Jasig/cas-server-security-filter — pull request #6 by apetro (2014-08-18 14:16:31+00:00)
Title: Add character blocking filter

Add a `RequestParameterPolicyEnforcementFilter` for blocking unexpected characters in request parameters.

This Filter is documented in the accompanying updates to `README.md`, in its JavaDoc, and in a comprehensive JUnit test with [TestDox-style][] test method names.

The intent of the Filter is to be suitable for fronting Java CAS Client implementations of all kinds for blocking certain characters in certain request parameters as a workaround for preventing attempts to exploit CVE-2014-4172 . This is intended as an alternative to upgrading or switching Java CAS Client versions and implementations in environments where that version or client jump is undesirable for the complexity it may introduce.

The Filter is optionally configurable via `web.xml` `init-param`s. Most adopters will need to configure it to scrutinize only the CAS protocol request parameters as documented in the `README.md`.

The Filter also optionally blocks multi-valued request parameters, making it a suitable alternative to the `SecurityFilter` in this project for those situations where blocking all multi-valued request parameters is over-broad.

The Filter has no external dependencies and so should be deployable in any Java Servlet web application environment that supports Filters. This makes this Filter potentially suitable as a workaround for very old CAS client environments including those using third party or even custom CAS Client implementations.

[TestDox-style]: http://googletesting.blogspot.com/2007/02/tott-naming-unit-tests-responsibly.html