Package org.owasp.esapi.errors
Class EnterpriseSecurityException
- java.lang.Object
-
- java.lang.Throwable
-
- java.lang.Exception
-
- org.owasp.esapi.errors.EnterpriseSecurityException
-
- All Implemented Interfaces:
java.io.Serializable
- Direct Known Subclasses:
AccessControlException
,AuthenticationException
,AvailabilityException
,CertificateException
,ConfigurationException
,EncodingException
,EncryptionException
,ExecutorException
,IntegrityException
,ValidationException
public class EnterpriseSecurityException extends java.lang.Exception
EnterpriseSecurityException is the base class for all security related exceptions. You should pass in the root cause exception where possible. Constructors for classes extending EnterpriseSecurityException should be sure to call the appropriate super() method in order to ensure that logging and intrusion detection occur properly.All EnterpriseSecurityExceptions have two messages, one for the user and one for the log file. This way, a message can be shown to the user that doesn't contain sensitive information or unnecessary implementation details. Meanwhile, all the critical information can be included in the exception so that it gets logged.
Note that the "logMessage" for ALL EnterpriseSecurityExceptions is logged in the log file. This feature should be used extensively throughout ESAPI implementations and the result is a fairly complete set of security log records. ALL EnterpriseSecurityExceptions are also sent to the IntrusionDetector for use in detecting anomalous patterns of application usage.
- Author:
- Jeff Williams (jeff.williams@aspectsecurity.com)
- See Also:
- Serialized Form
-
-
Field Summary
Fields Modifier and Type Field Description protected Logger
logger
The logger.protected java.lang.String
logMessage
protected static long
serialVersionUID
-
Constructor Summary
Constructors Modifier Constructor Description protected
EnterpriseSecurityException()
Instantiates a new security exception.EnterpriseSecurityException(java.lang.String userMessage, java.lang.String logMessage)
Creates a new instance of EnterpriseSecurityException.EnterpriseSecurityException(java.lang.String userMessage, java.lang.String logMessage, java.lang.Throwable cause)
Creates a new instance of EnterpriseSecurityException that includes a root cause Throwable.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description java.lang.String
getLogMessage()
Returns a message that is safe to display in logs, but may contain sensitive information and therefore probably should not be displayed to users.java.lang.String
getUserMessage()
Returns message meant for display to users Note that if you are unsure of what set this message, it would probably be a good idea to encode this message before displaying it to the end user.
-
-
-
Field Detail
-
serialVersionUID
protected static final long serialVersionUID
- See Also:
- Constant Field Values
-
logger
protected final transient Logger logger
The logger.
-
logMessage
protected java.lang.String logMessage
-
-
Constructor Detail
-
EnterpriseSecurityException
protected EnterpriseSecurityException()
Instantiates a new security exception.
-
EnterpriseSecurityException
public EnterpriseSecurityException(java.lang.String userMessage, java.lang.String logMessage)
Creates a new instance of EnterpriseSecurityException. This exception is automatically logged, so that simply by using this API, applications will generate an extensive security log. In addition, this exception is automatically registered with the IntrusionDetector, so that quotas can be checked. It should be noted that messages that are intended to be displayed to the user should be safe for display. In other words, don't pass in unsanitized data here. Also could hold true for the logging message depending on the context of the exception.- Parameters:
userMessage
- the message displayed to the userlogMessage
- the message logged
-
EnterpriseSecurityException
public EnterpriseSecurityException(java.lang.String userMessage, java.lang.String logMessage, java.lang.Throwable cause)
Creates a new instance of EnterpriseSecurityException that includes a root cause Throwable. It should be noted that messages that are intended to be displayed to the user should be safe for display. In other words, don't pass in unsanitized data here. Also could hold true for the logging message depending on the context of the exception.- Parameters:
userMessage
- the message displayed to the userlogMessage
- the message loggedcause
- the cause
-
-
Method Detail
-
getUserMessage
public java.lang.String getUserMessage()
Returns message meant for display to users Note that if you are unsure of what set this message, it would probably be a good idea to encode this message before displaying it to the end user.- Returns:
- a String containing a message that is safe to display to users
-
getLogMessage
public java.lang.String getLogMessage()
Returns a message that is safe to display in logs, but may contain sensitive information and therefore probably should not be displayed to users.- Returns:
- a String containing a message that is safe to display in logs, but probably not to users as it may contain sensitive information.
-
-