小编mon*_*ama的帖子

我们在 Spring Web 应用程序中添加了一个过滤器，用于检查所有传入请求是否存在可能导致 XSS 漏洞的内容。但是，当它尝试写入日志时，我们得到以下堆栈跟踪：

com.blah.blah.web.controllers.ExceptionLoggingController - ERROR: Exception: code=500,uri=/post.html,servlet=dispatch,class=org.owasp.esapi.errors.ConfigurationException,from=1.2.3.4,message=Request processing failed; nested exception is org.owasp.esapi.errors.ConfigurationException: java.lang.IllegalArgumentException: Classname cannot be null or empty. HTTPUtilities type name cannot be null or empty.
org.owasp.esapi.errors.ConfigurationException: java.lang.IllegalArgumentException: Classname cannot be null or empty. HTTPUtilities type name cannot be null or empty.
    at org.owasp.esapi.util.ObjFactory.make(ObjFactory.java:105)
    at org.owasp.esapi.ESAPI.httpUtilities(ESAPI.java:121)
    at org.owasp.esapi.ESAPI.currentRequest(ESAPI.java:70)
    at org.owasp.esapi.reference.JavaLogFactory$JavaLogger.log(JavaLogFactory.java:308)
    at org.owasp.esapi.reference.JavaLogFactory$JavaLogger.warning(JavaLogFactory.java:242)
    at org.owasp.esapi.reference.DefaultEncoder.canonicalize(DefaultEncoder.java:181)
    at org.owasp.esapi.reference.DefaultEncoder.canonicalize(DefaultEncoder.java:120)
    at com.blah.blah.web.MyFilter.removeXSS(MyFilter.java:26)

我在类路径上有 ESAPI.properties，这似乎可以正常工作，并且确实配置了“丢失”的类：

ESAPI.HTTPUtilities=org.owasp.esapi.reference.DefaultHTTPUtilities

DefaultHTTPUtilities 也在类路径上。