Package org.wso2.carbon.ui

Class CsrfJavaScriptServletProxy

java.lang.Object
javax.servlet.GenericServlet
javax.servlet.http.HttpServlet
org.wso2.carbon.ui.CsrfJavaScriptServletProxy
All Implemented Interfaces:
Serializable, javax.servlet.Servlet, javax.servlet.ServletConfig
public class CsrfJavaScriptServletProxy extends javax.servlet.http.HttpServlet
Proxy servlet for the OWASP CSRFGuard JavaScriptServlet.

The third-party JavaScriptServlet overrides init(ServletConfig) without calling super.init(config), so GenericServlet.getServletConfig() returns null. Equinox's HttpServletRequestWrapperImpl.getSession() calls registeredServlet.getServletConfig().getServletContext() on the servlet registered with the OSGi HTTP Whiteboard — resulting in a NullPointerException on every request to the CSRF JS endpoint.

This proxy is registered with OSGi instead. It correctly calls super.init(config), so getServletConfig() is never null from Equinox's perspective. It then calls delegate.init(config) which sets the static servletConfig field inside JavaScriptServlet needed for its own logic (e.g. resolving context-path init params). All requests are forwarded to the delegate unchanged.

See Also:

  • Constructor Summary

    Constructors
    Constructor
    Description
    CsrfJavaScriptServletProxy(javax.servlet.http.HttpServlet delegate)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    destroy()
     
    void
    init(javax.servlet.ServletConfig config)
     
    protected void
    service(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
     

    Methods inherited from class javax.servlet.http.HttpServlet

    doDelete, doGet, doHead, doOptions, doPost, doPut, doTrace, getLastModified, service

    Methods inherited from class javax.servlet.GenericServlet

    getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, init, log, log

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • CsrfJavaScriptServletProxy

      public CsrfJavaScriptServletProxy(javax.servlet.http.HttpServlet delegate)

  • Method Details

    • init

      public void init(javax.servlet.ServletConfig config) throws javax.servlet.ServletException
      Specified by:
      init in interface javax.servlet.Servlet
      Overrides:
      init in class javax.servlet.GenericServlet
      Throws:
      javax.servlet.ServletException

    • service

      protected void service(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws javax.servlet.ServletException, IOException
      Overrides:
      service in class javax.servlet.http.HttpServlet
      Throws:
      javax.servlet.ServletException
      IOException

    • destroy

      public void destroy()
      Specified by:
      destroy in interface javax.servlet.Servlet
      Overrides:
      destroy in class javax.servlet.GenericServlet