Skip to content

Remove csrfguard register from web.xml #4533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Zeta201 wants to merge 2 commits into
base: 4.12.x
Choose a base branch
from
Draft

Remove csrfguard register from web.xml #4533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
10a2711
Remove csrfguard register from web.xml
chamilaadhi Mar 10, 2026
26bc0d7
Fix invalid filter removal
chamilaadhi Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 73 additions & 0 deletions core/org.wso2.carbon.ui/src/main/java/org/wso2/carbon/ui/CsrfJavaScriptServletProxy.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
/*
* Copyright (c) 2026, WSO2 LLC. (http://www.wso2.com).
*
* WSO2 LLC. licenses this file to you under the Apache License,
* Version 2.0 (the "License"); you may not use this file except
* in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.wso2.carbon.ui;

import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
* Proxy servlet for the OWASP CSRFGuard JavaScriptServlet.
*
* <p>The third-party {@code JavaScriptServlet} overrides {@code init(ServletConfig)} without
* calling {@code super.init(config)}, so {@code GenericServlet.getServletConfig()} returns null.
* Equinox's {@code HttpServletRequestWrapperImpl.getSession()} calls
* {@code registeredServlet.getServletConfig().getServletContext()} on the servlet registered with
* the OSGi HTTP Whiteboard — resulting in a NullPointerException on every request to the CSRF JS
* endpoint.</p>
*
* <p>This proxy is registered with OSGi instead. It correctly calls {@code super.init(config)},
* so {@code getServletConfig()} is never null from Equinox's perspective. It then calls
* {@code delegate.init(config)} which sets the static {@code servletConfig} field inside
* {@code JavaScriptServlet} needed for its own logic (e.g. resolving context-path init params).
* All requests are forwarded to the delegate unchanged.</p>
*/
public class CsrfJavaScriptServletProxy extends HttpServlet {

private static final long serialVersionUID = 1L;

private final HttpServlet delegate;

public CsrfJavaScriptServletProxy(HttpServlet delegate) {
this.delegate = delegate;
}

@Override
public void init(ServletConfig config) throws ServletException {
// Must call super.init() so GenericServlet stores the config in its instance field.
// Equinox's HttpServletRequestWrapperImpl resolves the session via
// getServletConfig().getServletContext() on this (the registered) servlet.
super.init(config);
// Also initialise the delegate so it sets its static servletConfig field.
Comment on lines +52 to +59

@ghost ghost Mar 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 1

Suggested change
@Override
public void init(ServletConfig config) throws ServletException {
// Must call super.init() so GenericServlet stores the config in its instance field.
// Equinox's HttpServletRequestWrapperImpl resolves the session via
// getServletConfig().getServletContext() on this (the registered) servlet.
super.init(config);
// Also initialise the delegate so it sets its static servletConfig field.
@Override
public void init(ServletConfig config) throws ServletException {
log.info("Initializing CsrfJavaScriptServletProxy");
// Must call super.init() so GenericServlet stores the config in its instance field.
// Equinox's HttpServletRequestWrapperImpl resolves the session via
// getServletConfig().getServletContext() on this (the registered) servlet.
super.init(config);

delegate.init(config);
}

@Override
protected void service(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
delegate.service(request, response);
Comment on lines +62 to +66

@ghost ghost Mar 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 2

Suggested change
@Override
protected void service(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
delegate.service(request, response);
@Override
protected void service(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
if (log.isDebugEnabled()) {
log.debug("Forwarding CSRF JavaScript request to delegate servlet");
}
delegate.service(request, response);

}

@Override
public void destroy() {
delegate.destroy();
}
}
34 changes: 29 additions & 5 deletions ...rg.wso2.carbon.ui/src/main/java/org/wso2/carbon/ui/internal/CarbonUIServiceComponent.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@
import org.wso2.carbon.ui.CarbonUIAuthenticator;
import org.wso2.carbon.ui.CarbonUIUtil;
import org.wso2.carbon.ui.DefaultCarbonAuthenticator;
import org.wso2.carbon.ui.CsrfJavaScriptServletProxy;
import org.wso2.carbon.ui.TenantAwareCsrfJsFilter;
import org.wso2.carbon.ui.TextJavascriptHandler;
import org.wso2.carbon.ui.TilesJspServlet;
Expand Down Expand Up @@ -84,6 +85,8 @@
import javax.servlet.Servlet;
import javax.servlet.ServletContextListener;
import javax.servlet.Filter;
import javax.servlet.http.HttpServlet;

@Component(name = "core.ui.dscomponent", immediate = true)
public class CarbonUIServiceComponent {

Expand Down Expand Up @@ -318,7 +321,12 @@ public void start(BundleContext context) throws Exception {

// Register CSRFGuard listeners and filter using HTTP Whiteboard pattern
try {
// Register CsrfGuardHttpSessionListener - generates per-session CSRF tokens
// Register CsrfGuardHttpSessionListener - generates per-session CSRF tokens.
// Must be registered via OSGi (not web.xml) so that the token is stored in the
// HttpSessionAdaptor-wrapped (namespaced) session. JSP tags and CsrfGuardFilter
// both access the session through the Equinox-wrapped request, so the token must
// be at the namespaced key. The Tomcat-level CsrfGuardFilter in web.xml has been
// removed to avoid a dual-session token conflict.
Class<?> sessionListenerClass = Class.forName("org.owasp.csrfguard.CsrfGuardHttpSessionListener");
Object sessionListener = sessionListenerClass.newInstance();

Expand All @@ -333,15 +341,31 @@ public void start(BundleContext context) throws Exception {
Class<?> csrfGuardFilterClass = Class.forName("org.owasp.csrfguard.CsrfGuardFilter");
Filter csrfGuardFilter = (Filter) csrfGuardFilterClass.newInstance();

Dictionary<String, String> csrfFilterProps = new Hashtable<>();
csrfFilterProps.put(HttpWhiteboardConstants.HTTP_WHITEBOARD_FILTER_PATTERN, "/carbon/*");
Dictionary<String, Object> csrfFilterProps = new Hashtable<>();
csrfFilterProps.put(HttpWhiteboardConstants.HTTP_WHITEBOARD_FILTER_PATTERN, "/*");
csrfFilterProps.put("osgi.http.whiteboard.context.select", "(osgi.http.whiteboard.context.name=carbonContext)");
csrfFilterProps.put(HttpWhiteboardConstants.HTTP_WHITEBOARD_FILTER_NAME, "CsrfGuardFilter");
csrfFilterProps.put("service.ranking", "100");
csrfFilterProps.put(Constants.SERVICE_RANKING, Integer.valueOf(100));

context.registerService(Filter.class, csrfGuardFilter, csrfFilterProps);

@ghost ghost Mar 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 3

Suggested change
context.registerService(Filter.class, csrfGuardFilter, csrfFilterProps);
context.registerService(Filter.class, csrfGuardFilter, csrfFilterProps);
log.info("CSRF Guard filter registered successfully for pattern: /*");


// Register TenantAwareCsrfJsFilter filter.
// Register JavaScriptServlet directly as an OSGi HTTP Whiteboard servlet for the
// super-tenant path. This ensures the token is read from the Equinox-namespaced
// (adapted) session, consistent with how CsrfGuardHttpSessionListener stores it.
Class<?> jsServletClass = Class.forName("org.owasp.csrfguard.servlet.JavaScriptServlet");
HttpServlet jsServlet = (HttpServlet) jsServletClass.newInstance();
// Wrap with CsrfJavaScriptServletProxy so that the OSGi-registered servlet calls
// super.init(config), ensuring getServletConfig() is never null in Equinox's
// HttpServletRequestWrapperImpl.getSession() without modifying the third-party library.
Servlet jsServletProxy = new CsrfJavaScriptServletProxy(jsServlet);
Dictionary<String, String> jsServletProps = new Hashtable<>();
jsServletProps.put(HttpWhiteboardConstants.HTTP_WHITEBOARD_SERVLET_PATTERN, "/carbon/admin/js/csrfPrevention.js");
jsServletProps.put(HttpWhiteboardConstants.HTTP_WHITEBOARD_SERVLET_NAME, "JavaScriptServlet");
jsServletProps.put("osgi.http.whiteboard.context.select", "(osgi.http.whiteboard.context.name=carbonContext)");
context.registerService(Servlet.class, jsServletProxy, jsServletProps);

// Register TenantAwareCsrfJsFilter for tenant paths only (/t/*).
// It rewrites contextPath/servletPath for tenant URLs and delegates to JavaScriptServlet.
Filter csrfJsFilterCarbon = new TenantAwareCsrfJsFilter();
Dictionary<String, Object> csrfJsFilterCarbonProps = new Hashtable<>();
csrfJsFilterCarbonProps.put(HttpWhiteboardConstants.HTTP_WHITEBOARD_FILTER_PATTERN, "/t/*");
Expand Down
27 changes: 0 additions & 27 deletions distribution/kernel/carbon-home/repository/conf/tomcat/carbon/WEB-INF/web.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,6 @@
<load-on-startup>1</load-on-startup>
</servlet>

<!-- OWASP CSRFGuard servlet that serves dynamic token injection JavaScript-->
<servlet>
<servlet-name>JavaScriptServlet</servlet-name>
<servlet-class>org.owasp.csrfguard.servlet.JavaScriptServlet</servlet-class>
</servlet>

<servlet-mapping>
<servlet-name>bridgeservlet</servlet-name>
<url-pattern>/*</url-pattern>
Expand All @@ -54,11 +48,6 @@
<url-pattern>*.jsp</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>JavaScriptServlet</servlet-name>
<url-pattern>/carbon/admin/js/csrfPrevention.js</url-pattern>
</servlet-mapping>

<!--This is for performing the character encoding in the JSPs. -->
<filter>
<filter-name>CharsetFilter</filter-name>
Expand All @@ -69,12 +58,6 @@
</init-param>
</filter>

<!-- OWASP CSRFGuard filter used to validate CSRF token-->
<filter>
<filter-name>CSRFGuard</filter-name>
<filter-class>org.owasp.csrfguard.CsrfGuardFilter</filter-class>
</filter>

<!-- Filter to avoid path traversal -->
<filter>
<filter-name>PathTraversalFilter</filter-name>
Expand Down Expand Up @@ -111,11 +94,6 @@
<url-pattern>/*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-name>CSRFGuard</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-name>URLBasedCachePreventionFilter</filter-name>
<url-pattern>*.jsp</url-pattern>
Expand All @@ -126,11 +104,6 @@
<listener-class>org.owasp.csrfguard.CsrfGuardServletContextListener</listener-class>
</listener>

<!-- OWASP CSRFGuard session listener used to generate per-session CSRF token -->
<listener>
<listener-class>org.owasp.csrfguard.CsrfGuardHttpSessionListener</listener-class>
</listener>

<session-config>
<session-timeout>15</session-timeout>
<cookie-config>
Expand Down
30 changes: 1 addition & 29 deletions ...home/repository/resources/conf/templates/repository/conf/tomcat/carbon/WEB-INF/web.xml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,12 +41,6 @@
<load-on-startup>1</load-on-startup>
</servlet>

<!-- OWASP CSRFGuard servlet that serves dynamic token injection JavaScript-->
<servlet>
<servlet-name>JavaScriptServlet</servlet-name>
<servlet-class>org.owasp.csrfguard.servlet.JavaScriptServlet</servlet-class>
</servlet>

<servlet-mapping>
<servlet-name>bridgeservlet</servlet-name>
<url-pattern>/*</url-pattern>
Expand All @@ -59,11 +53,6 @@
<url-pattern>*.jsp</url-pattern>
</servlet-mapping>

<servlet-mapping>
<servlet-name>JavaScriptServlet</servlet-name>
<url-pattern>/carbon/admin/js/csrfPrevention.js</url-pattern>
</servlet-mapping>

<!--This is for performing the character encoding in the JSPs. -->
<filter>
<filter-name>CharsetFilter</filter-name>
Expand All @@ -74,12 +63,6 @@
</init-param>
</filter>

<!-- OWASP CSRFGuard filter used to validate CSRF token-->
<filter>
<filter-name>CSRFGuard</filter-name>
<filter-class>org.owasp.csrfguard.CsrfGuardFilter</filter-class>
</filter>

<!-- Tomcat http header security filter -->
<filter>
<filter-name>HttpHeaderSecurityFilter</filter-name>
Expand Down Expand Up @@ -116,7 +99,7 @@
<url-pattern>*</url-pattern>
</filter-mapping>

<filter-mapping>
<filter-mapping>
<filter-name>CharsetFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Expand All @@ -128,23 +111,12 @@
{% endfor %}
</filter-mapping>

<filter-mapping>
<filter-name>CSRFGuard</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

<!-- OWASP CSRFGuard context listener used to read CSRF configuration -->
<listener>
<listener-class>org.owasp.csrfguard.CsrfGuardServletContextListener</listener-class>
</listener>

<!-- OWASP CSRFGuard session listener used to generate per-session CSRF token -->
<listener>
<listener-class>org.owasp.csrfguard.CsrfGuardHttpSessionListener</listener-class>
</listener>



<session-config>
<session-timeout>{{tomcat.management_console.session_timeout}}</session-timeout>
<cookie-config>
Expand Down