrintWriter out=response.getWriter();

try
		{
			 String zipCode=Validator.getValidInput("ChangeAddressPage_ZipCodeField", request.getParameter( "zip" ), "zipCodePattern", 10, false); //Error on this line 
			 out.print(zipCode);
				 
		}
		catch(ValidationException e)
		{
			response.sendError( response.SC_BAD_REQUEST, e.getMessage() );
		}
	}

}

Any suggestions?

I love java but she hates me... :'(

Seetharaman Venkatasamy
Bartender

Joined: Jan 28, 2008
Posts: 4503

I like...

posted

the error message states getValidInput method is not a static method. but you have made a static method call which is wrong!

Not everything that counts can be counted, and not everything that can be counted counts-Albert Einstein

Nelo Angelo
Ranch Hand

Joined: Jul 25, 2011
Posts: 44

I like...

posted

Hi,

Thanks for the reply. I made proper adjustments to the syntax and now I am getting the following exception:

type Exception report

description The server encountered an internal error () that prevented it from fulfilling this request.

exception

javax.servlet.ServletException: Servlet execution threw an exception

root cause

java.lang.NoClassDefFoundError: org/owasp/validator/html/PolicyException
com.example.web.InputValidation.doPost(InputValidation.java:44)

New Code:

Seetharaman Venkatasamy
Bartender

Joined: Jan 28, 2008
Posts: 4503

I like...

posted

http://docs.oracle.com/javase/7/docs/api/java/lang/NoClassDefFoundError.html

Kevin W. Wall
Greenhorn

Joined: Jan 29, 2012
Posts: 1

posted

Nelo Angelo wrote:Hi,

Thanks for the reply. I made proper adjustments to the syntax and now I am getting the following exception:

type Exception report

description The server encountered an internal error () that prevented it from fulfilling this request.

exception

javax.servlet.ServletException: Servlet execution threw an exception

root cause

java.lang.NoClassDefFoundError: org/owasp/validator/html/PolicyException
com.example.web.InputValidation.doPost(InputValidation.java:44)

New Code:

String zipCodePattern="^\\d{5}(-\\d{4})?$"; DefaultValidator d=new DefaultValidator(); boolean b=d.isValidInput("ChangeAddressPage_ZipCodeField", request.getParameter( "zip" ), zipCodePattern, 10, false);

First, rather than using

I would recommend using:

Secondly, what version of ESAPI are you using? The latest version (which I would highly recommend) is 2.0.1.
Lots of bug fixes in ESAPI 2.0.x. The reason I ask is that ESAPI 2.0 has no PolicyException. In fact, Validator.isValidInput() throws IntrusionException not PolicyException. (See
http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/Validator.html#isValidInput%28java.lang.String,%20java.lang.String,%20java.lang.String,%20int,%20boolean%29)

Thirdly, I'd recommend that you post ESAPI questions to the ESAPI-User mailing list if you have ESAPI specific questions. You can sign up for that mailing list at:
https://lists.owasp.org/mailman/listinfo/esapi-user

Hope this helps somewhat.
-kevin wall

Nelo Angelo
Ranch Hand

Joined: Jul 25, 2011
Posts: 44

I like...

posted

Kevin W. Wall wrote:

Nelo Angelo wrote:Hi,

Thanks for the reply. I made proper adjustments to the syntax and now I am getting the following exception:

type Exception report

description The server encountered an internal error () that prevented it from fulfilling this request.

exception

javax.servlet.ServletException: Servlet execution threw an exception

root cause

java.lang.NoClassDefFoundError: org/owasp/validator/html/PolicyException
com.example.web.InputValidation.doPost(InputValidation.java:44)

New Code:

String zipCodePattern="^\\d{5}(-\\d{4})?$"; DefaultValidator d=new DefaultValidator(); boolean b=d.isValidInput("ChangeAddressPage_ZipCodeField", request.getParameter( "zip" ), zipCodePattern, 10, false);

First, rather than using
DefaultValidator d = new DefaultValidator();

I would recommend using:
Validator d = ESAPI.validator(); ...

Secondly, what version of ESAPI are you using? The latest version (which I would highly recommend) is 2.0.1.
Lots of bug fixes in ESAPI 2.0.x. The reason I ask is that ESAPI 2.0 has no PolicyException. In fact, Validator.isValidInput() throws IntrusionException not PolicyException. (See
http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/Validator.html#isValidInput%28java.lang.String,%20java.lang.String,%20java.lang.String,%20int,%20boolean%29)

Thirdly, I'd recommend that you post ESAPI questions to the ESAPI-User mailing list if you have ESAPI specific questions. You can sign up for that mailing list at:
https://lists.owasp.org/mailman/listinfo/esapi-user

Hope this helps somewhat.
-kevin wall

Hi kevin, thanks for the reply. I ran the code with the changes you suggested but the same exception keeps appearing.
I am using ESAPI 1.4.4.

Also, when I run other projects that use ESAPI (SqlInjection prevention), it runs successfully, but produces the following warning:

Thanks for the info about their mailing list. I forwarded this issue to them and hope that this problem would be fixed soon.

subject: Input Validation Error

Threads others viewed
exception handling
jsp form validation using bean with int
Connecting to a database through servl
Http 500 and NumberFormatException
HTTP Status 404 - /HelloWorld

more from paul wheaton's glorious empire of web junk: cast iron skillet diatomaceous earth rocket mass heater sepp holzer raised garden beds raising chickens lawn care CFL flea control missoula heat permaculture