org.zaproxy.zap.extension.httpsessions

Class ExtensionHttpSessions

java.lang.Object

org.parosproxy.paros.extension.ExtensionAdaptor

org.zaproxy.zap.extension.httpsessions.ExtensionHttpSessions

All Implemented Interfaces:

Extension, SessionChangedListener, HttpSenderListener, SiteMapListener

public class ExtensionHttpSessions
extends ExtensionAdaptor
implements SessionChangedListener, SiteMapListener, HttpSenderListener

The HttpSessions Extension handles the existing http sessions on the existing site. It allows the management and usage of multiple sessions per site and also handles the session tokens for each of them.

Whenever referring to a particular site, the string that is identifying it is constructed from the site's URI and has to follow these rules:

• no leading protocol (e.g. 'http'), colon (':') and double slashes ('//')
• the port is added in the end after colon
• lower-case

An example of a method performing these changes on an URI is ScanPanel.cleanSiteName(String, boolean) .

Field Summary

Fields

Modifier and Type	Field and Description
static String	NAME The Constant NAME.

Constructor Summary

Constructors

Constructor and Description
ExtensionHttpSessions() Instantiates a new extension http sessions.

Method Summary

Modifier and Type	Method and Description
void	addHttpSessionToken(String site, String token) Adds a new session token for a particular site.
String	getAuthor() Gets the author of the extension.
String	getDescription() Returns the description of the extension, to be shown in UI components.
List<HttpSession>	getHttpSessionsForContext(Context context) Builds and returns a list of http sessions that correspond to a given context.
protected HttpSessionsPanel	getHttpSessionsPanel() Gets the http sessions panel.
HttpSessionsSite	getHttpSessionsSite(String site) Gets the http sessions for a particular site.
HttpSessionsSite	getHttpSessionsSite(String site, boolean createIfNeeded) Gets the http sessions for a particular site.
HttpSessionTokensSet	getHttpSessionTokensSet(String site) Gets the set of session tokens for a particular site.
HttpSessionTokensSet	getHttpSessionTokensSetForContext(Context context) Gets the http session tokens set for the first site matching a given Context.
int	getListenerOrder() Gets the order of when this listener should be notified.
HttpSessionsParam	getParam() Gets the parameters (options) for this extension and related classes.
List<String>	getSites() Gets all of the sites with http sessions.
String	getUIName() By default returns the name returned by getName().
void	hook(ExtensionHook extensionHook) Called during extension's initialisation to allow to add new functionality to core components.
void	init() Initialize plugin during startup.
boolean	isDefaultSessionToken(String token) Checks if a particular token is part of the default session tokens set by the user using the options panel.
boolean	isSessionToken(String site, String token) Checks if a particular token is a session token name for a particular site.
void	nodeSelected(SiteNode node)
void	onHttpRequestSend(HttpMessage msg, int initiator, HttpSender sender) Notifies the listener that a new request was received from the client and is ready to be forwarded to the server.
void	onHttpResponseReceive(HttpMessage msg, int initiator, HttpSender sender) Notifies the listener that a new response was received from the server and is ready to be forwarded to the client.
void	onReturnNodeRendererComponent(SiteMapTreeCellRenderer component, boolean leaf, SiteNode value)
void	removeHttpSessionToken(String site, String token) Removes a particular session token for a site.
void	sessionAboutToChange(Session session) Called just prior to the session changing.
void	sessionChanged(Session session) Called just after the session has changed.
void	sessionModeChanged(Control.Mode mode) Called when the user changes the mode.
void	sessionScopeChanged(Session session) Called when the user has changes the session scope.
boolean	supportsDb(String type) Return true if the specified db type is supported by the extension (or if it doesn't use any db) If this method returns false (meaning the db in use is not supported) then the extension will not be loaded.

Methods inherited from class org.parosproxy.paros.extension.ExtensionAdaptor

canUnload, databaseOpen, destroy, getActiveActions, getAddOn, getDependencies, getExtensionMenu, getExtensionView, getI18nPrefix, getMessages, getModel, getName, getOrder, getUnsavedResources, getView, hasView, initModel, initView, initXML, isCore, isDepreciated, isEnabled, optionsLoaded, postInit, postInstall, setAddOn, setDescription, setEnabled, setI18nPrefix, setMessages, setName, setOrder, start, stop, supportsLowMemory, unload

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.parosproxy.paros.extension.SessionChangedListener

sessionPropertiesChanged

Methods inherited from interface org.parosproxy.paros.extension.Extension

getURL, getVersion

Field Detail

NAME

public static final String NAME

The Constant NAME.

See Also:

Constant Field Values

Constructor Detail

ExtensionHttpSessions

public ExtensionHttpSessions()

Instantiates a new extension http sessions.

Method Detail

supportsDb

public boolean supportsDb(String type)

Description copied from interface: Extension

Return true if the specified db type is supported by the extension (or if it doesn't use any db) If this method returns false (meaning the db in use is not supported) then the extension will not be loaded.

Specified by:

supportsDb in interface Extension

Overrides:

supportsDb in class ExtensionAdaptor

Parameters:

type - the db type

Returns:

true if the specified db type is supported by the extension (or if it doesn't use any db)

See Also:

Database.getType()

getUIName

public String getUIName()

Description copied from class: ExtensionAdaptor

By default returns the name returned by getName().

Specified by:

getUIName in interface Extension

Overrides:

getUIName in class ExtensionAdaptor

Returns:

the UI name of the extension, never null

See Also:

ExtensionAdaptor.getName()

getAuthor

public String getAuthor()

Description copied from interface: Extension

Gets the author of the extension.

Since 2.9.0 defaults to the author of the add-on, if set, otherwise an empty string.

Specified by:

getAuthor in interface Extension

Returns:

the author of the extension, might be null.

getDescription

public String getDescription()

Description copied from interface: Extension

Returns the description of the extension, to be shown in UI components. The description must be internationalised.

Specified by:

getDescription in interface Extension

Overrides:

getDescription in class ExtensionAdaptor

Returns:

the description of the extension, never null

init

public void init()

Description copied from interface: Extension

Initialize plugin during startup. This phase is carried out before all others.

Specified by:

init in interface Extension

Overrides:

init in class ExtensionAdaptor

hook

public void hook(ExtensionHook extensionHook)

Description copied from interface: Extension

Called during extension's initialisation to allow to add new functionality to core components.

Specified by:

hook in interface Extension

Overrides:

hook in class ExtensionAdaptor

Parameters:

extensionHook - the hook to add the components.

getParam

public HttpSessionsParam getParam()

Gets the parameters (options) for this extension and related classes.

Returns:

the param

isDefaultSessionToken

public boolean isDefaultSessionToken(String token)

Checks if a particular token is part of the default session tokens set by the user using the options panel. The default session tokens are valid for all sites. The check is being performed in a lower-case manner, as default session tokens are case-insensitive.

Parameters:

token - the token

Returns:

true, if it is a default session token

isSessionToken

public boolean isSessionToken(String site,
                              String token)

Checks if a particular token is a session token name for a particular site.

Parameters:

site - the site. This parameter has to be formed as defined in the ExtensionHttpSessions class documentation. However, if the protocol is missing, a default protocol of 80 is used.

token - the token

Returns:

true, if it is session token

addHttpSessionToken

public void addHttpSessionToken(String site,
                                String token)

Adds a new session token for a particular site.

Parameters:

site - the site. This parameter has to be formed as defined in the ExtensionHttpSessions class documentation. However, if the protocol is missing, a default protocol of 80 is used.

token - the token

removeHttpSessionToken

public void removeHttpSessionToken(String site,
                                   String token)

Removes a particular session token for a site.

All the existing sessions are cleaned up:

• if there are no more session tokens, all session are deleted
• in every existing session, the value for the deleted token is removed
• if there is a session with no values for the remaining session tokens, it is deleted
• if, after deletion, there are duplicate sessions, they are merged

Parameters:

site - the site. This parameter has to be formed as defined in the ExtensionHttpSessions class documentation. However, if the protocol is missing, a default protocol of 80 is used.

token - the token

getHttpSessionTokensSet

public final HttpSessionTokensSet getHttpSessionTokensSet(String site)

Gets the set of session tokens for a particular site. No modifications should be done to the returned object. Instead, any modifications should be done through the corresponding methods in the ExtensionHttpSessions.

Parameters:

site - the site. This parameter has to be formed as defined in the ExtensionHttpSessions class documentation. However, if the protocol is missing, a default protocol of 80 is used.

Returns:

the session tokens set, if any have been set, or null, if there are no session tokens for this site

See Also:

addHttpSessionToken(String, String), removeHttpSessionToken(String, String)

getHttpSessionsPanel

protected HttpSessionsPanel getHttpSessionsPanel()

Gets the http sessions panel.

Returns:

the http sessions panel

getHttpSessionsSite

public HttpSessionsSite getHttpSessionsSite(String site)

Gets the http sessions for a particular site. If it doesn't exist, it is created.

Parameters:

site - the site. This parameter has to be formed as defined in the ExtensionHttpSessions class documentation. However, if the protocol is missing, a default protocol of 80 is used.

Returns:

the http sessions site container

getHttpSessionsSite

public HttpSessionsSite getHttpSessionsSite(String site,
                                            boolean createIfNeeded)

Gets the http sessions for a particular site. The behaviour when a HttpSessionsSite does not exist is defined by the createIfNeeded parameter.

Parameters:

site - the site. This parameter has to be formed as defined in the ExtensionHttpSessions class documentation. However, if the protocol is missing, a default protocol of 80 is used.

createIfNeeded - whether a new HttpSessionsSite object is created if one does not exist

Returns:

the http sessions site container, or null one does not exist and createIfNeeded is false

nodeSelected

public void nodeSelected(SiteNode node)

Specified by:

nodeSelected in interface SiteMapListener

onReturnNodeRendererComponent

public void onReturnNodeRendererComponent(SiteMapTreeCellRenderer component,
                                          boolean leaf,
                                          SiteNode value)

Specified by:

onReturnNodeRendererComponent in interface SiteMapListener

sessionChanged

public void sessionChanged(Session session)

Description copied from interface: SessionChangedListener

Called just after the session has changed. sessionChanged may be called by non-event thread. Should handle with care in all the listener. Use EventThread for each GUI event.

Specified by:

sessionChanged in interface SessionChangedListener

Parameters:

session - the new session

sessionAboutToChange

public void sessionAboutToChange(Session session)

Description copied from interface: SessionChangedListener

Called just prior to the session changing. Listeners should close down any resources associated with this session. sessionAboutToChange may be called by non-event thread. Should handle with care in all the listener. Use EventThread for each GUI event.

Specified by:

sessionAboutToChange in interface SessionChangedListener

Parameters:

session - the session about to be closed

sessionScopeChanged

public void sessionScopeChanged(Session session)

Description copied from interface: SessionChangedListener

Called when the user has changes the session scope. sessionScopeChanged may be called by non-event thread. Should handle with care in all the listener. Use EventThread for each GUI event.

Specified by:

sessionScopeChanged in interface SessionChangedListener

Parameters:

session - the current session

sessionModeChanged

public void sessionModeChanged(Control.Mode mode)

Description copied from interface: SessionChangedListener

Called when the user changes the mode. sessionModeChanged may be called by non-event thread. Should handle with care in all the listener. Use EventThread for each GUI event.

Specified by:

sessionModeChanged in interface SessionChangedListener

Parameters:

mode - the new mode

getHttpSessionsForContext

public List<HttpSession> getHttpSessionsForContext(Context context)

Builds and returns a list of http sessions that correspond to a given context.

Parameters:

context - the context

Returns:

the http sessions for context

getHttpSessionTokensSetForContext

public HttpSessionTokensSet getHttpSessionTokensSetForContext(Context context)

Gets the http session tokens set for the first site matching a given Context.

Parameters:

context - the context

Returns:

the http session tokens set for context

getSites

public List<String> getSites()

Gets all of the sites with http sessions.

Returns:

all of the sites with http sessions

getListenerOrder

public int getListenerOrder()

Description copied from interface: HttpSenderListener

Gets the order of when this listener should be notified.

The listeners are ordered in a natural order, the greater the order the later it will be notified.

Note: If two or more listeners have the same order, the order that those listeners will be notified is undefined.

Specified by:

getListenerOrder in interface HttpSenderListener

Returns:

an int with the value of the order that this listener should be notified about

onHttpRequestSend

public void onHttpRequestSend(HttpMessage msg,
                              int initiator,
                              HttpSender sender)

Description copied from interface: HttpSenderListener

Notifies the listener that a new request was received from the client and is ready to be forwarded to the server.

The HttpMessage msg can be modified (only the request should be modified). If the return value is true the message may be forwarded and the following listeners will be notified, if the value is false the message will not be forwarded and no more listeners will be notified.

Note: In the presence of more than one listener there are no guarantees that:

• the HttpMessage msg is equal to the one forwarded to the server, as the following listeners may modify it;
• the message will really be forwarded to the server, even if the return value is true, as the following listeners may return false.
• the int initiator as defined in the HttpSender class.

Specified by:

onHttpRequestSend in interface HttpSenderListener

Parameters:

msg - the HttpMessage that may be forwarded to the server

initiator - the ID of the entity that's sending the message

sender - the sender of the message

onHttpResponseReceive

public void onHttpResponseReceive(HttpMessage msg,
                                  int initiator,
                                  HttpSender sender)

Description copied from interface: HttpSenderListener

Notifies the listener that a new response was received from the server and is ready to be forwarded to the client.

The HttpMessage msg can be modified (only the response should be modified). If the return value is true the message may be forwarded and the following listeners will be notified, if the value is false the message will not be forwarded and no more listeners will be notified.

Note: In the presence of more than one listener there are no guarantees that:

• the HttpMessage msg is equal to the one forwarded to the client, as the following listeners may modify it;
• the message will really be forwarded to the client, even if the return value is true, as the following listeners may return false.
• the int initiator as defined in the HttpSender class.

Specified by:

onHttpResponseReceive in interface HttpSenderListener

Parameters:

msg - the HttpMessage that may be forwarded to the client

initiator - the ID of the entity that's sending the message

sender - the sender of the message