Skip to Content

ESAPI Issues

Posted on

On my latest project I’m trying to make use of the [ESAPI](https://www.owasp.org/index.php/--- categories:OWASP_Enterprise_Security_API) (The OWASP Enterprise Security API) library which is built into the latest versions of ColdFusion (9.01 and 10).

I was originally trying to sanitize some form inputs with the ESAPI encoders. (The uform:option is used in cfUniform which I’ll be blogging more about soon).

<uform:option display="#rc.esapi.encodeForHTMLAttribute(category.getCategoryName())#" value="rc.esapi.encodeForHTMLAttribute(category.getCategoryID())#"/>

But this failed with an error:

Either there are no methods with the specified method name and argument types or the encodeForHTMLAttribute method is overloaded with argument types that ColdFusion cannot decipher reliably. ColdFusion found 0 methods that match the provided arguments. If this is a Java object and you verified that the method exists, use the javacast function to reduce ambiguity.

I originally thought maybe something was going on under the hood with cfUniform so I simplied my code and still got an error:

:::cfm
<cfloop array="#rc.sections#" index="section">
#rc.esapi.encodeForHTML( section.getSectionID() )#
,#rc.esapi.encodeForHTML( section.getSectionName() )#<br>
</cfloop>

But this worked fine:

:::cfm
<cfloop array="#rc.sections#" index="section">
#rc.esapi.encodeForHTML( 1 )#
,#rc.esapi.encodeForHTML( section.getSectionName() )#<br>
</cfloop>

Hmmmm…

I pinged Jason Dean (security guru) who came up with the solution:

:::cfm
rc.esapi.encodeForHTML( javaCast("string", section.getSectionID()) )#

It appears the encodeForHTML() method (and I assume the other encoder methods) is expecting a string!