157 lines
7.4 KiB
Properties
Executable File
157 lines
7.4 KiB
Properties
Executable File
#
|
|
# Copyright © 2005 - 2018 TIBCO Software Inc.
|
|
# http://www.jaspersoft.com.
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
# OWASP ESAPI RegEx Whitelist Patterns
|
|
Validator.SafeString=^[.\\p{Alnum}\\p{Space}]{0,1024}$
|
|
Validator.Email=^[\\p{L}\\p{M}\\p{N}._%'-]+@[\\p{L}\\p{M}\\p{N}.-]+$
|
|
Validator.IPAddress=^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
|
|
Validator.URL=^(ht|f)tp(s?)\\:\\/\\/[0-9a-zA-Z]([-.\\w]*[0-9a-zA-Z])*(:(0-9)*)*(\\/?)([a-zA-Z0-9\\-\\.\\?\\,\\:\\'\\/\\\\\\+=&%\\$#_]*)?$
|
|
Validator.CreditCard=^(\\d{4}[- ]?){3}\\d{4}$
|
|
Validator.SSN=^(?!000)([0-6]\\d{2}|7([0-6]\\d|7[012]))([ -]?)(?!00)\\d\\d\\3(?!0000)\\d{4}$
|
|
|
|
# Jaspersoft RegEx Whitelist Patterns
|
|
Validator.Alpha=^[\\p{L}\\p{M}]*$
|
|
Validator.AlphaDot=^[\\p{L}\\p{M}\\.]*$
|
|
Validator.AlphaNumDot=^[\\p{L}\\p{M}\\p{N}\\.]*$
|
|
Validator.AlphaDotUnderscore=^[\\p{L}\\p{M}_\\.]*$
|
|
Validator.AlphaNumDotUnderscore=^[\\p{L}\\p{M}\\p{N}_\\.]*$
|
|
Validator.AlphaNum=^[\\-]{0,1}[\\p{L}\\p{M}\\p{N}]*$
|
|
Validator.AlphaNumSpace=^[\\p{L}\\p{M}\\p{N}(\\s|%20)]*$
|
|
Validator.AlphaNumUnderscore=^[\\p{L}\\p{M}\\p{N}\\p{Pc}]*$
|
|
Validator.AlphaNumUnderscoreEtc=^[\\p{L}\\p{M}\\p{N}%_\\|\\.\\/\\-\\?\\=\\&\\s\\*\\@\\(\\)\\,\\;:\\~\\'\\"\\[\\]]*$
|
|
|
|
# p{L} = allow letters any language
|
|
# p{M} = allow marks (accents, umlauts, etc)
|
|
# p{L}p{M} = allow code point letter+mark
|
|
# p{N} = any numeric
|
|
# p{P} = all punctuation symbols (not recommended)
|
|
# p{Pd} = punctuation hyphen or dash
|
|
# p{Pi} and p{Pf} = quote marks
|
|
# p{Pc} = punctuation connectors such as underscore
|
|
# p{Po} = punctuation other, not dash, bracket, quote, connector
|
|
# p{Sc} = currency symbols
|
|
|
|
# This rule allows most chars, and should prevent < and >
|
|
Validator.AlphaNumPunctuation=^[\\u0080\\u0099\\u2019\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pi}\\p{Pf}\\p{Pc}\\p{Po}\\p{Sc}\\p{So}\\p{Sm}\\p{Cf}\\p{Z}\\s\\=\\(\\)\\[\\]\\~\\|\\{\\}\\`\\^\\+&&[^<>]]*$
|
|
|
|
# This rule allows almost every char. Not recommended.
|
|
Validator.AlphaNumPunctuationBrackets=^[\\p{L}\\p{M}\\p{N}\\p{P}\\p{S}\\p{Cf}\\p{Cc}\\p{Z}\\s]*$
|
|
|
|
# This rule allows almost every char, including angle brackets, but not parentheses. Use for xml input. Not recommended.
|
|
Validator.AlphaNumPunctuationBracketsNoParen=^[\\p{L}\\p{M}\\p{N}\\p{P}\\p{S}\\p{Cf}\\p{Cc}\\p{Z}\\s&&[^\\(\\)]]*$
|
|
|
|
Validator.AlphaUnderscore=^[\\p{L}\\p{M}\\p{Pc}]*$
|
|
Validator.AlphaUnderscoreForward=^[\\p{L}\\p{M}\\p{Pc}\\/]*$
|
|
Validator.AlphaUnderscoreDash=^[\\p{L}\\p{M}\\p{Pd}\\p{Pc}]*$
|
|
|
|
# Not recommended to use Numeric. Use AlphaNum instead since it is possible to receive undefined, Null, or NaN from client
|
|
Validator.Numeric=^[\\-]{0,1}[\\p{N}\\.]*$
|
|
Validator.NumUnderscore=^[\\-]{0,1}[\\p{N}_]*$
|
|
|
|
# Valid username value allows alphanumeric, dash, underscore, at sign, backslash, dot, etc
|
|
# Validator.UsernameValue =^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pi}\\p{Pf}\\p{Pc}\\p{Po}\\~\\|]+$
|
|
# Use blacklist from applicationContext.xml configurationBean.userNameNotSupportedSymbols
|
|
Validator.UsernameValue=^[^\\s`"'~!#$%^&,*+=;:?<>}{)(\\]\\[/]*$
|
|
Validator.Timezone=^[\\p{L}\\p{N}_\\-\\/\\:\\+\\p{Z}]*$
|
|
|
|
# Allow 0 or more characters, except for the space character
|
|
Validator.AllOkNotSpace=^[^\\s]*$
|
|
|
|
# spring flow is english only so this is ok
|
|
Validator.FlowExecKey=^e[1-9][0-9]*s[1-9][0-9]*$
|
|
|
|
Validator.URLNoProtocol=^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\p{Po}\\p{Pi}\\p{Pf}\\:\\/\\%\\.\\s]*$
|
|
|
|
# similar to AlphaNumPunctuation, and add space explicitly
|
|
Validator.PathWithSpace=^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\p{Po}\\p{Pi}\\p{Pf}\\s\\=\\:\\/\\%\\.\\~\\|$]*$
|
|
|
|
# same as PathWithSpace add comma explicitly. can be used to check comma separated elements of type PathWithSpace
|
|
Validator.PathWithComma=^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\p{Po}\\p{Pi}\\p{Pf}\\s\\=\\:\\/\\%\\.\\~\\|\\,$]+$
|
|
|
|
# app specific regex for the src parameter
|
|
Validator.Source=^(\\/)[\\p{L}\\p{M}\\p{N}]+\\.html[(%3F)\\w(%3D)]+
|
|
|
|
# a filename can be alpha, numeric, dash, or underscore
|
|
# followed by dot
|
|
# followed by alpha only 2-4 chars, no more, no less
|
|
Validator.Filename=^[\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}]+\\.[\\p{L}]{2,4}$
|
|
|
|
# any file extension
|
|
Validator.FileExt=[\\p{L}]{2,4}$
|
|
|
|
# use to validate file path + file name
|
|
# allows forward slash, letters, letter+mark, numbers, dash, connectors such as underscore, and dot
|
|
Validator.Resource=^[\\/\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\.()\\s]+$
|
|
# Validator.Resource=^[\\/\\p{L}\\p{M}\\p{N}\\p{Pd}\\p{Pc}\\.]+$
|
|
|
|
# specific to flowParams
|
|
# pattern cannot be generalized at this point
|
|
Validator.FlowParams=^[\\w]?\\w(?=).*$
|
|
|
|
Validator.Script=(?is)^.*<\\s*(\\S+)\\s*.*>.*<\\s*/\\s*\\1\\s*>.*$
|
|
Validator.ScriptLiteral=(?is)^.*<\\s*(script)\\s*.*>.*$
|
|
Validator.DoubleDash=(?s)^.*--.*$
|
|
Validator.SQLComment=(?s)(^.*--.*$)|(^.*/\\*.+\\*/.*$)
|
|
|
|
# true or false or yes or no, case insensitive
|
|
Validator.Boolean=^((?i)true|(?i)false|(?i)yes|(?i)no|(?i)~NOTHING~)$
|
|
|
|
# app specific date format used in View | Repository | Schedule
|
|
# example: 2011-09-14
|
|
Validator.Date=\\d{4}-\\d{2}-\\d{2}
|
|
Validator.DateNoFormat=^[\\p{N}\\p{Pd}\\p{Po}\\s\\p{L}\\p{M}]+$
|
|
# example: 2011-09-14 17:53
|
|
Validator.DateTime=\\d{4}-\\d{2}-\\d{2}\\s\\d{1,2}:\\d{2}
|
|
|
|
# app specific
|
|
# Example: datasources=['/public/audit/datasources/AuditDataSource']
|
|
Validator.Datasources=^\\[\\'[\\/\\w]+\\'\\]$
|
|
|
|
# do not use
|
|
# Prevent the words 'update ', 'insert ', or 'delete ' (notice ending space) from being in a query string
|
|
# use string.toLowerCase() to make sure case matches
|
|
# hacker could use DeLeTe or upDAte, so toLowerCase forces the case on all characters in the string.
|
|
Validator.ValidSQLNotUpdateInsertDelete=^((?!update |insert |delete ).)*$
|
|
|
|
# starts with 'select', does not contain ';'
|
|
# Do not allow INTO anywhere in the query.
|
|
# "select ... into" is dangerous because one can do
|
|
# select * INTO Table in 'Another.mdb' FROM Customers;
|
|
Validator.ValidSQL=(?is)^\\s*(select|call)\\b((?!\\binto\\b)[^;])*;?\\s*$
|
|
|
|
# ========================================================
|
|
# WARNING! Do NOT use these AnyChar rules unless you have to!
|
|
# allow any character except newline
|
|
Validator.AnyChar=^.*$
|
|
# allow any character including newline
|
|
Validator.AnyCharIncludingNewline=[\\s\\S]*
|
|
# ========================================================
|
|
|
|
Validator.EmailAddresses=^[\\p{L}\\p{M}\\p{N}._%'-\\@\\,\\;\\s]+$
|
|
|
|
# ie7 quirk posts span tags along with the actual button value
|
|
# use this when running into this quirk. this regex does not to allow a dot
|
|
# or parenthesis (eg, document.cookie or alert(1) will not pass)
|
|
Validator.ButtonValue=^[\\p{L}\\p{M}\\<\\>\\s\\&\\/\\=\\-\\;]*$
|
|
|
|
# input controls uses ~NOTHING~ as the value to post when the user
|
|
# de-selects the standard options from the list
|
|
Validator.DropdownValue=^[\\p{L}\\p{M}\\p{N}\\~\\s\\[\\]\\&\\'\\`\\,\\-\\/]*$
|
|
|
|
Validator.ReportUnitName=^[\\p{L}\\p{M}\\p{N}\\p{P}\\p{S}\\p{Cf}\\p{Cc}\\p{Z}\\s&&[^<>;/{]]*$
|
|
Validator.DashboardViewer=^[\\p{L}\\p{M}\\p{N}\\p{P}\\p{S}\\p{Cf}\\p{Cc}\\p{Z}\\s&&[^\\(\\)<>;/{]]*$ |