Legacy Java Configuration Properties

  • Updated

Note! These configuration values are considered legacy configuration options. As of version Java Agent Version 3.6.0 these configuration options began deprecating.  New configuration values will only be supported via YAML-based configuration. All users are encouraged to migrate to YAML configuration properties

 

Parameters for certain rules are configurable by the end user. The following are methods of applying custom parameters to these rules.

Setting In "rules.xml"

An optional top level <properties> element has been added to the rules.xml.

<?xml version="1.0" encoding="UTF-8"?>
<policies>
    <policy>
        <properties>
            <web.session.timeout>30</web.session.timeout>
            .
            .
            .
        </properties>
        <org-packages/>
        <propagators>
        .
        .
        .
        </propagators>
        .
        .
        .
    </policy>
    .
    .
    .
</policies>

Properties File

Also, users can use -Dcontrast.properties="/path/to/properties.file" to point to a standard Java properties file when launching their application container. This will override any settings in the <properties> element in the rules.xml file.

For example, in the catalina.sh:

export CONTRAST_AGENT_JAR= "..."
export JAVA_OPTS= "$JAVA_OPTS -javaagent:$CONTRAST_AGENT_JAR -Dcontrast.properties=" /path/to/properties.file "..."

And a properties file located at /path/to/properties.file would look like web.session.timeout= 30.

Direct Definition

Finally, the user could specify a property directly when launching their application container, like -Dweb.session.timeout=30. This will override any settings in rules.xml and the properties file.

export CONTRAST_AGENT_JAR= "..." 
export JAVA_OPTS= "$JAVA_OPTS -javaagent:$CONTRAST_AGENT_JAR -Dweb.session.timeout=" 30 "..."

Supported Properties

Currently, the following properties are supported by this feature:

Property Name  Default Value  Description
web.session.timeout  30   The security plugin will report a vulnerability if   the <session-timeout> value configured in an   application's web.xml exceeds this value. This   value is in minutes.  

Was this article helpful?

0 out of 0 found this helpful

Have more questions? Submit a request