Method validateTokens

src/main/java/utils/Validate.java:478–515

This method compares the two submitted tokens after ensuring they are not null and not empty. @param cookieToken CSRF cookie Token @param requestToken CSRF request Token @return A boolean value stating weather or not the tokens are valid

(Cookie cookieToken, Object requestToken)

	 * @return A boolean value stating weather or not the tokens are valid
	 */
	public static boolean validateTokens (Cookie cookieToken, Object requestToken)
	{
		boolean result = false;
		boolean cookieNull = (cookieToken == null);
		boolean requestNull = (requestToken == null);
		if(!cookieNull && !requestNull)
		{
			try
			{
				String theRequest = (String)requestToken;
				String theCookie = cookieToken.getValue();
				boolean cookieEmpty = theCookie.isEmpty();
				boolean requestEmpty = theRequest.isEmpty();
				
				if(!cookieEmpty && !requestEmpty)
					result = theRequest.compareTo(theCookie) == 0;
				else if (cookieEmpty)
					log.error("Cookie Token Empty");
				else if (requestEmpty)
					log.error("Request Token Empty");
				
				if(!result)
					log.error("CSRF Tokens did not match");
			}
			catch(Exception e)
			{
				log.error("CSRF in Request Error: " + e.toString());
			}
		}
		else
		{
			if(cookieNull)
				log.error("Cookie Token was Null");
			else if (requestNull)
				log.error("Request Token was Null");
		}	
		return result;
	}
	
	/**
	 * Validates file name attributes to defend against path traversal