diff --git a/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java b/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
index dc99d76b3..767a49438 100644
--- a/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
+++ b/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
@@ -811,7 +811,7 @@ public void sendForward( String location ) throws AccessControlException,Servle
public void sendRedirect(HttpServletResponse response, String location) throws AccessControlException, IOException {
if (!ESAPI.validator().isValidRedirectLocation("Redirect", location, false)) {
logger.fatal(Logger.SECURITY_FAILURE, "Bad redirect location: " + location);
- throw new IOException("Redirect failed");
+ throw new AccessControlException("Redirect failed");
}
response.sendRedirect(location);
}
diff --git a/src/main/java/org/owasp/esapi/reference/validation/BaseValidationRule.java b/src/main/java/org/owasp/esapi/reference/validation/BaseValidationRule.java
index 1929ff02a..8201aafd7 100644
--- a/src/main/java/org/owasp/esapi/reference/validation/BaseValidationRule.java
+++ b/src/main/java/org/owasp/esapi/reference/validation/BaseValidationRule.java
@@ -89,7 +89,7 @@ public final void setEncoder( Encoder encoder ) {
* {@inheritDoc}
*/
public void assertValid( String context, String input ) throws ValidationException {
- getValid( context, input, null );
+ getValid( context, input );
}
/**
@@ -100,7 +100,11 @@ public Object getValid( String context, String input, ValidationErrorList errorL
try {
valid = getValid( context, input );
} catch (ValidationException e) {
- errorList.addError(context, e);
+ if( errorList == null) {
+ throw e;
+ } else {
+ errorList.addError(context, e);
+ }
}
return valid;
}
diff --git a/src/test/java/org/owasp/esapi/reference/validation/BaseValidationRuleTest.java b/src/test/java/org/owasp/esapi/reference/validation/BaseValidationRuleTest.java
new file mode 100644
index 000000000..f7adfccdb
--- /dev/null
+++ b/src/test/java/org/owasp/esapi/reference/validation/BaseValidationRuleTest.java
@@ -0,0 +1,101 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright (c) 2007 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Ben Sleek Sparta Systems
+ * @created 2015
+ */
+package org.owasp.esapi.reference.validation;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+
+import org.owasp.esapi.Encoder;
+import org.owasp.esapi.errors.ValidationException;
+
+public class BaseValidationRuleTest extends TestCase {
+
+ /**
+ * Instantiates a new base validation rule test.
+ *
+ * @param testName
+ * the test name
+ */
+ public BaseValidationRuleTest(String testName) {
+ super(testName);
+ }
+
+ /**
+ * {@inheritDoc}
+ *
+ * @throws Exception
+ */
+ protected void setUp() throws Exception {
+ // none
+ }
+
+ /**
+ * {@inheritDoc}
+ *
+ * @throws Exception
+ */
+ protected void tearDown() throws Exception {
+ // none
+ }
+
+ /**
+ * Suite.
+ *
+ * @return the test
+ */
+ public static Test suite() {
+ TestSuite suite = new TestSuite(BaseValidationRuleTest.class);
+ return suite;
+ }
+
+ /**
+ * Verifies assertValid throws ValidationException on invalid input
+ * Validates fix for Google issue #195
+ *
+ * @throws ValidationException
+ */
+ public void testAssertValid() throws ValidationException {
+ SampleValidationRule rule = new SampleValidationRule("UnitTest");
+ try {
+ rule.assertValid("testcontext", "badinput");
+ fail();
+ } catch (ValidationException e) {
+ // success
+ }
+ }
+
+ public class SampleValidationRule extends BaseValidationRule {
+
+ public SampleValidationRule(String typeName, Encoder encoder) {
+ super(typeName, encoder);
+ }
+
+ public SampleValidationRule(String typeName) {
+ super(typeName);
+ }
+
+ @Override
+ protected Object sanitize(String context, String input) {
+ return null;
+ }
+
+ public Object getValid(String context, String input) throws ValidationException {
+ throw new ValidationException("Demonstration Exception", "Demonstration Exception");
+ }
+
+ }
+}