当与Oracle JDBC一起使用时,我使用ESAPI对字符串进行编码。即使我的项目中有ESAPI.财产,我也会出现以下错误。
final var queryString = String.format("SELECT * FROM %1$s WHERE %2$s = '%3$s'", ESAPI.encoder().encodeForSQL(new OracleCodec(),tableName), ESAPI.encoder().encodeForSQL(new OracleCodec(),columnName), ESAPI.encoder().encodeForSQL(new OracleCodec(),columnValue)); Caused by: java.lang.ClassNotFoundException: org.owasp.encoder.esapi.ESAPIEncoder at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641) at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188) at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:520) at java.base/java.lang.Class.forName0(Native Method) at java.base/java.lang.Class.forName(Class.java:375) at org.owasp.esapi.util.ObjFactory.loadClassByStringName(ObjFactory.java:158) at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:81) ... 108 common frames omitted
这是我的项目结构。
版本:
实现'org.owasp.esapi:esapi:2.2.1'
这是我的ESAPI.properties文件
# Properties based on ESAPI 2.2.1.1's configuration/esapi/ESAPI.properties file. ESAPI.Encoder=org.owasp.encoder.esapi.ESAPIEncoder # Log4JFactory Requires log4j.xml or log4j.properties in classpath - http://www.laliluna.de/log4j-tutorial.html # Note that this is now considered deprecated! #ESAPI.Logger=org.owasp.esapi.logging.log4j.Log4JLogFactory # To use JUL, you need to obtain ESAPI's esapi-java-logging.properties and drop # it somewhere into your class path. You can get it from the ESAPI configuration # jar. (See Release 2.2.1.1 under GitHub for ESAPI/esapi-java-legacy.) ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory # To use the new SLF4J logger in ESAPI (see GitHub issue #129), set #ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory # and do whatever other normal SLF4J configuration that you normally would do for your application. # Note: The uncommented out ones are those needed for SLF4J. Others may be # needed if you change the ESAPI logger. #=========================================================================== # ESAPI Logging # Set the application name if these logs are combined with other applications Logger.ApplicationName=sql-service # If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true Logger.LogEncodingRequired=false # Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments. Logger.LogApplicationName=true # Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments. Logger.LogServerIP=false # LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you # want to place it in a specific directory. #Logger.LogFileName=ESAPI_logging_file # MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000) #Logger.MaxLogFileSize=10000000 # Determines whether ESAPI should log the user info. Logger.UserInfo=false # Determines whether ESAPI should log the session id and client IP Logger.ClientInfo=false
如有任何帮助,将不胜感激。