I have this line of code in my project :
try {
ESAPI.initialize("org.owasp.esapi.reference.DefaultSecurityConfiguration");
value = ESAPIENCODER.canonicalize(value);
} catch (Throwable e) {
LOG.warn("Invalid parameter value, setting to empty. Value: " + value, e);
value = "";
}
I get the following error:
ERROR [IntrusionException] [SECURITY FAILURE Anonymous:null#unknown ->
/ExampleApplication/IntrusionException] INTRUSION - Multiple (2x)
encoding detected in
http://www.google.co.jp/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwjwscD6ifjbAhVOgK0KHT_DAYsQFggxMAE&url=http%3A%2F%2Fwww.nequipment.eu%2Fassets%2Fimported%2Ftransformations%2Fcontent%2Fproduct-details%2F%257Blanguage%257D_Brochure%2FC061657EB4C64903B6BEB38FBAC03445%2FDX140LC-3_AS8-3_EN.pdf&usg=AOvVaw2923Vp0vsPQHvZ7gDbPFGs
2018-06-29 00:29:31,559 WARN [com.xxxxx.framework.utils.XSSUtil]
Invalid parameter value, setting to empty. Value:
http://www.google.co.jp/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwjwscD6ifjbAhVOgK0KHT_DAYsQFggxMAE&url=http%3A%2F%2Fwww.nequipment.eu%2Fassets%2Fimported%2Ftransformations%2Fcontent%2Fproduct-details%2F%257Blanguage%257D_Brochure%2FC061657EB4C64903B6BEB38FBAC03445%2F140LC-3_X160LC-3_EN.pdf&usg=AOvVaw2923Vp0vsPQHvZ7gDbPFGs
org.owasp.esapi.errors.IntrusionException: Input validation failure
at
org.owasp.esapi.reference.DefaultEncoder.canonicalize(DefaultEncoder.java:181)
at
org.owasp.esapi.reference.DefaultEncoder.canonicalize(DefaultEncoder.java:122)
What does the warning mean and how can I get rid of it?
Related
The contract function is
function _removeFlag(address sender) internal {
//remove if in record
if (mapping1[sender] > 0) {
mapping1[sender] = 0;
}
}
when my test case running into this function , show an error like:
truffle>: truffle test
Error: Returned error: VM Exception while processing transaction: out of gas
If I set it with mapping1[sender] = 1; the error disappears.
Version information:
Truffle v5.4.0 (core: 5.4.0)
Solidity v0.5.16 (solc-js)
Node v16.4.2
Web3.js v1.4.0
First check your account balance : balance = web3.eth.getBalance(someAddress); then try to specify the gaslimit contractInstance.createProposal("ADHD", "Foo", 2, {from: web3.eth.accounts[1], gas:3000000})
I have a C++ code that parses incoming json message using rapidjson.
The json message received contains one key:value pair ("userID": 100), where the value is an integer.
However, if the value is sent as a string '100', rapidjson crashed the whole program with the following error:
Invalid response: { "error": "ERR_RATE_LIMIT"}
trading: ../../include/rapidjson/document.h:1737: int rapidjson::GenericValue<Encoding, Allocator>::GetInt() const [with Encoding = rapidjson::UTF8<>; Allocator = rapidjson::MemoryPoolAllocator<>]: Assertion `data_.f.flags & kIntFlag' failed.
/home/ray/dev/trading_execution/src/trading/trading.run.sh: line 39: 2518 Aborted (core dumped) ./trading 1234
I would expect rapidjson can handle this more gently than crashing the program.
Any suggestion how to deal with this situation? For example, is there a better way to handle the error?
Json message:
{
"ctRequestId": "cfa5511f-8c1a-492b-b81a-1462d03bbe99",
"requestType": "generic",
"userID": 100,
}
Code:
userID = getJSONInt(document, "userID");
int getJSONInt(rapidjson::Document& document, const char* memberName)
{
int memberValue;
try
{
if (document.HasMember(memberName))
memberValue = document[memberName].GetInt();
}
catch(const std::exception& e)
{
std::cerr << e.what() << '\n';
}
return memberValue;
}
No expert of rapidjson, but according to the documentation (http://rapidjson.org/md_doc_tutorial.html)
Note that, RapidJSON does not automatically convert values between JSON types. If a value is a string, it is invalid to call GetInt(), for example. In debug mode it will fail an assertion. In release mode, the behavior is undefined.
In the following sections we discuss details about querying individual types.
If you look in the table in the section "Querying Number" of the linked document you can find some member function you can use to test the type before extracting it. In your case you might want to try IsInt()
Edit: for the particular use case IsUint/GetUint may be more appropriate as pointed out in the comments
Try this:
{
...,
...,
"UserId" : "100" // note double quotes for 100
}
And if the value of "UserId" is string, then query it using GetString() query and not GetInt() to pass assertion test.
I'm trying to insert this formula
=IF(Datenbasis!B3<0;((Datenbasis!K3-Datenbasis!B3)/ABS(Datenbasis!B3))^(1/9)-1;(Datenbasis!$K$3/Datenbasis!$B$3)^(1/9)-1)
into this samplefile1 with this code:
// ....
try
{
$inputFileType = PHPExcel_IOFactory::identify("phpexceltest.xls");
$objReader = PHPExcel_IOFactory::createReader($inputFileType);
$objPHPExcel = $objReader->load("phpexceltest.xls");
}
catch(Exception $e)
{
$_loadingerror = TRUE;
}
if ($_loadingerror === TRUE)
{
// Fehler beim Laden der Vorlagen-Datei!
die("Fehler!");
}
$objPHPExcel->setActiveSheetIndex("0");
// ....
$objPHPExcel->getActiveSheet()->setCellValue("J4", "=IF(Datenbasis!B3<0;((Datenbasis!K3-Datenbasis!B3)/ABS(Datenbasis!B3))^(1/9)-1;(Datenbasis!$" . "K$3/Datenbasis!$" . "B$3)^(1/9)-1)");
// ....
$objWriter = PHPExcel_IOFactory::createWriter($objPHPExcel, 'Excel5');
$objWriter->save("ready.xls");
I get this error
Fatal error: Uncaught exception 'Exception' with message 'Results!J4 -> undefined variable ';'' in ...\PHPExcel\Cell.php:288 Stack trace: #0 ...\PHPExcel\Writer\Excel5\Worksheet.php(441): PHPExcel_Cell->getCalculatedValue() #1 ...\PHPExcel\Writer\Excel5.php(171): PHPExcel_Writer_Excel5_Worksheet->close() #2 phpexceltest.php(446): PHPExcel_Writer_Excel5->save('ready.xls') #3 {main} thrown in ...\PHPExcel\Cell.php on line 288
and I have no idea why. When I use this formula in Excel directly, it's working.
Any ideas, what to do?
Rules for writing formulae in PHPExcel (as described in the documentation)
Decimal separator is '.' (period)
Function argument separator is ',' (comma)
Matrix row separator is ';' (semicolon)
English function names must be used
unless you've explicitly set a locale for the calculation engine
You're using a semi-colon (';') as a function argument separator
I wanted to make a general function that would search for a class type in a node and returns its address. It is defined below
SoNode* searchandgive(SoType searchtype, SoNode* searchnode)
{
SoSearchAction mysearch;
mysearch.setType(searchtype);
mysearch.setInterest(SoSearchAction::FIRST);
mysearch.apply(searchnode);
if (mysearch.getPath() == NULL) {
std::cout<<"No property of this type was found";
}
SoPath* mypath=mysearch.getPath();
return mypath->getTail();
}
But when I pass a search type like SoCoordinate3::getClassTypeId() and the node to be searched for senode as given below:
SoCoordinate3 * mycoords=(SoCoordinate3*) searchandgive(SoCoordinate3::getClassTypeId(),senode);
const SbVec3f *s=mycoords->point.getValues(0);
std::cout<<" " <<s->getValue()[25]; // Some point
But the last line is generating a Unhandled Exception Error. Please tell what am I doing wrong here. The last line is valid since the same written inside the scope of the function works but not here.
With this you are standing that mysearch.getPath() could be null:
if (mysearch.getPath() == NULL) {
std::cout<<"No property of this type was found";
}
but below you are using that without any check:
SoPath* mypath=mysearch.getPath();
return mypath->getTail();
so this can raise an Unhandled Exception.
Another poitn is the line:
std::cout<<" " <<s->getValue()[25]; // Some point
There is no check about how many points are in the vector, and this as well could cause an exception.
try {
// some error
} catch (any e) {
e.extendedInfo = 'New extended info';
//throw(e);
//cfcatch.extendedInfo = 'New extended info';
rethrow;
}
When I (re)catch this exception the extendedInfo is not displayed. What I want to happen is the raised exception keeps all of its pre-catch properties including the original tagContext and line numbers etc but gets a new value for extendedInfo.
I've tried copying the attributes of e into a new attributeCollection and throwing that with throw(e) or <cfthrow attributeCollection="#e#" /> but then the context is changed and the error displays the wrong line of source code.
While I'm at it is there a way to to drop the topmost stack object so an exception appears to have been thrown from the calling context. ie:
function myRethrow(e) (
throw(e); // <!-- error is actually throw here BUT ...
)
myRethrow(e); // <-- error should appear to have 'happened' here
Using Railo 3.2
I think you can use throw function like this:
try {
try {
// some error
}
catch (any e) {
e.extendedInfo = 'New extended info';
throw(argumentCollection = e);
}
}
catch (any e) {
WriteDump(e);
}
Works for me.