OWASP - User contributions [en]

Struts

2007-10-24T09:12:57Z

Eklaver: /* Roles */

==Status==
'''Content to be finalised. First draft'''
==Author==
Eelco Klaver
==Introduction ==
This article describes the web security implications for the Struts MVC framework, how Struts helps in securing your web applications and where special attention is needed. It will not describe the internal details of Struts.

==Architecture==
The framework provides its own web Controller component. This Controller acts as a bridge between the application's Model and the web View. When a request is received, the Controller invokes an Action class. The Action class interacts with the Model to examine or update the application's state. The framework provides an ActionForm class to help transfer data between Model and View.

==Components==
===Action===
* No distinction is made between HTTP GET and POST method. Both methods are mapped to the same Action execute method.

===ActionForm===

===Validation===
* Integration with commons validator

==Configuration==

==Security==
===Roles===
In the struts-config.xml configuration file it is possible to specify a roles attribute, a comma-delimited list of security role names that are allowed access to the ActionMapping object.

<pre>
<action
roles="administrator,contributor"
path="/article/Edit"
parameter="org.article.FindByArticle"
name="articleForm"
scope="request">
<forward
name="success"
path="article.jsp"/>
</action>
</pre>
[[Category:OWASP Java Project]]

Talk:OWASP Java Project Roadmap

2007-10-23T12:59:34Z

Eklaver: /* Web Services Security */

This is the discussion page for the Java Project Roadmap. You can add your thoughts and comments below. Please make them easy to read and end your entries with <nowiki>~~~~</nowiki> to sign your entries.

==Ideas==

* I think we should consider revamping the roadmap with specific article titles and content that we'd like to get written. For example, I'm considering writing an article on how to set up Eclipse to do a code review. It would be nice to link that in here, but I'm not sure just where. I was thinking something like this....

; [[Using Eclipse for security code review]]
: This article will cover setting up Eclipse with plugins like FindBugs, jlint, PMD, and Metrics. Then it will explore how you can use the various search and code browsing functions to find and diagnose potential vulnerabilities. [[User:Jeff Williams|Jeff Williams]] 15:01, 22 June 2006 (EDT)

Sounds like some excellent content! Couldn't this fit in to the [http://www.owasp.org/index.php?title=Talk:OWASP_Java_Project_Roadmap#Code_Analysis_Tools Code Analysis Tools] section (even if we have to rename the section to something like "Code Analysis Techniques")? Since the Eclipse example is something core to the Java project, I think it should be placed under a real heading, but for other miscellaneous content, I've created a Resources section which could include external articles, books and other resources. [[User:Stephendv|Stephendv]] 04:18, 26 June 2006 (EDT)

==J2EE Security for Architects==
<table border=1 cellpadding=5>
<tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
<tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
<tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
<tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
</table>
===Design considerations===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Discuss the security implications of common J2EE architectures. This could be discussed in terms of: Authentication, Authorisation, Data Validation, Cross Site Scripting protection. Other architecture concerns such as scalability, performance and maintainability can also be mentioned, but the focus on security should not be lost.

Any other security concerns that should be addressed during the design phase should also be mentioned here.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Architectural considerations
** EJB Middle tier
** Web Services Middle tier
** Spring Middle tier

===Noteworthy Frameworks===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Discuss important and relevant Java security frameworks that would be useful to architects. The information should be at a suitably high level, for example, by discussing the advantages and features as well as the associated costs (direct and indirect) of using the frameworks.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Acegi
* Commons validator
* jGuard
* Stinger seems to be parked for a while now, is this correct Jeff?
** Stinger is
** CVS HEAD is in a functional state; needs work on docs and new features [[User:Roman|Roman]] 00:15, 13 June 2006 (EDT)
Most web tier frameworks will prevent XSS attacks, so listing them all in this section is a bit verbose, would prefer to see them listed in the XSS section. --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT)

I think Struts should be covered too - Rohyt

Struts is important as a web framework, but there are many frameworks that provide the same functionality from a security point of view. I think it makes sense to discuss struts as a web framework in section on XSS below with the other popular web frameworks rather than give it a special place in this section which only covers security specific frameworks. --[[User:Stephendv|Stephendv]] 07:22, 18 June 2006 (EDT)

==J2EE Security for Developers==
<table border=1 cellpadding=5>
<tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
<tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
<tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
<tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
</table>
===Java Security Basics===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Provide an introduction into the basic security services provided by the Java language and environment. Remember to keep this relevant for web developers for the initial release - there may be a potential to expand this to thick clients in subsequent releases.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Class Loading
* Bytecode verifier
* The Security Manager and security.policy file

===Input Validation===
* Overview

==== SQL Injection====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Provide cursory background information on SQL injection and refer to the Guide for more indepth coverage (no need to duplicate info in the Guide). This section should provide practical advise and real-world code examples for developers. If you feel that a popular persistence framework is not covered, please add it!</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Overview
* Prevention
** White Listing
** Prepared Statements
** Stored Procedures
** Hibernate
** Ibatis
** Spring JDBC
** EJB 3.0?
** JDO?

====Cross Site Scripting (XSS)====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Provide cursory background information on XSS and refer to the Guide for more indepth coverage. This section should provide practical advise and real-world code examples for developers. If you would like to see coverage of a web framework that's not listed, please add it!</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Overview
* Prevention
** White Listing
** Manual HTML Encoding
** Preventing XSS in popular Web Frameworks
*** JSP/JSTL
*** Struts
*** Spring MVC
*** Java Server Faces
*** WebWork
*** Wicket
*** Tapestry
* CSRF attack

==== LDAP Injection ====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing LDAP injection.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Overview
* Prevention

==== XPATH Injection ====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing XPATH injection.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Overview
* Prevention

==== Miscellaneous Injection Attacks ====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Should contain practical real-world advise and code examples.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* HTTP Response splitting
* Command injection - Runtime.getRuntime().exec()

=== Authentication===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Discuss authentication for Java and J2EE apps under the suggested headings below. Examples for container managed authentication of specific application servers are also welcome.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Storing credentials
* Hashing
* SSL Best Practices
* CAPTCHA systems (such as jcaptcha)
* Container-managed authentication with Realms
* JAAS Authentication
* Password length & complexity

===Session Management===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>The generic problems and solutions for session management are covered in the Guide. This section should focus on Java specific examples. </td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Logout
* Session Timeout
* Absolute Timeout
* Session Fixation
* Terminating sessions
** Terminating sessions when the browser window is closed

===Authorization===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* In presentation layer
* In business logic
* In data layer
* Declarative v/s Programmatic
* web.xml configuration
* [[Forced browsing]]
* JAAS
* EJB Authorization
* Acegi
* JACC
* Check horizontal privilege

=== Encryption===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* JCE
* Storing db secrets
* Encrypting JDBC connections
* JSSE
* Random number generation

=== Error Handling & Logging===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Output Validation
* Custom Errors
* Logging - why log? what to log? log4j, etc.
* Exception handling techniques
** fail-open/fail-closed
** resource cleanup
** finally block
** swallowing exceptions
* Exception handling frameworks
** Servlet spec - web.xml
** JSP errorPage
* Web application forensics and how it differs from conventional forensics. This will emphasize the importance of appropriate exception handling and logging - Rohyt

=== Web Services Security ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Discuss securely implementing Web Services using Java technologies. Examples using specific frameworks are welcome. The topic list is a bit light at the moment, please add more topics if they're relevant.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* SAML
* (X)WS-Security
* SunJWSDP
* XML Signature (JSR 105)
* XML Encryption (JSR 106)
* ...?
I think this section should also include WSS4J and a description of how XWS-Security and WSS4J can be integrated in the major Java Web Services Frameworks, such as Spring-WS, Axis, XFire, etc. (see also http://www.nljug.org/pages/events/content/jfall_2007/sessions/00028/) [[User:Eklaver|Eelco Klaver]] 08:59, 23 October 2007 (EDT)

=== Code Analysis Tools ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>The introduction should cover the advantages and short comings of code analysis tools. An overview of the current state of the art and the available tools would go well here. As a start, only open source tools are listed, but if vendors of commercial tools adhere to the [[Tutorial]] guidelines, these submissions will be gladly received.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Introduction
* FindBugs
** Creating custom rules
* PMD
** Creating custom rules
* JLint
* Jmetrics

I proposed some guidelines for the entire OWASP site
in the [[Tutorial]] page. What do you think?? [[User:Jeff Williams|Jeff Williams]] 15:01, 22 June 2006 (EDT)

I didn't know this existed. Replaced the above with a link to the [[Tutorial]] page. --[[User:Stephendv|Stephendv]] 04:03, 26 June 2006 (EDT)

== J2EE Security For Deployers ==
<table border=1 cellpadding=5>
<tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
<tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
<tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
<tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
</table>
=== Securing Popular J2EE Servers ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Practical step-by-step guides to securing various J2EE servers. Examples of secure configurations can also be provided for download. If configurations are provided, they should be properly commented so that the rationale for configuration settings is clearly explained. Users of the configurations should be provided with enough information to make their own risk decisions.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Securing Tomcat
* Securing JBoss
* Securing WebLogic
* Securing WebSphere
* Others...

=== Defining a Java Security Policy ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Practical information on creating a Java security policies for J2EE servers.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Jeff's tool? --[[User:Stephendv|Stephendv]] 08:37, 12 June 2006 (EDT)
* jChains (www.jchains.org)

=== Protecting Binaries ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>This should be focussed on web applications, so examples should include applets and web start apps.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
- Discuss Bytecode Manipulation Tools and Techniques - Rohyt
* Bytecode obfuscation
* Convert bytecode to native machine code
* jarsigner

Struts

2007-05-31T05:32:49Z

Eklaver:

Struts

2007-05-31T05:32:02Z

Eklaver: /* Validation */

Struts

2007-05-31T05:31:06Z

Eklaver: /* Architecture */

Struts

2007-05-31T05:27:55Z

Eklaver:

Struts

2007-05-31T05:16:02Z

Eklaver: New page: ==Status== '''Content to be finalised. First draft''' ==Author== Eelco Klaver ==Introduction == ==Architecture== ==Components== ===Action=== ===ActionForm=== ===Validation=== ==Con...

==Status==
'''Content to be finalised. First draft'''
==Author==
Eelco Klaver
==Introduction ==

==Architecture==

==Components==
===Action===

===ActionForm===

===Validation===

==Configuration==
==Roles==

[[Category:OWASP Java Project]]

OWASP Java Table of Contents

2007-05-31T05:10:24Z

Eklaver: /* Noteworthy Frameworks */

<b>Key:</b>
* xx%: Progress status of the paragraph
* <b>Review</b>: The paragraph needs a review
* TD: Paragraph to be assigned

==[[J2EE Security for Architects]]==
Discuss the security implications of common J2EE architectures. This could be discussed in terms of: Authentication, Authorisation, Data Validation, Cross Site Scripting protection. Other architecture concerns such as scalability, performance and maintainability can also be mentioned, but the focus on security should not be lost.

Any other security concerns that should be addressed during the design phase should also be mentioned here.
===Design considerations===
* Architectural considerations (0%, TD)
** EJB Middle tier (0%, TD)
** Web Services Middle tier (0%, TD)
** Spring Middle tier (0%, TD)

==[[J2EE Security for Developers]]==
=== Noteworthy Frameworks ===
Discuss important and relevant Java security frameworks that would be useful to architects. The information should be at a suitably high level, for example, by discussing the advantages and features as well as the associated costs (direct and indirect) of using the frameworks.

(0%, Seeking Volunteers)
* [[Struts]] (Eelco Klaver - Planning - 0%)
* Turbine
* [[Java Server Faces]] (Sam Reghenzi - 90%, Finalising content)
* Tapestry
* Webwork
* Cocoon
* Tiles
* SiteMesh
* Spring (Eelco Klaver - Planning - 0%)

===[[Java Security Basics]]===
Provide an introduction into the basic security services provided by the Java language and environment. Remember to keep this relevant for web developers for the initial release - there may be a potential to expand this to thick clients in subsequent releases.
* Class Loading (0%, Shyaam Sundar, <b>Review</b>)
* Bytecode verifier (0%, Shyaam Sundar, <b>Review</b>)
* The Security Manager and security.policy file (0%, Shyaam Sundar, <b>Review</b>)

===Input Validation Overview ===
Input validation is perhaps the most important category of application security. Any data entering a software system must be verified to contain safe data that is not mounting a SQL Injection, XSS, CSRF or other form of attack. This is done primarily through the use of regular expressions. It's crucial not to hard-code input validation routines. Regular expressions should contained within a configuration file that can easily updated by an InfoSec professional and not require a programmers intervention or deployment of new application code. Application security needs change over time as new attack vectors are discovered. Application administers need to be able to react to these changes as quickly as possible.

===Input Validation ===
* Dangerous calls (BufferedReader.readLine(), ServletRequest.getParameter(), etc...) (0%, TD)
* [[How to add validation logic to HttpServletRequest]] (100%, Jeff Williams, Complete)
* [[How to perform HTML entity encoding in Java]] (100%, Jeff Williams, Complete)

==== [[Preventing SQL Injection in Java]] ====
* Overview
* Prevention (60%, Stephen de Vries, <b>Review</b>)
** White Listing
** Prepared Statements
** Stored Procedures
** Hibernate
** Ibatis (60%, Rohyt Belani, <b>Review</b>)
** Spring JDBC
** EJB 3.0
** JDO

==== [[Preventing LDAP Injection in Java]] ====
* Overview (100%, Stephen de Vries, Complete)
* Prevention (100%, Stephen de Vries, Complete)

==== [[XPATH Injection]] ====
As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing XPATH injection.
* Overview (0%, TD)
* Prevention (0%, TD)

==== Miscellaneous Injection Attacks ====
* HTTP Response splitting (0%, TD)
* Command injection - Runtime.getRuntime().exec() (0%, TD)

=== Authentication===
* Storing credentials - (0%, Adrian San Juan, <b>Review</b>)
* [[Hashing Java|Hashing]] - (100%, Michel Prunet, <b>Review</b>)
* [[SSL Best Practices]] - (20%, Philippe Curmin, <b>Review</b>)
* [[Using JCaptcha]] - (100%, Dave Ferguson, <b>Review</b>)
* Container-managed authentication with Realms
** [[Declarative Access Control in Java]] - (100%, Dave Ferguson, Completed)
* [[JAAS Timed Login Module]] - (100%, Stephen de Vries, <b>Review</b>)
* [[JAAS Tomcat Login Module]] - (100%, Stephen de Vries, <b>Review</b>)
* [[Password length & complexity]] - (100%, Adrian San Juan, <b>Review</b>)

===Session Management ===
The generic problems and solutions for session management are covered in the Guide. This section should focus on Java specific examples.
* Logout (0%, TD)
* Session Timeout (0%, TD)
* Absolute Timeout (0%, TD)
* [[Session Fixation in Java]] (100%, Rohyt Belani, <b>Review</b>)
* Terminating sessions (0%, TD)
** Terminating sessions when the browser window is closed

===Authorization===
* Declarative v/s Programmatic (0%, TD)
* EJB Authorization (0%, TD)
* Acegi (0%, TD)
* JACC (0%, TD)
* Check horizontal privilege (0%, TD)

=== Encryption===
* [http://www.owasp.org/index.php/Using_the_Java_Cryptographic_Extensions JCE] (80%, Joe Prasanna Kumar - To be reviewed)
* Storing db secrets (0%, TD)
* Encrypting JDBC connections (0%, TD)
* [http://www.owasp.org/index.php/Using_the_Java_Secure_Socket_Extensions JSSE] (80%, Joe Prasanna Kumar - To be reviewed)
* [http://www.owasp.org/index.php/Using_the_Java_Cryptographic_Extensions Random number generation] (80%, Joe Prasanna Kumar - To be reviewed)

=== Error Handling & Logging===
* Logging - why log? what to log? log4j, etc. (0%, TD)
* Exception handling techniques (0%, TD)
** fail-open/fail-closed
** resource cleanup
** finally block
** swallowing exceptions
* Exception handling frameworks (50%, TD)
** Servlet spec - web.xml [[Securing tomcat]] (100%, Darren Edmonds, Completed)
** JSP errorPage (0%, TD)
* Web application forensics (0%, TD)

=== Web Services Security ===
* SAML (0%, TD)
* (X)WS-Security (0%, TD)
* SunJWSDP (0%, TD)
* WSS4J (0%, Eelco Klaver)
* XML Signature (JSR 105) (0%, TD)
* XML Encryption (JSR 106) (0%, TD)

=== Code Analysis Tools ===
The introduction should cover the advantages and short comings of code analysis tools. An overview of the current state of the art and the available tools would go well here. As a start, only open source tools are listed, but if vendors of commercial tools adhere to the [[Tutorial]] guidelines, these submissions will be gladly received.
* Introduction (0%, TD)
* [[:Category:OWASP LAPSE Project]] (100%, <b>Review</b>)
* FindBugs (0%, TD)
** Creating custom rules
* PMD (0%, TD)
** Creating custom rules
* JLint (0%, TD)
* Jmetrics (0%, TD)

== [[J2EE Security For Deployers]] ==
Practical step-by-step guides to securing various J2EE servers. Examples of secure configurations can also be provided for download. If configurations are provided, they should be properly commented so that the rationale for configuration settings is clearly explained. Users of the configurations should be provided with enough information to make their own risk decisions.
=== Securing Popular J2EE Servers ===
* [[Securing tomcat|Securing Tomcat]] - (100%, Darren Edmonds, Completed)
* Securing JBoss (0%, TD)
* Securing WebLogic (0%, TD)
* Securing WebSphere (0%, TD)
* Others...

=== Defining a Java Security Policy ===
Practical information on creating a Java security policies for J2EE servers.
* PolicyTool - JChains already provides this functionality, one policy tool is enough.
* jChains (www.jchains.org) - (0%, TD)

=== Protecting Binaries ===
* Bytecode manipulation tools and techniques (0%, TD)
* [[Bytecode obfuscation]] (100%, Pierre Parrend, <b>Review</b>)
* Convert bytecode to native machine code (0%, TD)
* [[Protecting code archives with digital signatures]] (100%, Pierre Parrend, <b>Review</b>)
* [[Signing jar files with jarsigner]] (100%, Pierre Parrend, <b>Review</b>)

==[[J2EE Security for Security Analysts and Testers]]==
* Using Eclipse to verify Java applications (0%, TD)
* Using [[:Category:OWASP WebScarab Project|WebScarab]] to find vulnerabilities in J2EE applications - (0%, TD)
* Decompiling Java bytecode (0%, TD)

== [[Java Security Resources]] (ongoing)==

[[Category:OWASP Java Project]]

OWASP Java Table of Contents

2007-05-31T05:08:16Z

Eklaver: /* Web Services Security */

<b>Key:</b>
* xx%: Progress status of the paragraph
* <b>Review</b>: The paragraph needs a review
* TD: Paragraph to be assigned

==[[J2EE Security for Architects]]==
Discuss the security implications of common J2EE architectures. This could be discussed in terms of: Authentication, Authorisation, Data Validation, Cross Site Scripting protection. Other architecture concerns such as scalability, performance and maintainability can also be mentioned, but the focus on security should not be lost.

Any other security concerns that should be addressed during the design phase should also be mentioned here.
===Design considerations===
* Architectural considerations (0%, TD)
** EJB Middle tier (0%, TD)
** Web Services Middle tier (0%, TD)
** Spring Middle tier (0%, TD)

==[[J2EE Security for Developers]]==
=== Noteworthy Frameworks ===
Discuss important and relevant Java security frameworks that would be useful to architects. The information should be at a suitably high level, for example, by discussing the advantages and features as well as the associated costs (direct and indirect) of using the frameworks.

(0%, Seeking Volunteers)
* Struts (Eelco Klaver - Planning - 0%)
* Turbine
* [[Java Server Faces]] (Sam Reghenzi - 90%, Finalising content)
* Tapestry
* Webwork
* Cocoon
* Tiles
* SiteMesh
* Spring (Eelco Klaver - Planning - 0%)

===[[Java Security Basics]]===
Provide an introduction into the basic security services provided by the Java language and environment. Remember to keep this relevant for web developers for the initial release - there may be a potential to expand this to thick clients in subsequent releases.
* Class Loading (0%, Shyaam Sundar, <b>Review</b>)
* Bytecode verifier (0%, Shyaam Sundar, <b>Review</b>)
* The Security Manager and security.policy file (0%, Shyaam Sundar, <b>Review</b>)

===Input Validation Overview ===
Input validation is perhaps the most important category of application security. Any data entering a software system must be verified to contain safe data that is not mounting a SQL Injection, XSS, CSRF or other form of attack. This is done primarily through the use of regular expressions. It's crucial not to hard-code input validation routines. Regular expressions should contained within a configuration file that can easily updated by an InfoSec professional and not require a programmers intervention or deployment of new application code. Application security needs change over time as new attack vectors are discovered. Application administers need to be able to react to these changes as quickly as possible.

===Input Validation ===
* Dangerous calls (BufferedReader.readLine(), ServletRequest.getParameter(), etc...) (0%, TD)
* [[How to add validation logic to HttpServletRequest]] (100%, Jeff Williams, Complete)
* [[How to perform HTML entity encoding in Java]] (100%, Jeff Williams, Complete)

==== [[Preventing SQL Injection in Java]] ====
* Overview
* Prevention (60%, Stephen de Vries, <b>Review</b>)
** White Listing
** Prepared Statements
** Stored Procedures
** Hibernate
** Ibatis (60%, Rohyt Belani, <b>Review</b>)
** Spring JDBC
** EJB 3.0
** JDO

==== [[Preventing LDAP Injection in Java]] ====
* Overview (100%, Stephen de Vries, Complete)
* Prevention (100%, Stephen de Vries, Complete)

==== [[XPATH Injection]] ====
As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing XPATH injection.
* Overview (0%, TD)
* Prevention (0%, TD)

==== Miscellaneous Injection Attacks ====
* HTTP Response splitting (0%, TD)
* Command injection - Runtime.getRuntime().exec() (0%, TD)

=== Authentication===
* Storing credentials - (0%, Adrian San Juan, <b>Review</b>)
* [[Hashing Java|Hashing]] - (100%, Michel Prunet, <b>Review</b>)
* [[SSL Best Practices]] - (20%, Philippe Curmin, <b>Review</b>)
* [[Using JCaptcha]] - (100%, Dave Ferguson, <b>Review</b>)
* Container-managed authentication with Realms
** [[Declarative Access Control in Java]] - (100%, Dave Ferguson, Completed)
* [[JAAS Timed Login Module]] - (100%, Stephen de Vries, <b>Review</b>)
* [[JAAS Tomcat Login Module]] - (100%, Stephen de Vries, <b>Review</b>)
* [[Password length & complexity]] - (100%, Adrian San Juan, <b>Review</b>)

===Session Management ===
The generic problems and solutions for session management are covered in the Guide. This section should focus on Java specific examples.
* Logout (0%, TD)
* Session Timeout (0%, TD)
* Absolute Timeout (0%, TD)
* [[Session Fixation in Java]] (100%, Rohyt Belani, <b>Review</b>)
* Terminating sessions (0%, TD)
** Terminating sessions when the browser window is closed

===Authorization===
* Declarative v/s Programmatic (0%, TD)
* EJB Authorization (0%, TD)
* Acegi (0%, TD)
* JACC (0%, TD)
* Check horizontal privilege (0%, TD)

=== Encryption===
* [http://www.owasp.org/index.php/Using_the_Java_Cryptographic_Extensions JCE] (80%, Joe Prasanna Kumar - To be reviewed)
* Storing db secrets (0%, TD)
* Encrypting JDBC connections (0%, TD)
* [http://www.owasp.org/index.php/Using_the_Java_Secure_Socket_Extensions JSSE] (80%, Joe Prasanna Kumar - To be reviewed)
* [http://www.owasp.org/index.php/Using_the_Java_Cryptographic_Extensions Random number generation] (80%, Joe Prasanna Kumar - To be reviewed)

=== Error Handling & Logging===
* Logging - why log? what to log? log4j, etc. (0%, TD)
* Exception handling techniques (0%, TD)
** fail-open/fail-closed
** resource cleanup
** finally block
** swallowing exceptions
* Exception handling frameworks (50%, TD)
** Servlet spec - web.xml [[Securing tomcat]] (100%, Darren Edmonds, Completed)
** JSP errorPage (0%, TD)
* Web application forensics (0%, TD)

=== Web Services Security ===
* SAML (0%, TD)
* (X)WS-Security (0%, TD)
* SunJWSDP (0%, TD)
* WSS4J (0%, Eelco Klaver)
* XML Signature (JSR 105) (0%, TD)
* XML Encryption (JSR 106) (0%, TD)

=== Code Analysis Tools ===
The introduction should cover the advantages and short comings of code analysis tools. An overview of the current state of the art and the available tools would go well here. As a start, only open source tools are listed, but if vendors of commercial tools adhere to the [[Tutorial]] guidelines, these submissions will be gladly received.
* Introduction (0%, TD)
* [[:Category:OWASP LAPSE Project]] (100%, <b>Review</b>)
* FindBugs (0%, TD)
** Creating custom rules
* PMD (0%, TD)
** Creating custom rules
* JLint (0%, TD)
* Jmetrics (0%, TD)

== [[J2EE Security For Deployers]] ==
Practical step-by-step guides to securing various J2EE servers. Examples of secure configurations can also be provided for download. If configurations are provided, they should be properly commented so that the rationale for configuration settings is clearly explained. Users of the configurations should be provided with enough information to make their own risk decisions.
=== Securing Popular J2EE Servers ===
* [[Securing tomcat|Securing Tomcat]] - (100%, Darren Edmonds, Completed)
* Securing JBoss (0%, TD)
* Securing WebLogic (0%, TD)
* Securing WebSphere (0%, TD)
* Others...

=== Defining a Java Security Policy ===
Practical information on creating a Java security policies for J2EE servers.
* PolicyTool - JChains already provides this functionality, one policy tool is enough.
* jChains (www.jchains.org) - (0%, TD)

=== Protecting Binaries ===
* Bytecode manipulation tools and techniques (0%, TD)
* [[Bytecode obfuscation]] (100%, Pierre Parrend, <b>Review</b>)
* Convert bytecode to native machine code (0%, TD)
* [[Protecting code archives with digital signatures]] (100%, Pierre Parrend, <b>Review</b>)
* [[Signing jar files with jarsigner]] (100%, Pierre Parrend, <b>Review</b>)

==[[J2EE Security for Security Analysts and Testers]]==
* Using Eclipse to verify Java applications (0%, TD)
* Using [[:Category:OWASP WebScarab Project|WebScarab]] to find vulnerabilities in J2EE applications - (0%, TD)
* Decompiling Java bytecode (0%, TD)

== [[Java Security Resources]] (ongoing)==

[[Category:OWASP Java Project]]

Talk:OWASP Java Project Roadmap

2006-06-23T09:12:30Z

Eklaver: /* Web Services Security */

This is the discussion page for the Java Project Roadmap. You can add your thoughts and comments below. Please make them easy to read and end your entries with <nowiki>~~~~</nowiki> to sign your entries.

==Ideas==

* I think we should consider revamping the roadmap with specific article titles and content that we'd like to get written. For example, I'm considering writing an article on how to set up Eclipse to do a code review. It would be nice to link that in here, but I'm not sure just where. I was thinking something like this....

; [[Using Eclipse for security code review]]
: This article will cover setting up Eclipse with plugins like FindBugs, jlint, PMD, and Metrics. Then it will explore how you can use the various search and code browsing functions to find and diagnose potential vulnerabilities. [[User:Jeff Williams|Jeff Williams]] 15:01, 22 June 2006 (EDT)

==J2EE Security for Architects==
<table border=1 cellpadding=5>
<tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
<tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
<tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
<tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
</table>
===Design considerations===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Discuss the security implications of common J2EE architectures. This could be discussed in terms of: Authentication, Authorisation, Data Validation, Cross Site Scripting protection. Other architecture concerns such as scalability, performance and maintainability can also be mentioned, but the focus on security should not be lost.

Any other security concerns that should be addressed during the design phase should also be mentioned here.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Architectural considerations
** EJB Middle tier
** Web Services Middle tier
** Spring Middle tier

===Noteworthy Frameworks===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Discuss important and relevant Java security frameworks that would be useful to architects. The information should be at a suitably high level, for example, by discussing the advantages and features as well as the associated costs (direct and indirect) of using the frameworks.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Acegi
* Commons validator
* jGuard
* Stinger seems to be parked for a while now, is this correct Jeff?
** Stinger is
** CVS HEAD is in a functional state; needs work on docs and new features [[User:Roman|Roman]] 00:15, 13 June 2006 (EDT)
Most web tier frameworks will prevent XSS attacks, so listing them all in this section is a bit verbose, would prefer to see them listed in the XSS section. --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT)

I think Struts should be covered too - Rohyt

Struts is important as a web framework, but there are many frameworks that provide the same functionality from a security point of view. I think it makes sense to discuss struts as a web framework in section on XSS below with the other popular web frameworks rather than give it a special place in this section which only covers security specific frameworks. --[[User:Stephendv|Stephendv]] 07:22, 18 June 2006 (EDT)

==J2EE Security for Developers==
<table border=1 cellpadding=5>
<tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
<tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
<tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
<tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
</table>
===Java Security Basics===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Provide an introduction into the basic security services provided by the Java language and environment. Remember to keep this relevant for web developers for the initial release - there may be a potential to expand this to thick clients in subsequent releases.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Class Loading
* Bytecode verifier
* The Security Manager and security.policy file

===Input Validation===
* Overview

==== SQL Injection====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Provide cursory background information on SQL injection and refer to the Guide for more indepth coverage (no need to duplicate info in the Guide). This section should provide practical advise and real-world code examples for developers. If you feel that a popular persistence framework is not covered, please add it!</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Overview
* Prevention
** White Listing
** Prepared Statements
** Stored Procedures
** Hibernate
** Ibatis
** Spring JDBC
** EJB 3.0?
** JDO?

====Cross Site Scripting (XSS)====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Provide cursory background information on XSS and refer to the Guide for more indepth coverage. This section should provide practical advise and real-world code examples for developers. If you would like to see coverage of a web framework that's not listed, please add it!</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Overview
* Prevention
** White Listing
** Manual HTML Encoding
** Preventing XSS in popular Web Frameworks
*** JSP/JSTL
*** Struts
*** Spring MVC
*** Java Server Faces
*** WebWork
*** Wicket
*** Tapestry
* CSRF attack

==== LDAP Injection ====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing LDAP injection.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Overview
* Prevention

==== XPATH Injection ====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing XPATH injection.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Overview
* Prevention

==== Miscellaneous Injection Attacks ====
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Should contain practical real-world advise and code examples.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* HTTP Response splitting
* Command injection - Runtime.getRuntime().exec()

=== Authentication===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Discuss authentication for Java and J2EE apps under the suggested headings below. Examples for container managed authentication of specific application servers are also welcome.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Storing credentials
* Hashing
* SSL Best Practices
* CAPTCHA systems (such as jcaptcha)
* Container-managed authentication with Realms
* JAAS Authentication
* Password length & complexity

===Session Management===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>The generic problems and solutions for session management are covered in the Guide. This section should focus on Java specific examples. </td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Logout
* Session Timeout
* Absolute Timeout
* Session Fixation
* Terminating sessions
** Terminating sessions when the browser window is closed

===Authorization===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* In presentation layer
* In business logic
* In data layer
* Declarative v/s Programmatic
* web.xml configuration
* [[Forced browsing]]
* JAAS
* EJB Authorization
* Acegi
* JACC
* Check horizontal privilege

=== Encryption===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* JCE
* Storing db secrets
* Encrypting JDBC connections
* JSSE
* Random number generation

=== Error Handling & Logging===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Output Validation
* Custom Errors
* Logging - why log? what to log? log4j, etc.
* Exception handling techniques
** fail-open/fail-closed
** resource cleanup
** finally block
** swallowing exceptions
* Exception handling frameworks
** Servlet spec - web.xml
** JSP errorPage
* Web application forensics and how it differs from conventional forensics. This will emphasize the importance of appropriate exception handling and logging - Rohyt

=== Web Services Security ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Discuss securely implementing Web Services using Java technologies. Examples using specific frameworks are welcome. The topic list is a bit light at the moment, please add more topics if they're relevant.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* SAML
* (X)WS-Security
* SunJWSDP
* XML Signature (JSR 105)
* XML Encryption (JSR 106)
* ...?

=== Code Analysis Tools ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>The introduction should cover the advantages and short comings of code analysis tools. An overview of the current state of the art and the available tools would go well here. As a start, only open source tools are listed, but if vendors of commercial tools adhere to the [[Contributing to the OWASP Java project]] guidelines, these submissions will be gladly received.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Introduction
* FindBugs
** Creating custom rules
* PMD
** Creating custom rules
* JLint
* Jmetrics

I proposed some guidelines for the entire OWASP site
in the [[Tutorial]] page. What do you think?? [[User:Jeff Williams|Jeff Williams]] 15:01, 22 June 2006 (EDT)

== J2EE Security For Deployers ==
<table border=1 cellpadding=5>
<tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
<tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
<tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
<tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
</table>
=== Securing Popular J2EE Servers ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Practical step-by-step guides to securing various J2EE servers. Examples of secure configurations can also be provided for download. If configurations are provided, they should be properly commented so that the rationale for configuration settings is clearly explained. Users of the configurations should be provided with enough information to make their own risk decisions.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Securing Tomcat
* Securing JBoss
* Securing WebLogic
* Securing WebSphere
* Others...

=== Defining a Java Security Policy ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>Practical information on creating a Java security policies for J2EE servers.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
* Jeff's tool? --[[User:Stephendv|Stephendv]] 08:37, 12 June 2006 (EDT)
* jChains (www.jchains.org)

=== Protecting Binaries ===
<table border=1 cellpadding=5>
<tr><td valign="top"><b>Objective:</b></td><td>This should be focussed on web applications, so examples should include applets and web start apps.</td></tr>
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
<tr><td><b>Reviewers:</b></td><td></td></tr>
</table>
- Discuss Bytecode Manipulation Tools and Techniques - Rohyt
* Bytecode obfuscation
* Convert bytecode to native machine code
* jarsigner