NullPointerException when using JSP Tags and the CSRFGuard is disabled.

[alexhatz05]

Hello,

[Bug Description]
I am using CSRFGuard JSP Tag libraries in a Java EE project (Java 8). I recently faced the following issue: when I have to set the org.owasp.csrfguard.Enabled property to false, then a Null Pointer Exception is thrown and my application fails to load.

I checked the code of the respective JSP Tags and noticed that there is no check to see if the CSRFGuard is enabled before proceeding with the token injection. After debugging I found that the following line throwsthe exception:

final LogicalSession logicalSession = csrfGuard.getLogicalSessionExtractor().extract((HttpServletRequest) this.pageContext.getRequest());

[To Reproduce]
Steps to reproduce the behavior:

1. Go to CSRFGuard properties and set org.owasp.csrfguard.Enabled = false
2. Load any page that is using CSRFGuard JSP Tags
3. See the error in the logs

[Expected behavior]
Due to practical reasons, I deem necessary to find a solution so that the application using CSRFGuard tags would not be impacted by CSRF functionality when the guard is disabled.

[Environment]

• OS: RHEL
• Browser: Chrome, Firefox (I checked only those two)

[Solution that worked for me]
If you would like to consider my solution, I have submitted a Pull Request with the branch check_if_enabled_before_injecting_with_tag which contains a simple solution by checking if the CSRFGuard is enabled before proceeding with the logic. I have done this for TokenTag, TokenNameTag, TokenValueTag.

[forgedhallpass]

Thank you @alexhatz05. Very well written description of the issue! The PR will be accepted after the minor changes that were requested. Is the issue also reproducible in the test application?

[alexhatz05]

Thank you for accepting my change :) I submitted the changes requested, hope you received them (I'm new to contributing).

I just checked with the test application having CSRFGuard disabled and managed to reproduce the issue there as well.

[forgedhallpass]

Fixed by #20

[forgedhallpass]

I've created a new patch version release (https://github.com/OWASP/www-project-csrfguard/releases/tag/4.0.1) with your changes. It will soon be available on Maven central as well. Thank you for your contribution.

[kguelzau]

neither 4.0.1 nor 4.1.0 is available on maven central, right?

[forgedhallpass]

@kguelzau 4.1.1 has been released to Maven Central.