ESAPI Mapping

2011-06-17T06:48:54Z

Chris Schmidt:

<center>
{| style="width: 75%; align:center; text-align:center; border:2px solid #4F81BD; background-color:#F2F2F2; padding=2;"
|- style="background-color: #000; color: #FFF;"
! style="color: #FFF" | Top 10 2010
! style="color: #FFF" colspan="2" | ESAPI Control / ASVS Requirements
|- style="background-color: #FFF"
| rowspan="2" width="34%" style="background-color: #D9D9D9" | [[Top 10 2010-A1|A1-Injection]]
| width="33%" style="background-color: lightgreen" | [[ESAPI Mapping Encoder A1|Encoder]]
| width="33%" style="background-color: lightgreen" | [[ESAPI Mapping Validator A1|Validator]]
|- style="background-color: #FFF"
| style="background-color: #FFB200" | [http://code.google.com/p/owasp-asvs/wiki/Verification_V6 V6: Output Encoding/Escaping]
| style="background-color: #FFB200" | [http://code.google.com/p/owasp-asvs/wiki/Verification_V5 V5: Input Validation]
|- style="background-color: #FFF"
| rowspan="2" | [[Top 10 2010-A2|A2-Cross Site Scripting (XSS)]]
| style="background-color: lightgreen" | [[ESAPI Mapping Encoder A2|Encoder]]
| style="background-color: lightgreen" | [[ESAPI Mapping Validator A2|Validator]]
|- style="background-color: #FFF"
| style="background-color: #FFB200" | [http://code.google.com/p/owasp-asvs/wiki/Verification_V6 V6: Output Encoding/Escaping]
| style="background-color: #FFB200" | [http://code.google.com/p/owasp-asvs/wiki/Verification_V5 V5: Input Validation]
|- style="background-color: #FFF"
| rowspan="2" style="background-color: #D9D9D9" | [[Top 10 2010-A3|A3-Broken Authentication and Session Management]]
| style="background: lightgreen" | [[ESAPI Mapping Authenticator A3|Autenticator]]
| style="background: lightgreen" | [[ESAPI Mapping HttpUtilities A3|HttpUtilities]]
|- style="background-color: #FFF"
| style="background-color: #FFB200" | [http://code.google.com/p/owasp-asvs/wiki/Verification_V2 V2: Authentication]
| style="background-color: #FFB200" | [http://code.google.com/p/owasp-asvs/wiki/Verification_V11 V11: HTTP Security]
|}

</center>

[[Category:OWASP Enterprise Security API]]

2011-06-17T05:32:16Z

Chris Schmidt:

I tried to keep the specification as compatible as I can with the existing APIs, however there are definately places where existing users are going to have to modify their code - specifically where it deals with Encoding and Validation. I believe these changes are absolutely necessary however to establish a good cross-platform specification. I also believe the migration path allows for the smoothest transition for end-users (developers) to make the necessary changes without completely breaking their existing implementations. This is similar to the path that Spring-Security took with it's 2.0 -> 2.5 -> 3.0 path where they did a very similar thing and I used their experience as the basis for the proposed roadmap.

--[[User:Chris Schmidt|Chris Schmidt]] 02:23, 16 June 2011 (EDT)

== Proposed Roadmap ==

Does this seem like a realistic and smooth approach?

--[[User:Chris Schmidt|Chris Schmidt]] 02:26, 16 June 2011 (EDT)

== AccessController ==

Let's start with discussing the proposed changes to the AccessController.

Summary of proposed changes:
* Drop deprecated methods isAuthorizedForXXX, assertAuthorizedForXXX
* Replace (Object) Parameters with strongly typed StereoTypes

Thoughts?

--[[User:Chris Schmidt|Chris Schmidt]] 02:26, 16 June 2011 (EDT)

I like the resource approach, I am imaginating there will be, lets say, a FileResource inheritated from Resource, so if a FileResource is passed to the method then only assessments against file resources will be done, am I right?

--[[User:jcmax|Juan C Calderon]] 19:23, 16 June 2011 (CDT)

== Logged in user, from where? ==

where is the logged in user information will come from? how is it going to be available for isAuthorized?

--[[User:jcmax|Juan C Calderon]] 19:16, 16 June 2011 (CDT)

I personally like the Spring-Security approach - which is similar to the way ESAPI for Java currently does it - in that it uses a threadlocal; however - afaik there is no concept of ThreadLocal variables in PHP or ASP.Net. I think the best way to do this would be to borrow the concept of the SecurityContextHolder from the Spring-Security model and leave the actual implementation of how it is populated up to the implementation. So this would be a new interface called something like AuthenticationHolder or UserContextHolder with a method to getCurrentUser() which would return the currently logged in user.

--[[User:Chris Schmidt|Chris Schmidt]] 01:32, 17 June 2011 (EDT)

== Exceptions ==

The specification looks very "Java", that is, I am not pretty sure if you can handle structured exceptions in PHP, in Classic ASP is not possible, yet it could be emulated a little. Can we come to a representation that is more language neutral? (this is not a show stopper, just thinking on trying to be the more neutral possible)

--[[User:jcmax|Juan C Calderon]] 19:21, 16 June 2011 (CDT)

I added this at the very end because it does feel very Java'ish to me as well. However, that being said - all of the languages have a concept of either an Error or an Exception. PHP has Exceptions and as far as I can tell in ASP.Net you can raise an Error event which accomplishes the same task. Unfortunately in modern OO languages the concept of Error has a completely different meaning than an Exception as we are using them. An error is generally a condition that cannot be recovered from whereas an Exception represents a state that can - hence the use of the Exception word.

--[[User:Chris Schmidt|Chris Schmidt]] 01:32, 17 June 2011 (EDT)

ESAPI Specification

2011-06-16T07:12:00Z

Chris Schmidt:

ESAPI Specification

2011-06-16T07:02:03Z

Chris Schmidt:

ESAPI Project Structure

2011-06-16T06:59:10Z

Chris Schmidt: Created page with "<pre>This document is currently under development - Please use the Discussion page for threaded conversation</pre> * '''ESAPI-Core-Specification (TLD):''' All forks should "inhe..."

<pre>This document is currently under development - Please use the Discussion page for threaded conversation</pre>

* '''ESAPI-Core-Specification (TLD):''' All forks should "inherit" from this specification
** '''ESAPI-Core:''' This is a language specific artifact (jar,dll,etc.) that contains the API described by the ESAPI Core Specification as well as the Core-API Unit Testing Suite
*** '''ESAPI-Core-RI:''' This is the "Reference Implementation" of the Core-API. This can be a single artifact or multiple artifacts depending on the preference of the community and project leadership.
*** '''ESAPI-Web-Specification:''' This is the specification for the ESAPI Web API
**** '''ESAPI-Web-API:''' This is the language specific artifact that contains the API described by the ESAPI-Web-Specification as well as a set of Unit Tests
***** '''ESAPI-Web-RI:''' This is the "Reference Implementation" of the Web-API.
*** '''ESAPI-Mobile-Specification:'''
**** '''ESAPI-Mobile-API:'''
***** '''ESAPI-Mobile-RI:'''
*** '''ESAPI-Desktop-Specification:'''
**** '''ESAPI-Desktop-API:'''
***** '''ESAPI-Desktop-RI:'''

2011-06-16T06:26:45Z

Chris Schmidt:

Talk:ESAPI Specification

2011-06-16T06:25:55Z

Chris Schmidt: /* AccessController */ new section

Chris Schmidt:

== Summit 2011 ==

=== Summit Overview ===

The ESAPI Summit will be held on

=== Agenda ===

* 09:00 - 09:30 Mission Briefing
** Review Project Definition and Mission Statement (update if necc.)
* 09:30 - 10:30 Brain Dump
** Get everyones "big-picture" ideas up on the board
** Brief statement about each, this should be a fast-paced Mind-Mapping Exercise aimed to get as many ideas as we can on the board as quickly as possible
* 10:30 - 10:45 Break time
** Good job, get some coffee and some air and get prepared for the real work.
* 10:45 - 12:00 Bug Hunt
** Review the list of existing ESAPI Bugs, assign a champion to them, and prioritize per champion
* 12:00 - 13:00 Lunch - Open Conversation
** Lunch to be provided by OWASP/ESAPI
* 13:00 - 15:00 Where do we go now?
** Now that the bugs are fresh in our heads, let's revisit our master wish-list from earlier and prioritize future enhancements, lay them out into a version roadmap (not a calendar roadmap). Some of these enhancements will likely jump out as high-priority and others as nice-to-haves. It should also be remembered, that a version roadmap is a organic document, it will constantly change and evolve to meet the demands of our users. This is just a first step in getting such a roadmap in place.
* 15:00 - 15:15 Break time
** Get some air, there is sure to be some great debate to reflect on
* 15:15 - 16:00 Formally define the following policies
** Becoming a Committer
** Submitting Contributed Components
** Reporting Security Vulnerabilities
* 16:00 - 18:00 Aligning the ESAPI Projects
** How do we bring all of the implementations into alignment as far as the API is concerned
** How do we ensure that all implements adhere to the contract of the API
** What level of adherement to the specification do we enforce to "sign off" on various implementations

=== Attending the ESAPI Summit ===

If you are planning to attend this summit, please list your name below so that we can ensure that we have adequate space and materials for everyone.

== Summit 2008 ==

=== Summit Overview ===

The first OWASP ESAPI Summit was held December 9-11, 2008. It was hosted by Aspect Security in their Columbia, MD office.

The following were the attendees of the Summit:

*[[User:Jeff Williams|Jeff Williams]], Aspect Security - [[ESAPI|ESAPI Project Lead]]
*[[User:Wichers|Dave Wichers]], Aspect Security - [http://code.google.com/p/owasp-esapi-java/ ESAPI Java Committer]
*Ron Monzillo, Sun Microsystems - [http://java.sun.com/javaee/security/ Java EE Security Architect]
*[[User:Arshan|Arshan Dabirsiaghi]], Aspect Security - [[:Category:Intrinsic_Security_Working_Group|OWASP Intrisic Security Working Group Chair]]
*[[User:Jerryhoff|Jerry Hoff]], Aspect Security
*[[User:Mikehfauzy|Mike Fauzy]], Aspect Security
*[[User:Kevin.Fealey|Kevin Fealey]], Aspect Security - [[ESAPI Swingset|ESAPI Swingset Lead]]
*[[User:Jmanico|Jim Manico]], Aspect Security - [http://code.google.com/p/owasp-esapi-java/ ESAPI Java Committer]
*Steve Lavenhar, Booz Allen Hamilton
*Lian Jin, Booz Allen Hamilton
*John Steven, Cigital, Technical Director
*Joel Winstead, Cigital
*Alex Smolen, Foundstone - [[.NET ESAPI | ESAPI .NET Lead]]
*Andy Miller, Lockheed Martin
*John Munsch, Lockheed Martin
*Steve Christey, MITRE - [http://cve.mitre.org CVE]/[http://cwe.mitre.org CWE] Project Lead

The following pages contain our thoughts/results from the summit.

Summary: TODO

=== Links ===

* [[ESAPI Charter]]
* [[ESAPI Roadmap]]
* [[ESAPI Adoption Strategy]]
* [[ESAPI Framework Strategy]]
* [[ESAPI Assurance]]
* [[ESAPI Documentation]]
* [[ESAPI Marketing]]
* [[ESAPI Tooling]]
* [[ESAPI Static Analysis Support]]
* [[ESAPI Performance]]
* [[ESAPI Internationalization]]
* [[ESAPI Installation]]

=== Design ===

* [[ESAPI API]]

=== Features ===

* [[ESAPI Validation]]
* [[ESAPI Canonicalization]]
* [[ESAPI Encoding]]
* [[ESAPI Authentication]]
* [[ESAPI Session Management]]
* [[ESAPI Access Control]]
* [[ESAPI Encryption]]
* [[ESAPI Randomizer]]
* [[ESAPI Error Handling]]
* [[ESAPI Logging]]
* [[ESAPI Intrusion Detection]]
* [[ESAPI HTTP Protection]]
* [[ESAPI Utilities]]
* [[ESAPI Filters]]

__NOTOC__
[[Category:OWASP Enterprise Security API]]