'Invalid request / Error while processing request' After Changing Password in OFSAA User Management (Doc ID 2408299.1)

Last updated on MARCH 10, 2023

Applies to:

Symptoms

In Oracle Financial Services Analytical Applications (OFSAA) 8.0.6, when trying to update a user's password in Identity Management > User Management, after entering the new password value and clicking on 'Save', the following error message appears:

Invalid request / Error while processing request

Additionally, the following error exists in the Tomcat web server catalinatest.2018-06-04.log:

04-Jun-2018 10:28:29.599 WARNING [http-nio-8080-exec-6] org.owasp.esapi.reference.JavaLogFactory$JavaLogger.log [SECURITY FAILURE Anonymous:null@unknown -> /DefaultName/IntrusionDetector] Invalid input: context=ValidationFramework, type(OFS_AAI_SMS_date_exp)=(0[0-9]|1[0-2])\/([0-2][0-9]|3[0-1])\/[0-9][0-9][0-9][0-9]( ([0-2][0-9]|2[0-4]):[0-5][0-9]:[0-5][0-9] [AP]?M)?, input=03-FEB-17
org.owasp.esapi.errors.ValidationException: ValidationFramework: Invalid input. Please conform to regex (0[0-9]|1[0-2])\/([0-2][0-9]|3[0-1])\/[0-9][0-9][0-9][0-9]( ([0-2][0-9]|2[0-4]):[0-5][0-9]:[0-5][0-9] [AP]?M)? with a maximum length of 9
       at org.owasp.esapi.reference.validation.StringValidationRule.checkWhitelist(StringValidationRule.java:144)
       at org.owasp.esapi.reference.validation.StringValidationRule.checkWhitelist(StringValidationRule.java:160)
       at org.owasp.esapi.reference.validation.StringValidationRule.getValid(StringValidationRule.java:284)
       at org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:214)
       at org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:185)
       at com.ofs.aai.common.security.OFSAASecurityValidator.validateInputESAPI(OFSAASecurityValidator.java:521)
       at com.ofs.aai.common.security.OFSAASecurityValidator.validateRequestObject(OFSAASecurityValidator.java:158)
       at com.iflex.fic.ficml.SMSServlet.doPost(SMSServlet.java:184)
       at javax.servlet.http.HttpServlet.service(HttpServlet.java:648)
       at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
       etc.

As a result of these errors, the user password is not changed.

Changes

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.