OWASP - User contributions [en]

ESAPI Javadocs

2009-05-22T17:14:14Z

Kevin.Fealey: /* Latest Javadocs */

==Latest Javadocs==
The latest Javadocs for the ESAPI can be found [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html here].

==How to create Javadocs for ESAPI using Eclipse v3.4==
First off, notice a folder called "javadoc resources" in the root directory of your ESAPI project. This folder contains images referenced from the Javadoc as well as overview-summary.html, which is the title page for the ESAPI Javadoc. The instructions below make reference to these files.
[[category:FIXME|image links not working]]
===To Generate Javadocs===
# ''Be sure you are in the Java EE perspective.'' To change your perspective, click the ''Window'' button on the main toolbar. Then click ''Open Perspective'' and choose ''Java EE''. If Java EE is not in the list, select ''Other...'' and find ''Java EE''. If Java EE is not in the list under Other, you may need to download Eclipse Ganymede (v3.4) for Java EE developers. Javadoc creation functionality may be built into your version of Eclipse, but that has not been tested.
# Then, click the ''Project'' button on the main toolbar. Select ''Generate Javadoc...''
# Find the Javadoc executable to use. This is usually javadoc.exe within your java bin directory, as shown in figure 1.
# Select the ESAPI source, but not the test files within your ESAPI project, as shown in figure 1.
# You should create Javadoc for members with visibility: Package, as shown in figure 1.
# Select the Javadoc output directory. This will likely be /doc under your ESAPI project folder.
# Click ''Next''.

Figure 1:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc1.jpg

# Designate a title for this Javadoc. Generally, this should be "OWASP Enterprise Security API (ESAPI)".
# Use Default: Under Basic Options, make sure all checkboxes are selected, as shown in Figure 2.
# Use Default: Make sure Javadocs for referenced archives are not generated, as shown in Figure 2.
# Use Default: No custom style sheet should be specified, as shown in Figure 2.
# Click ''Next''.

Figure 2:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc2.jpg

# ''The Overview page must be selected, as shown in Figure 3''. ''It should point to overview-summary.html in the javadoc resources folder''.
# Use Default: The JRE source compatibility should be selected as 1.4, as shown in Figure 3.
# Click ''Finish''.

Figure 3:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc3.jpg

# If it isn't already there, copy the folder "doc-files" from "javadoc resources" to org/owasp/esapi within your new javadoc directory.
# To view these new javadocs, double click on: <yourdocsfolder>/index.html

=== Submitting these new javadocs to SVN ===
# To submit these newly generated javadocs, simply use Team --> Commit in Eclipse. Note: Please check in updates into the existing /doc directory, rather than creating a new directory.
# If you receive version control errors during the submit, follow the following steps:
* Navigate to your ESAPI Project/doc/org/owasp/esapi/doc-files directory.
* Delete the folder called .svn from this folder and all subdirectories (wiki).
* In the Navigator view in Eclipse, Right-click the doc-files folder and select "Team" -> "Add to svn:ignore...".
* In the Navigator view in Eclipse, Right-click the doc-files folder again and select "Team" -> "Add to Version Control". You should receive a message saying that you previously asked to ignore this file. Click yes.

== Why do my newly generated Javadocs render as plain text in my browser? ==
Unfortunately, using this method of Javadoc generation does not set MIME types for the HTML files generated. This means that to the browser, your HTML files are just text files, and will display as such. Luckily Subclipse has a function to fix this. We are going to tell Subclipse to automatically set the MIME type of HTML files to text/html and the MIME type of CSS files to text/css every time it commits a change.

# The first thing you need to do is enable auto properties for your SVN client. If you do not enable auto properties, you will have to manually set the properties (MIME type) of every HTML and CSS file.
* In Windows, open a terminal by typing "cmd" (with no quotes) into "Run" on the Start menu. If you are using Vista, you can type "cmd" directly into the "Start Searching" bar.
* Type (again, and from now on, with no quotes) "cd %APPDATA%" and hit enter.
* Type "cd Subversion" and hit enter.
* Type "notepad config". This will open the SVN configuration file in notepad.
* Find the line "enable-auto-props = yes" and remove the # from the front of it. This enables auto properties.
# Then, tell Subversion which MIME types to set for which files:
* Towards the bottom of the file, find a section called ''[auto-props]''. Add the following to this section:
*.html = svn:mime-type=text/html
*.css = svn:mime-type=text/css
# Save the file.
''Any further commits to the SVN should set the MIME type properly.''

Your Javadoc should be ready to commit and view!

[[Category:OWASP Enterprise Security API]]

ESAPI Javadocs

2009-05-22T17:13:40Z

Kevin.Fealey: /* Latest Javadocs */

==Latest Javadocs==
The latest Javadocs for the ESAPI can be found [here http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html]

==How to create Javadocs for ESAPI using Eclipse v3.4==
First off, notice a folder called "javadoc resources" in the root directory of your ESAPI project. This folder contains images referenced from the Javadoc as well as overview-summary.html, which is the title page for the ESAPI Javadoc. The instructions below make reference to these files.
[[category:FIXME|image links not working]]
===To Generate Javadocs===
# ''Be sure you are in the Java EE perspective.'' To change your perspective, click the ''Window'' button on the main toolbar. Then click ''Open Perspective'' and choose ''Java EE''. If Java EE is not in the list, select ''Other...'' and find ''Java EE''. If Java EE is not in the list under Other, you may need to download Eclipse Ganymede (v3.4) for Java EE developers. Javadoc creation functionality may be built into your version of Eclipse, but that has not been tested.
# Then, click the ''Project'' button on the main toolbar. Select ''Generate Javadoc...''
# Find the Javadoc executable to use. This is usually javadoc.exe within your java bin directory, as shown in figure 1.
# Select the ESAPI source, but not the test files within your ESAPI project, as shown in figure 1.
# You should create Javadoc for members with visibility: Package, as shown in figure 1.
# Select the Javadoc output directory. This will likely be /doc under your ESAPI project folder.
# Click ''Next''.

Figure 1:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc1.jpg

# Designate a title for this Javadoc. Generally, this should be "OWASP Enterprise Security API (ESAPI)".
# Use Default: Under Basic Options, make sure all checkboxes are selected, as shown in Figure 2.
# Use Default: Make sure Javadocs for referenced archives are not generated, as shown in Figure 2.
# Use Default: No custom style sheet should be specified, as shown in Figure 2.
# Click ''Next''.

Figure 2:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc2.jpg

# ''The Overview page must be selected, as shown in Figure 3''. ''It should point to overview-summary.html in the javadoc resources folder''.
# Use Default: The JRE source compatibility should be selected as 1.4, as shown in Figure 3.
# Click ''Finish''.

Figure 3:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc3.jpg

# If it isn't already there, copy the folder "doc-files" from "javadoc resources" to org/owasp/esapi within your new javadoc directory.
# To view these new javadocs, double click on: <yourdocsfolder>/index.html

=== Submitting these new javadocs to SVN ===
# To submit these newly generated javadocs, simply use Team --> Commit in Eclipse. Note: Please check in updates into the existing /doc directory, rather than creating a new directory.
# If you receive version control errors during the submit, follow the following steps:
* Navigate to your ESAPI Project/doc/org/owasp/esapi/doc-files directory.
* Delete the folder called .svn from this folder and all subdirectories (wiki).
* In the Navigator view in Eclipse, Right-click the doc-files folder and select "Team" -> "Add to svn:ignore...".
* In the Navigator view in Eclipse, Right-click the doc-files folder again and select "Team" -> "Add to Version Control". You should receive a message saying that you previously asked to ignore this file. Click yes.

== Why do my newly generated Javadocs render as plain text in my browser? ==
Unfortunately, using this method of Javadoc generation does not set MIME types for the HTML files generated. This means that to the browser, your HTML files are just text files, and will display as such. Luckily Subclipse has a function to fix this. We are going to tell Subclipse to automatically set the MIME type of HTML files to text/html and the MIME type of CSS files to text/css every time it commits a change.

# The first thing you need to do is enable auto properties for your SVN client. If you do not enable auto properties, you will have to manually set the properties (MIME type) of every HTML and CSS file.
* In Windows, open a terminal by typing "cmd" (with no quotes) into "Run" on the Start menu. If you are using Vista, you can type "cmd" directly into the "Start Searching" bar.
* Type (again, and from now on, with no quotes) "cd %APPDATA%" and hit enter.
* Type "cd Subversion" and hit enter.
* Type "notepad config". This will open the SVN configuration file in notepad.
* Find the line "enable-auto-props = yes" and remove the # from the front of it. This enables auto properties.
# Then, tell Subversion which MIME types to set for which files:
* Towards the bottom of the file, find a section called ''[auto-props]''. Add the following to this section:
*.html = svn:mime-type=text/html
*.css = svn:mime-type=text/css
# Save the file.
''Any further commits to the SVN should set the MIME type properly.''

Your Javadoc should be ready to commit and view!

[[Category:OWASP Enterprise Security API]]

ESAPI Javadocs

2009-05-22T17:13:20Z

Kevin.Fealey: /* Latest Javadocs */

==Latest Javadocs==
The latest Javadocs for the ESAPI can be found at: [[http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html]]

==How to create Javadocs for ESAPI using Eclipse v3.4==
First off, notice a folder called "javadoc resources" in the root directory of your ESAPI project. This folder contains images referenced from the Javadoc as well as overview-summary.html, which is the title page for the ESAPI Javadoc. The instructions below make reference to these files.
[[category:FIXME|image links not working]]
===To Generate Javadocs===
# ''Be sure you are in the Java EE perspective.'' To change your perspective, click the ''Window'' button on the main toolbar. Then click ''Open Perspective'' and choose ''Java EE''. If Java EE is not in the list, select ''Other...'' and find ''Java EE''. If Java EE is not in the list under Other, you may need to download Eclipse Ganymede (v3.4) for Java EE developers. Javadoc creation functionality may be built into your version of Eclipse, but that has not been tested.
# Then, click the ''Project'' button on the main toolbar. Select ''Generate Javadoc...''
# Find the Javadoc executable to use. This is usually javadoc.exe within your java bin directory, as shown in figure 1.
# Select the ESAPI source, but not the test files within your ESAPI project, as shown in figure 1.
# You should create Javadoc for members with visibility: Package, as shown in figure 1.
# Select the Javadoc output directory. This will likely be /doc under your ESAPI project folder.
# Click ''Next''.

Figure 1:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc1.jpg

# Designate a title for this Javadoc. Generally, this should be "OWASP Enterprise Security API (ESAPI)".
# Use Default: Under Basic Options, make sure all checkboxes are selected, as shown in Figure 2.
# Use Default: Make sure Javadocs for referenced archives are not generated, as shown in Figure 2.
# Use Default: No custom style sheet should be specified, as shown in Figure 2.
# Click ''Next''.

Figure 2:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc2.jpg

# ''The Overview page must be selected, as shown in Figure 3''. ''It should point to overview-summary.html in the javadoc resources folder''.
# Use Default: The JRE source compatibility should be selected as 1.4, as shown in Figure 3.
# Click ''Finish''.

Figure 3:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc3.jpg

# If it isn't already there, copy the folder "doc-files" from "javadoc resources" to org/owasp/esapi within your new javadoc directory.
# To view these new javadocs, double click on: <yourdocsfolder>/index.html

=== Submitting these new javadocs to SVN ===
# To submit these newly generated javadocs, simply use Team --> Commit in Eclipse. Note: Please check in updates into the existing /doc directory, rather than creating a new directory.
# If you receive version control errors during the submit, follow the following steps:
* Navigate to your ESAPI Project/doc/org/owasp/esapi/doc-files directory.
* Delete the folder called .svn from this folder and all subdirectories (wiki).
* In the Navigator view in Eclipse, Right-click the doc-files folder and select "Team" -> "Add to svn:ignore...".
* In the Navigator view in Eclipse, Right-click the doc-files folder again and select "Team" -> "Add to Version Control". You should receive a message saying that you previously asked to ignore this file. Click yes.

== Why do my newly generated Javadocs render as plain text in my browser? ==
Unfortunately, using this method of Javadoc generation does not set MIME types for the HTML files generated. This means that to the browser, your HTML files are just text files, and will display as such. Luckily Subclipse has a function to fix this. We are going to tell Subclipse to automatically set the MIME type of HTML files to text/html and the MIME type of CSS files to text/css every time it commits a change.

# The first thing you need to do is enable auto properties for your SVN client. If you do not enable auto properties, you will have to manually set the properties (MIME type) of every HTML and CSS file.
* In Windows, open a terminal by typing "cmd" (with no quotes) into "Run" on the Start menu. If you are using Vista, you can type "cmd" directly into the "Start Searching" bar.
* Type (again, and from now on, with no quotes) "cd %APPDATA%" and hit enter.
* Type "cd Subversion" and hit enter.
* Type "notepad config". This will open the SVN configuration file in notepad.
* Find the line "enable-auto-props = yes" and remove the # from the front of it. This enables auto properties.
# Then, tell Subversion which MIME types to set for which files:
* Towards the bottom of the file, find a section called ''[auto-props]''. Add the following to this section:
*.html = svn:mime-type=text/html
*.css = svn:mime-type=text/css
# Save the file.
''Any further commits to the SVN should set the MIME type properly.''

Your Javadoc should be ready to commit and view!

[[Category:OWASP Enterprise Security API]]

ESAPI Javadocs

2009-05-22T17:13:05Z

Kevin.Fealey:

==Latest Javadocs==
The latest Javadocs for the ESAPI can be found at: [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html]

==How to create Javadocs for ESAPI using Eclipse v3.4==
First off, notice a folder called "javadoc resources" in the root directory of your ESAPI project. This folder contains images referenced from the Javadoc as well as overview-summary.html, which is the title page for the ESAPI Javadoc. The instructions below make reference to these files.
[[category:FIXME|image links not working]]
===To Generate Javadocs===
# ''Be sure you are in the Java EE perspective.'' To change your perspective, click the ''Window'' button on the main toolbar. Then click ''Open Perspective'' and choose ''Java EE''. If Java EE is not in the list, select ''Other...'' and find ''Java EE''. If Java EE is not in the list under Other, you may need to download Eclipse Ganymede (v3.4) for Java EE developers. Javadoc creation functionality may be built into your version of Eclipse, but that has not been tested.
# Then, click the ''Project'' button on the main toolbar. Select ''Generate Javadoc...''
# Find the Javadoc executable to use. This is usually javadoc.exe within your java bin directory, as shown in figure 1.
# Select the ESAPI source, but not the test files within your ESAPI project, as shown in figure 1.
# You should create Javadoc for members with visibility: Package, as shown in figure 1.
# Select the Javadoc output directory. This will likely be /doc under your ESAPI project folder.
# Click ''Next''.

Figure 1:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc1.jpg

# Designate a title for this Javadoc. Generally, this should be "OWASP Enterprise Security API (ESAPI)".
# Use Default: Under Basic Options, make sure all checkboxes are selected, as shown in Figure 2.
# Use Default: Make sure Javadocs for referenced archives are not generated, as shown in Figure 2.
# Use Default: No custom style sheet should be specified, as shown in Figure 2.
# Click ''Next''.

Figure 2:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc2.jpg

# ''The Overview page must be selected, as shown in Figure 3''. ''It should point to overview-summary.html in the javadoc resources folder''.
# Use Default: The JRE source compatibility should be selected as 1.4, as shown in Figure 3.
# Click ''Finish''.

Figure 3:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc3.jpg

# If it isn't already there, copy the folder "doc-files" from "javadoc resources" to org/owasp/esapi within your new javadoc directory.
# To view these new javadocs, double click on: <yourdocsfolder>/index.html

=== Submitting these new javadocs to SVN ===
# To submit these newly generated javadocs, simply use Team --> Commit in Eclipse. Note: Please check in updates into the existing /doc directory, rather than creating a new directory.
# If you receive version control errors during the submit, follow the following steps:
* Navigate to your ESAPI Project/doc/org/owasp/esapi/doc-files directory.
* Delete the folder called .svn from this folder and all subdirectories (wiki).
* In the Navigator view in Eclipse, Right-click the doc-files folder and select "Team" -> "Add to svn:ignore...".
* In the Navigator view in Eclipse, Right-click the doc-files folder again and select "Team" -> "Add to Version Control". You should receive a message saying that you previously asked to ignore this file. Click yes.

== Why do my newly generated Javadocs render as plain text in my browser? ==
Unfortunately, using this method of Javadoc generation does not set MIME types for the HTML files generated. This means that to the browser, your HTML files are just text files, and will display as such. Luckily Subclipse has a function to fix this. We are going to tell Subclipse to automatically set the MIME type of HTML files to text/html and the MIME type of CSS files to text/css every time it commits a change.

# The first thing you need to do is enable auto properties for your SVN client. If you do not enable auto properties, you will have to manually set the properties (MIME type) of every HTML and CSS file.
* In Windows, open a terminal by typing "cmd" (with no quotes) into "Run" on the Start menu. If you are using Vista, you can type "cmd" directly into the "Start Searching" bar.
* Type (again, and from now on, with no quotes) "cd %APPDATA%" and hit enter.
* Type "cd Subversion" and hit enter.
* Type "notepad config". This will open the SVN configuration file in notepad.
* Find the line "enable-auto-props = yes" and remove the # from the front of it. This enables auto properties.
# Then, tell Subversion which MIME types to set for which files:
* Towards the bottom of the file, find a section called ''[auto-props]''. Add the following to this section:
*.html = svn:mime-type=text/html
*.css = svn:mime-type=text/css
# Save the file.
''Any further commits to the SVN should set the MIME type properly.''

Your Javadoc should be ready to commit and view!

[[Category:OWASP Enterprise Security API]]

ESAPI Javadocs

2009-05-22T17:11:13Z

Kevin.Fealey:

==How to create Javadocs for ESAPI using Eclipse v3.4==
First off, notice a folder called "javadoc resources" in the root directory of your ESAPI project. This folder contains images referenced from the Javadoc as well as overview-summary.html, which is the title page for the ESAPI Javadoc. The instructions below make reference to these files.
[[category:FIXME|image links not working]]
===To Generate Javadocs===
# ''Be sure you are in the Java EE perspective.'' To change your perspective, click the ''Window'' button on the main toolbar. Then click ''Open Perspective'' and choose ''Java EE''. If Java EE is not in the list, select ''Other...'' and find ''Java EE''. If Java EE is not in the list under Other, you may need to download Eclipse Ganymede (v3.4) for Java EE developers. Javadoc creation functionality may be built into your version of Eclipse, but that has not been tested.
# Then, click the ''Project'' button on the main toolbar. Select ''Generate Javadoc...''
# Find the Javadoc executable to use. This is usually javadoc.exe within your java bin directory, as shown in figure 1.
# Select the ESAPI source, but not the test files within your ESAPI project, as shown in figure 1.
# You should create Javadoc for members with visibility: Package, as shown in figure 1.
# Select the Javadoc output directory. This will likely be /doc under your ESAPI project folder.
# Click ''Next''.

Figure 1:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc1.jpg

# Designate a title for this Javadoc. Generally, this should be "OWASP Enterprise Security API (ESAPI)".
# Use Default: Under Basic Options, make sure all checkboxes are selected, as shown in Figure 2.
# Use Default: Make sure Javadocs for referenced archives are not generated, as shown in Figure 2.
# Use Default: No custom style sheet should be specified, as shown in Figure 2.
# Click ''Next''.

Figure 2:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc2.jpg

# ''The Overview page must be selected, as shown in Figure 3''. ''It should point to overview-summary.html in the javadoc resources folder''.
# Use Default: The JRE source compatibility should be selected as 1.4, as shown in Figure 3.
# Click ''Finish''.

Figure 3:

http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/Generate%20Javadoc3.jpg

# If it isn't already there, copy the folder "doc-files" from "javadoc resources" to org/owasp/esapi within your new javadoc directory.
# To view these new javadocs, double click on: <yourdocsfolder>/index.html

=== Submitting these new javadocs to SVN ===
# To submit these newly generated javadocs, simply use Team --> Commit in Eclipse. Note: Please check in updates into the existing /doc directory, rather than creating a new directory.
# If you receive version control errors during the submit, follow the following steps:
* Navigate to your ESAPI Project/doc/org/owasp/esapi/doc-files directory.
* Delete the folder called .svn from this folder and all subdirectories (wiki).
* In the Navigator view in Eclipse, Right-click the doc-files folder and select "Team" -> "Add to svn:ignore...".
* In the Navigator view in Eclipse, Right-click the doc-files folder again and select "Team" -> "Add to Version Control". You should receive a message saying that you previously asked to ignore this file. Click yes.

== Why do my newly generated Javadocs render as plain text in my browser? ==
Unfortunately, using this method of Javadoc generation does not set MIME types for the HTML files generated. This means that to the browser, your HTML files are just text files, and will display as such. Luckily Subclipse has a function to fix this. We are going to tell Subclipse to automatically set the MIME type of HTML files to text/html and the MIME type of CSS files to text/css every time it commits a change.

# The first thing you need to do is enable auto properties for your SVN client. If you do not enable auto properties, you will have to manually set the properties (MIME type) of every HTML and CSS file.
* In Windows, open a terminal by typing "cmd" (with no quotes) into "Run" on the Start menu. If you are using Vista, you can type "cmd" directly into the "Start Searching" bar.
* Type (again, and from now on, with no quotes) "cd %APPDATA%" and hit enter.
* Type "cd Subversion" and hit enter.
* Type "notepad config". This will open the SVN configuration file in notepad.
* Find the line "enable-auto-props = yes" and remove the # from the front of it. This enables auto properties.
# Then, tell Subversion which MIME types to set for which files:
* Towards the bottom of the file, find a section called ''[auto-props]''. Add the following to this section:
*.html = svn:mime-type=text/html
*.css = svn:mime-type=text/css
# Save the file.
''Any further commits to the SVN should set the MIME type properly.''

Your Javadoc should be ready to commit and view!

[[Category:OWASP Enterprise Security API]]

ESAPI Javadocs

2009-05-22T17:06:55Z

Kevin.Fealey:

Troubleshoot ESAPI

2009-04-16T20:47:00Z

Kevin.Fealey:

===I am not receiving any compilation errors in Eclipse, but my web server can't find ESAPI===
* Be sure that ESAPI is being exported to your web server when the server starts. To do this:
# Right-click your project in the Navigator and choose "Properties".
# Select "Java EE Module Dependencies" from the list on the left.
# If the ESAPI JAR is already listed, be sure it is checked off on the list.
# If the ESAPI JAR is not listed, add it with "Add JAR" or "Add External JAR".
# Save and restart your web server.

[[Category:OWASP Enterprise Security API]]

Troubleshoot ESAPI

2009-04-16T20:46:00Z

Kevin.Fealey: New page: ===I am not receiving any compilation errors in Eclipse, but my web server can't find ESAPI=== * Be sure that ESAPI is being exported to your web server when the server starts. To do this:...

ESAPI-Building

2009-04-16T18:46:39Z

Kevin.Fealey: /* Running Test Cases */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.
* Follow the instructions below for Importing the ESAPI Source.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 5.0+

* Once Java 5.0+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* Right-click on your ESAPI project in the Navigator, mouse over ''Maven'' and click ''Enable Dependency Management''
** ''Note:'' If Maven is not an option when you right-click on the project, be sure the Maven plugin for eclipse is installed, as described above.
** ''Note:'' If ''Enable Dependency Management'' is not an option, dependency management is probably already enabled, So this step can be skipped.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.5''.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests.
# The "Base directory" should point to the root of your project
# The "Goals" field type "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:45:58Z

Kevin.Fealey: /* Building */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.
* Follow the instructions below for Importing the ESAPI Source.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 5.0+

* Once Java 5.0+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* Right-click on your ESAPI project in the Navigator, mouse over ''Maven'' and click ''Enable Dependency Management''
** ''Note:'' If Maven is not an option when you right-click on the project, be sure the Maven plugin for eclipse is installed, as described above.
** ''Note:'' If ''Enable Dependency Management'' is not an option, dependency management is probably already enabled, So this step can be skipped.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.5''.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests.
# The "Base directory" should point to the root of your project
# The "Goals" field type "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:43:17Z

Kevin.Fealey: /* Project Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.
* Follow the instructions below for Importing the ESAPI Source.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 5.0+

* Once Java 5.0+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* Right-click on your ESAPI project in the Navigator, mouse over ''Maven'' and click ''Enable Dependency Management''
** ''Note:'' If Maven is not an option when you right-click on the project, be sure the Maven plugin for eclipse is installed, as described above.
** ''Note:'' If ''Enable Dependency Management'' is not an option, dependency management is probably already enabled, So this step can be skipped.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.5''.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:40:48Z

Kevin.Fealey: /* Project Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.
* Follow the instructions below for Importing the ESAPI Source.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 5.0+

* Once Java 5.0+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* Right-click on your ESAPI project in the Navigator, mouse over ''Maven'' and click ''Enable Dependency Management''
** ''Note:'' If Maven is not an option when you right-click on the project, be sure the Maven plugin for eclipse is installed, as described above.
** ''Note:'' If ''Enable Dependency Management'' is not an option, dependency management is probably already enabled, So this step can be skipped.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:36:30Z

Kevin.Fealey: /* Project Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.
* Follow the instructions below for Importing the ESAPI Source.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 5.0+

* Once Java 5.0+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:35:46Z

Kevin.Fealey: /* Project Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.
* Follow the instructions below for Importing the ESAPI Source.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 5.0+

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:32:36Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.
* Follow the instructions below for Importing the ESAPI Source.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:32:17Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.
* Follow the instructions

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:31:13Z

Kevin.Fealey: /* Source Code From a .zip */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===OR===

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2009-04-16T18:30:22Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
** Simply unzip the contents wherever you like. This 'installs' Eclipse.
* Install [http://java.sun.com/javase/downloads/index.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Skip step 12 (do not open the SVN perspective)
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
** Only install the Maven Integration Components
* Connect to the SVN and download the ESAPI source. Directions can be found [[ESAPI-Building#Subversion_Setup|here]]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset). We recommend you run the script from the command line so that you can see the errors if any. ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If you do not plan on building Swingset too, comment out any lines in the script that reference Swingset
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct (Use "" if there is a blank space in the path). Or, try removing all the REM lines from the script if it is also getting added to the path.
* Close Eclipse
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe and select ''Create Shortcut''
* Right-Click your Eclipse shortcut and select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK (e.g., "C:\Program Files\Java\jdk1.6.0_13\bin"). This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [[::Category:OWASP_Enterprise_Security_API#Download_Now|here]]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [[ESAPI-Building#Eclipse_Setup |script listed above]] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

Category:OWASP Enterprise Security API

2009-02-19T21:11:35Z

Kevin.Fealey: /* Architecture */

{{:Project Information: OWASP Enterprise Security API Project}}
[[Category:OWASP Project]]
[[Category:OWASP Tool]]
[[Category:OWASP Download]]
[[Category:OWASP Release Quality Tool]]

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk_doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar ESAPI v1.4 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.4

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar ESAPI v1.4 Basic JAR file]
: Java 1.4 compatible JAR for ESAPI v1.4 (does not contain many reference implementations)

</td><td>
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.4.zip ESAPI v1.4 Source archive]
: Source files for ESAPI v1.4

</td></tr>
</table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* The current ESAPI JAR has been built for Java 1.6, however support for Java 1.4.2+ is available. Please see [https://www.owasp.org/index.php/ESAPI-Building here] for information on building ESAPI for a different version of Java.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named [[ESAPI_Swingset|''The ESAPI Swingset'']]. More information about Swingset is available [[ESAPI_Swingset | here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project licensed under the [http://en.wikipedia.org/wiki/BSD_license BSD license], which is very permissive and about as close to public domain as is possible. You can use or modify ESAPI however you want, even include it in commercial products.

__NOTOC__

Category:OWASP Enterprise Security API

2008-12-16T17:42:52Z

Kevin.Fealey: /* Using the ESAPI */

=OWASP Enterprise Security API (ESAPI) Project=

[http://www.youtube.com/watch?v=QAPD1jPn04g Watch the Video]

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar ESAPI v1.4 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.4

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar ESAPI v1.4 Basic JAR file]
: Java 1.4 compatible JAR for ESAPI v1.4 (does not contain many reference implementations)

</td><td>
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.4.zip ESAPI v1.4 Source archive]
: Source files for ESAPI v1.4

</td></tr>
</table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* The current ESAPI JAR has been built for Java 1.6, however support for Java 1.4.2+ is available. Please see [https://www.owasp.org/index.php/ESAPI-Building here] for information on building ESAPI for a different version of Java.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named [[ESAPI_Swingset|''The ESAPI Swingset'']]. More information about Swingset is available [[ESAPI_Swingset | here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project licensed under the [http://en.wikipedia.org/wiki/BSD_license BSD license], which is very permissive and about as close to public domain as is possible. You can use or modify ESAPI however you want, even include it in commercial products.

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__

ESAPI-Building

2008-12-15T21:06:12Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download the latest build of Maven from [http://maven.apache.org/download.html here] -- only install the Maven Integration Components
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset) ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [https://www.owasp.org/index.php/ESAPI-Building#Eclipse_Setup script listed above] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T20:34:22Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download the latest build of Maven from [http://maven.apache.org/download.html here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset) ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [https://www.owasp.org/index.php/ESAPI-Building#Eclipse_Setup script listed above] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI Javadocs

2008-12-15T19:32:57Z

Kevin.Fealey: /* Submitting these new javadocs to SVN */

==How to create Javadocs for ESAPI using Eclipse v3.4==
First off, notice a folder called "javadoc resources" in the root directory of your ESAPI project. This folder contains images referenced from the Javadoc as well as overview-summary.html, which is the title page for the ESAPI Javadoc. The instructions below make reference to these files.

===To Generate Javadocs===
# ''Be sure you are in the Java EE perspective.'' To change your perspective, click the ''Window'' button on the main toolbar. Then click ''Open Perspective'' and choose ''Java EE''. If Java EE is not in the list, select ''Other..'' and find ''Java EE''. If Java EE is not in the list under Other, you may need to download Eclipse Ganymede (v3.4) for Java EE developers. Javadoc creation functionality may be built into your version of Eclipse, but that has not been tested.
# Then, click the ''Project'' button on the main toolbar. Select ''Generate Javadoc...''
# Find the Javadoc executable to use. This is usually javadoc.exe within your java bin directory, as shown in figure 1.
# Select the ESAPI source, but not the test files within your ESAPI project, as shown in figure 1.
# You should create Javadoc for members with visibility: Package, as shown in figure 1.
# Select the Javadoc output directory. This will likely be /doc under your ESAPI project folder.
# Click ''Next''.

Figure 1:

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/wiki/Generate%20Javadoc1.jpg

# Designate a title for this Javadoc. Generally, this should be "OWASP Enterprise Security API (ESAPI)".
# Use Default: Under Basic Options, make sure all checkboxes are selected, as shown in Figure 2.
# Use Default: Make sure Javadocs for referenced archives are not generated, as shown in Figure 2.
# Use Default: No custom style sheet should be specified, as shown in Figure 2.
# Click ''Next''.

Figure 2:

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/wiki/Generate%20Javadoc2.jpg

# ''The Overview page must be selected, as shown in Figure 3''. ''It should point to overview-summary.html in the javadoc resources folder''.
# Use Default: The JRE source compatibility should be selected as 1.4, as shown in Figure 3.
# Click ''Finish''.

Figure 3:

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/wiki/Generate%20Javadoc3.jpg

# If it isn't already there, copy the folder "doc-files" from "javadoc resources" to org/owasp/esapi within your new javadoc directory.
# To view these new javadocs, double click on: <yourdocsfolder>/index.html

=== Submitting these new javadocs to SVN ===
# To submit these newly generated javadocs, simply use Team --> Commit in Eclipse. Note: Please check in updates into the existing /doc directory, rather than creating a new directory.
# If you receive version control errors during the submit, follow the following steps:
* Navigate to your ESAPI Project/doc/org/owasp/esapi/doc-files directory.
* Delete the folder called .svn from this folder and all subdirectories (wiki).
* In the Navigator view in Eclipse, Right-click the doc-files folder and select "Team" -> "Add to svn:ignore...".
* In the Navigator view in Eclipse, Right-click the doc-files folder again and select "Team" -> "Add to Version Control". You should receive a message saying that you previously asked to ignore this file. Click yes.

== Why do my newly generated Javadocs render as plain text in my browser? ==
Unfortunately, using this method of Javadoc generation does not set MIME types for the HTML files generated. This means that to the browser, your HTML files are just text files, and will display as such. Luckily Subclipse has a function to fix this. We are going to tell Subclipse to automatically set the MIME type of HTML files to text/html and the MIME type of CSS files to text/css every time it commits a change.

# The first thing you need to do is enable auto properties for your SVN client. If you do not enable auto properties, you will have to manually set the properties (MIME type) of every HTML and CSS file.
* In Windows, open a terminal by typing "cmd" (with no quotes) into "Run" on the Start menu. If you are using Vista, you can type "cmd" directly into the "Start Searching" bar.
* Type (again, and from now on, with no quotes) "cd %APPDATA%" and hit enter.
* Type "cd Subversion" and hit enter.
* Type "notepad config". This will open the SVN configuration file in notepad.
* Find the line "enable-auto-props = yes" and remove the # from the front of it. This enables auto properties.
# Then, tell Subversion which MIME types to set for which files:
* Towards the bottom of the file, find a section called ''[auto-props]''. Add the following to this section:
*.html = svn:mime-type=text/html
*.css = svn:mime-type=text/css
# Save the file.
''Any further commits to the SVN should set the MIME type properly.''

Your Javadoc should be ready to commit and view!

[[Category: OWASP Enterprise Security API]]

Category:OWASP Enterprise Security API

2008-12-15T19:30:36Z

Kevin.Fealey: /* Using the ESAPI */

=OWASP Enterprise Security API (ESAPI) Project=

[http://www.youtube.com/watch?v=QAPD1jPn04g Watch the Video]

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar ESAPI v1.4 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.4

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar ESAPI v1.4 Basic JAR file]
: Java 1.4 compatible JAR for ESAPI v1.4 (does not contain many reference implementations)

</td><td>
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.4.zip ESAPI v1.4 Source archive]
: Source files for ESAPI v1.4

</td></tr>
</table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* At the moment, ESAPI is set up for Java 1.4.2. If you would like to use the ESAPI reference implementations with a Java 1.6 application, there are some lines of code that need to be uncommented. Please see [https://www.owasp.org/index.php/ESAPI-Building here] for information on editing the ESAPI. More information regarding this topic will be added to the Wiki soon. For now, please contact [http://www.owasp.org/index.php/User:Jeff_Williams Jeff Williams] if you plan to use ESAPI with a Java 1.6 project.
* As stated above, ESAPI requires Java 1.4.2. Be sure to set your workspace settings regarding this.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named [[ESAPI_Swingset|''The ESAPI Swingset'']]. More information about Swingset is available [[ESAPI_Swingset | here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project licensed under the [http://en.wikipedia.org/wiki/BSD_license BSD license], which is very permissive and about as close to public domain as is possible. You can use or modify ESAPI however you want, even include it in commercial products.

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__

Category:OWASP Enterprise Security API

2008-12-15T19:30:15Z

Kevin.Fealey: /* Resources */

=OWASP Enterprise Security API (ESAPI) Project=

[http://www.youtube.com/watch?v=QAPD1jPn04g Watch the Video]

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar ESAPI v1.4 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.4

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar ESAPI v1.4 Basic JAR file]
: Java 1.4 compatible JAR for ESAPI v1.4 (does not contain many reference implementations)

</td><td>
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.4.zip ESAPI v1.4 Source archive]
: Source files for ESAPI v1.4

</td></tr>
</table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* At the moment, ESAPI is set up for Java 1.4.2. If you would like to use the ESAPI reference implementations with a Java 1.6 application, there are some lines of code that need to be uncommented. Please see [https://www.owasp.org/index.php/ESAPI-Building here] for information on editing the ESAPI. More information regarding this topic will be added to the Wiki soon. For now, please contact [http://www.owasp.org/index.php/User:Jeff_Williams Jeff Williams] if you plan to use ESAPI with a Java 1.6 project.
* As stated above, ESAPI requires Java 1.4.2. Be sure to set your workspace settings regarding this.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named [[ESAPI_Swingset|''The ESAPI Swingset'']]. More information about Swingset is available [[ESAPI_Swingset | here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project licensed under the [http://en.wikipedia.org/wiki/BSD_license BSD license], which is very permissive and about as close to public domain as is possible. You can use or modify ESAPI however you want, even include it in commercial products.

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__

ESAPI-Building

2008-12-15T17:04:53Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download [http://owasp-esapi-java.googlecode.com/files/ESAPI_setup_resources.zip the ESAPI setup resources] and extract the files. Edit the included script file to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset) ''NOTE: the AntiSamy file mentioned in the batch file is also included in the archive''
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [https://www.owasp.org/index.php/ESAPI-Building#Eclipse_Setup script listed above] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:53:09Z

Kevin.Fealey: /* Running Test Cases */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download [http://addlink this script] and edit it to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset)
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [https://www.owasp.org/index.php/ESAPI-Building#Eclipse_Setup script listed above] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass ''NOTE: NOT ALL TESTS CURRENTLY PASS''

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:52:12Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download [http://addlink this script] and edit it to match your directory structure. Then run the script to add all ESAPI and Swingset dependencies to your Maven repository (enables building of ESAPI and Swingset)
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [https://www.owasp.org/index.php/ESAPI-Building#Eclipse_Setup script listed above] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:46:18Z

Kevin.Fealey: /* Building */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download [http://addlink this script] and edit it to match your directory structure. Then run the script to add ESAPI and Antisamy jar files to your Maven repository (enables building of ESAPI and Swingset)
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [https://www.owasp.org/index.php/ESAPI-Building#Eclipse_Setup script listed above] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the new Maven integration.

Once your environment is set up, as specified above:
# Right-Click your ESAPI project root folder
# Select ''Run As...''
# Select ''Run Configurations''
# Double Click "Maven Build" from the options on the left to create a new configuration.
# Name your configuration at the top. This will be for building ESAPI without running JUnit tests (because tests failing cause the build to fail, and at the moment, some tests fail)
# The "Base directory" should point to the root of your project
# The "Goals" field say "package"
# From the checkboxes below, check "Skip Tests"
# Any options not mentioned should be left as their default
# Click "Apply" to save your build configuration
# Click "Run" to run your configuration
''NOTE: Jars created through building are located in the directory called "target". ''

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:40:33Z

Kevin.Fealey: /* Project Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download [http://addlink this script] and edit it to match your directory structure. Then run the script to add ESAPI and Antisamy jar files to your Maven repository (enables building of ESAPI and Swingset)
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [https://www.owasp.org/index.php/ESAPI-Building#Eclipse_Setup script listed above] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the included Ant build scripts.

There are two build scripts included in the ESAPI trunk repository.
* Full build of ESAPI with all available reference implementations.
* Basic build of ESAPI without reference implementations.

While the reference implementations are generally good for independent developers, most businesses will want to create their own security implementations based around the companies standard practices and infrastructure. This is why the Basic version is provided.

To build either version, simple ''right-click the build script'' for the desired build, select ''Run As'' -> ''Ant Build''. The script should run, with output directed to the Console. When complete, the dist directory should contain a new JAR, the build directory will contain all class files (even the reference implementation class files in the Basic build), and javadoc/api will contain the newly generated Javadocs.

===Problems Building?===
If you have any problems while performing the steps above, be sure you have Apache Ant installed.
''For help setting up Eclipse or integrating Ant within Eclipse, please read [http://www.onjava.com/pub/a/onjava/excerpt/anttdg2_ch11/index.html?page=1 this article]''.

Compile problems after the build are usually caused by dependency issues. Please check your Java Build Path to be sure all the necessary files are included.

As of ESAPI v1.3.0, the necessary Libraries are:

* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/antisamy-bin.1.2.jar antisamy-bin.1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-css.jar batik-css.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-util.jar batik-util.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-codec-1.3.jar commons-codec-1.3.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2.jar commons-fileupload-1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2-sources.jar commons-fileupload-1.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-httpclient-3.1.jar commons-httpclient-3.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2.jar commons-io-1.3.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2-sources.jar commons-io-1.3.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-logging-1.1.1.jar commons-logging-1.1.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/jsp-api.jar jsp-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/junit-4.4.jar junit-4.4.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/nekohtml.jar nekohtml.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/proguard.jar proguard.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/servlet-api.jar servlet-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xercesImpl.jar xercesImpl.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis.jar xml-apis.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis-ext.jar xml-apis-ext.jar]
* [http://java.sun.com/j2se/1.4.2/download.html JRE System Library (1.4.2)]

''Note: not all of these libraries may be required if you do not plan on using the ESAPI reference implementations!''

Please remember, ESAPI requires J2SE 1.4.2.

====If any of these files are missing====
To check if the above files are on your Java Build Path in Eclipse, Right-Click the ESAPI project folder and select properties, then select ''Java Build Path'' from the left column, and choose ''Libraries'' from the tabs on the right.

All of the files listed above, aside from the JRE, should have been downloaded in the source zip file. They should be located in /lib.

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:40:04Z

Kevin.Fealey: /* Project Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download [http://addlink this script] and edit it to match your directory structure. Then run the script to add ESAPI and Antisamy jar files to your Maven repository (enables building of ESAPI and Swingset)
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java JRE 1.4.2+.
'''NOTE: ESAPI was recently updated to run on Java 5.0 and 6.'''

* Once Java 1.4.2+ is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure a JRE or JDK is listed next to ''JRE System Library''. If there is a red X on next to the JRE, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* The Libraries tab should list ''JRE System Library'' and ''Maven Dependencies''. If anything else is listed, it is not necessary and should be removed. Maven now handles all dependencies.
* If a red X appears next to ''Maven Dependencies'', click the arrow on the left to expand the tree. If AntiSamy has an error, be sure the [http://linkhere script listed above] ran without errors.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''. This is because ESAPI is backwards compatible with Java 1.4, but should not affect running the project on newer versions.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* If errors still exist, Right-Click your ESAPI project root folder and select ''Maven'' -> ''Enable Dependency Management''. If errors remain, select ''Maven'' again, then ''Update Dependencies''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the included Ant build scripts.

There are two build scripts included in the ESAPI trunk repository.
* Full build of ESAPI with all available reference implementations.
* Basic build of ESAPI without reference implementations.

While the reference implementations are generally good for independent developers, most businesses will want to create their own security implementations based around the companies standard practices and infrastructure. This is why the Basic version is provided.

To build either version, simple ''right-click the build script'' for the desired build, select ''Run As'' -> ''Ant Build''. The script should run, with output directed to the Console. When complete, the dist directory should contain a new JAR, the build directory will contain all class files (even the reference implementation class files in the Basic build), and javadoc/api will contain the newly generated Javadocs.

===Problems Building?===
If you have any problems while performing the steps above, be sure you have Apache Ant installed.
''For help setting up Eclipse or integrating Ant within Eclipse, please read [http://www.onjava.com/pub/a/onjava/excerpt/anttdg2_ch11/index.html?page=1 this article]''.

Compile problems after the build are usually caused by dependency issues. Please check your Java Build Path to be sure all the necessary files are included.

As of ESAPI v1.3.0, the necessary Libraries are:

* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/antisamy-bin.1.2.jar antisamy-bin.1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-css.jar batik-css.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-util.jar batik-util.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-codec-1.3.jar commons-codec-1.3.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2.jar commons-fileupload-1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2-sources.jar commons-fileupload-1.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-httpclient-3.1.jar commons-httpclient-3.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2.jar commons-io-1.3.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2-sources.jar commons-io-1.3.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-logging-1.1.1.jar commons-logging-1.1.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/jsp-api.jar jsp-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/junit-4.4.jar junit-4.4.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/nekohtml.jar nekohtml.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/proguard.jar proguard.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/servlet-api.jar servlet-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xercesImpl.jar xercesImpl.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis.jar xml-apis.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis-ext.jar xml-apis-ext.jar]
* [http://java.sun.com/j2se/1.4.2/download.html JRE System Library (1.4.2)]

''Note: not all of these libraries may be required if you do not plan on using the ESAPI reference implementations!''

Please remember, ESAPI requires J2SE 1.4.2.

====If any of these files are missing====
To check if the above files are on your Java Build Path in Eclipse, Right-Click the ESAPI project folder and select properties, then select ''Java Build Path'' from the left column, and choose ''Libraries'' from the tabs on the right.

All of the files listed above, aside from the JRE, should have been downloaded in the source zip file. They should be located in /lib.

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:27:01Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Subversion_Setup here]
* Download [http://addlink this script] and edit it to match your directory structure. Then run the script to add ESAPI and Antisamy jar files to your Maven repository (enables building of ESAPI and Swingset)
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java SDK 1.4. Java 1.4.2 is used by ESAPI to keep it backward compatible with environments that are still using older versions of Java. Please be sure this is [http://java.sun.com/j2se/1.4.2/download.html downloaded] and installed.

* Once Java 1.4 is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure the ''JRE'' listed is version ''1.4''. If it is not, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the included Ant build scripts.

There are two build scripts included in the ESAPI trunk repository.
* Full build of ESAPI with all available reference implementations.
* Basic build of ESAPI without reference implementations.

While the reference implementations are generally good for independent developers, most businesses will want to create their own security implementations based around the companies standard practices and infrastructure. This is why the Basic version is provided.

To build either version, simple ''right-click the build script'' for the desired build, select ''Run As'' -> ''Ant Build''. The script should run, with output directed to the Console. When complete, the dist directory should contain a new JAR, the build directory will contain all class files (even the reference implementation class files in the Basic build), and javadoc/api will contain the newly generated Javadocs.

===Problems Building?===
If you have any problems while performing the steps above, be sure you have Apache Ant installed.
''For help setting up Eclipse or integrating Ant within Eclipse, please read [http://www.onjava.com/pub/a/onjava/excerpt/anttdg2_ch11/index.html?page=1 this article]''.

Compile problems after the build are usually caused by dependency issues. Please check your Java Build Path to be sure all the necessary files are included.

As of ESAPI v1.3.0, the necessary Libraries are:

* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/antisamy-bin.1.2.jar antisamy-bin.1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-css.jar batik-css.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-util.jar batik-util.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-codec-1.3.jar commons-codec-1.3.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2.jar commons-fileupload-1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2-sources.jar commons-fileupload-1.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-httpclient-3.1.jar commons-httpclient-3.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2.jar commons-io-1.3.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2-sources.jar commons-io-1.3.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-logging-1.1.1.jar commons-logging-1.1.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/jsp-api.jar jsp-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/junit-4.4.jar junit-4.4.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/nekohtml.jar nekohtml.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/proguard.jar proguard.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/servlet-api.jar servlet-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xercesImpl.jar xercesImpl.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis.jar xml-apis.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis-ext.jar xml-apis-ext.jar]
* [http://java.sun.com/j2se/1.4.2/download.html JRE System Library (1.4.2)]

''Note: not all of these libraries may be required if you do not plan on using the ESAPI reference implementations!''

Please remember, ESAPI requires J2SE 1.4.2.

====If any of these files are missing====
To check if the above files are on your Java Build Path in Eclipse, Right-Click the ESAPI project folder and select properties, then select ''Java Build Path'' from the left column, and choose ''Libraries'' from the tabs on the right.

All of the files listed above, aside from the JRE, should have been downloaded in the source zip file. They should be located in /lib.

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:25:21Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [https://www.owasp.org/index.php/ESAPI-Building#Importing_the_ESAPI_Source here]
* Download [http://addlink this script] and edit it to match your directory structure. Then run the script to add ESAPI and Antisamy jar files to your Maven repository (enables building of ESAPI and Swingset)
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java SDK 1.4. Java 1.4.2 is used by ESAPI to keep it backward compatible with environments that are still using older versions of Java. Please be sure this is [http://java.sun.com/j2se/1.4.2/download.html downloaded] and installed.

* Once Java 1.4 is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure the ''JRE'' listed is version ''1.4''. If it is not, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the included Ant build scripts.

There are two build scripts included in the ESAPI trunk repository.
* Full build of ESAPI with all available reference implementations.
* Basic build of ESAPI without reference implementations.

While the reference implementations are generally good for independent developers, most businesses will want to create their own security implementations based around the companies standard practices and infrastructure. This is why the Basic version is provided.

To build either version, simple ''right-click the build script'' for the desired build, select ''Run As'' -> ''Ant Build''. The script should run, with output directed to the Console. When complete, the dist directory should contain a new JAR, the build directory will contain all class files (even the reference implementation class files in the Basic build), and javadoc/api will contain the newly generated Javadocs.

===Problems Building?===
If you have any problems while performing the steps above, be sure you have Apache Ant installed.
''For help setting up Eclipse or integrating Ant within Eclipse, please read [http://www.onjava.com/pub/a/onjava/excerpt/anttdg2_ch11/index.html?page=1 this article]''.

Compile problems after the build are usually caused by dependency issues. Please check your Java Build Path to be sure all the necessary files are included.

As of ESAPI v1.3.0, the necessary Libraries are:

* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/antisamy-bin.1.2.jar antisamy-bin.1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-css.jar batik-css.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-util.jar batik-util.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-codec-1.3.jar commons-codec-1.3.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2.jar commons-fileupload-1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2-sources.jar commons-fileupload-1.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-httpclient-3.1.jar commons-httpclient-3.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2.jar commons-io-1.3.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2-sources.jar commons-io-1.3.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-logging-1.1.1.jar commons-logging-1.1.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/jsp-api.jar jsp-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/junit-4.4.jar junit-4.4.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/nekohtml.jar nekohtml.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/proguard.jar proguard.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/servlet-api.jar servlet-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xercesImpl.jar xercesImpl.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis.jar xml-apis.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis-ext.jar xml-apis-ext.jar]
* [http://java.sun.com/j2se/1.4.2/download.html JRE System Library (1.4.2)]

''Note: not all of these libraries may be required if you do not plan on using the ESAPI reference implementations!''

Please remember, ESAPI requires J2SE 1.4.2.

====If any of these files are missing====
To check if the above files are on your Java Build Path in Eclipse, Right-Click the ESAPI project folder and select properties, then select ''Java Build Path'' from the left column, and choose ''Libraries'' from the tabs on the right.

All of the files listed above, aside from the JRE, should have been downloaded in the source zip file. They should be located in /lib.

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:24:47Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse
* Within Eclipse, download and install the [http://m2eclipse.codehaus.org/ Eclipse Maven plugin]. At this time, we recommend using the latest stable development build (the second link on the page)
* Connect to the SVN and download the ESAPI source. Directions can be found [http://addlink here]
* Download [http://addlink this script] and edit it to match your directory structure. Then run the script to add ESAPI and Antisamy jar files to your Maven repository (enables building of ESAPI and Swingset)
** If the script loads and quickly closes or there are build errors, it is likely that at least one of the references to files/folders is not correct
* If you do not launch Eclipse from a shortcut, create a shortcut for Eclipse
# Navigate to the directory where you installed Eclipse
# Right-Click Eclipse.exe
# Select ''Create Shortcut''
* Right-Click your Eclipse shortcut
* Select ''Properties''
* At the end of the line that says ''Target'', add ''-vm "x"'' where ''x'' is the location of a JDK. This step is necessary for the Maven plugin to work
* Restart Eclipse using the edited shortcut.

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java SDK 1.4. Java 1.4.2 is used by ESAPI to keep it backward compatible with environments that are still using older versions of Java. Please be sure this is [http://java.sun.com/j2se/1.4.2/download.html downloaded] and installed.

* Once Java 1.4 is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure the ''JRE'' listed is version ''1.4''. If it is not, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the included Ant build scripts.

There are two build scripts included in the ESAPI trunk repository.
* Full build of ESAPI with all available reference implementations.
* Basic build of ESAPI without reference implementations.

While the reference implementations are generally good for independent developers, most businesses will want to create their own security implementations based around the companies standard practices and infrastructure. This is why the Basic version is provided.

To build either version, simple ''right-click the build script'' for the desired build, select ''Run As'' -> ''Ant Build''. The script should run, with output directed to the Console. When complete, the dist directory should contain a new JAR, the build directory will contain all class files (even the reference implementation class files in the Basic build), and javadoc/api will contain the newly generated Javadocs.

===Problems Building?===
If you have any problems while performing the steps above, be sure you have Apache Ant installed.
''For help setting up Eclipse or integrating Ant within Eclipse, please read [http://www.onjava.com/pub/a/onjava/excerpt/anttdg2_ch11/index.html?page=1 this article]''.

Compile problems after the build are usually caused by dependency issues. Please check your Java Build Path to be sure all the necessary files are included.

As of ESAPI v1.3.0, the necessary Libraries are:

* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/antisamy-bin.1.2.jar antisamy-bin.1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-css.jar batik-css.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-util.jar batik-util.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-codec-1.3.jar commons-codec-1.3.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2.jar commons-fileupload-1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2-sources.jar commons-fileupload-1.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-httpclient-3.1.jar commons-httpclient-3.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2.jar commons-io-1.3.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2-sources.jar commons-io-1.3.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-logging-1.1.1.jar commons-logging-1.1.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/jsp-api.jar jsp-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/junit-4.4.jar junit-4.4.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/nekohtml.jar nekohtml.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/proguard.jar proguard.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/servlet-api.jar servlet-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xercesImpl.jar xercesImpl.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis.jar xml-apis.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis-ext.jar xml-apis-ext.jar]
* [http://java.sun.com/j2se/1.4.2/download.html JRE System Library (1.4.2)]

''Note: not all of these libraries may be required if you do not plan on using the ESAPI reference implementations!''

Please remember, ESAPI requires J2SE 1.4.2.

====If any of these files are missing====
To check if the above files are on your Java Build Path in Eclipse, Right-Click the ESAPI project folder and select properties, then select ''Java Build Path'' from the left column, and choose ''Libraries'' from the tabs on the right.

All of the files listed above, aside from the JRE, should have been downloaded in the source zip file. They should be located in /lib.

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

ESAPI-Building

2008-12-15T16:08:38Z

Kevin.Fealey: /* Eclipse Setup */

==Eclipse Setup==

* Get the [http://www.eclipse.org/downloads/ Ganymede release of Eclipse] - We recommend the version for Java EE developers
* Install [http://java.sun.com/javase/downloads/index_jdk5.jsp Java JDK 5.0 or greater] if you don't have it yet. Note: a ''JDK'' (not JRE) is required
* Within Eclipse, download and install the [http://subclipse.tigris.org/install.html Eclipse Subversion (SVN) plugin] called Subclipse.
** Don't forget to do Step 12: to enable the Subversion perspective within Eclipse

==Importing the ESAPI Source==
To import the ESAPI source code into your workspace, you can either download the source files in a zip file from [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here] or download the latest trunk from the ESAPI SVN.

'''The zip files containing the ESAPI source''' are official releases of the ESAPI. They will be updated whenever major changes are made to the ESAPI, whether features are added/removed, or if ESAPI undergoes a major organizational change. If you are planning on using the ESAPI's reference implementations and want to see ESAPI's source, but do not want to build your own JAR, you might download the ESAPI source zip file (available [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#Download_Now here]).

'''The ESAPI trunk SVN''' contains the most up-to-date development version of ESAPI. The trunk may contain different code from the pre-zipped source. It may contain new features or be organized differently. The trunk is a development version of the ESAPI, meaning that contributors to the ESAPI project are actively editing this code, so while all contributors are encouraged to run all test cases on the code before committing it, developers using this code should run their own tests to be sure the code is fully functional. In addition, because the trunk code is in development, documentation regarding the ESAPI, especially Javadocs, may not be entirely accurate.

===Source Code From a .zip===

While there are a few ways to import the ESAPI project using a zip file of its source code, I recommend following these instructions. For the moment, I'll assume you are using Eclipse as your IDE. More tutorials may come in the future for other IDEs.

* Unzip file ESAPI source files to a directory of your choice.
* From the Eclipse toolbar, select ''File'' -> ''New'' -> ''Project'' -> ''Other''.
* In the ''Java'' folder, select ''Java Project from Existing Ant Buildfile'' and click Next.
* Name your project.
* Click ''Browse'' and navigate to the unzipped ESAPI source files.
* From the root directory (probably ESAPI_version) select ''build.xml''.
* Click ''Finish'' and you should be ready to edit ESAPI.

===Subversion Setup===

If you choose to use the ESAPI SVN code, follow the instructions [http://code.google.com/p/owasp-esapi-java/source/checkout here]. Unless you have been added to the ESAPI project as a contributor, please use the bottom SVN checkout link on the Google Code page (non-SSL).

If you are using subclipse, as recommended, open Eclipse and:
* Click ''File'' -> ''New'' -> ''Other....''.
* From the ''SVN Folder'' select '"Checkout Projects from SVN'' (this option will only be available if you have a SVN plugin installed) and hit ''Next >''.
* Click the ''Create a new repository location'' radio button.
* If you are not listed as a project contributor, insert ''http://owasp-esapi-java.googlecode.com/svn/trunk/'' as the URL. If you are listed as a project contributor, check the Google Code page for the URL to use. (Note: if you are a contributor, when prompted for your SVN password, use your Google generated password, available from the Google Code Source page.)
* Once the directory structure appears in the window, click the URL at the top to download everything. Then hit ''Next >''
* Select your desired project options. For most people, the default options should be fine. When finished, click ''Next >''.
* Select your desired workspace options, then click ''Finish''. The latest ESAPI source files will then be downloaded to your workspace. This may take a few minutes.

==Project Setup==

Some configuration may be necessary for ESAPI to compile and build on your system.

ESAPI requires the Java SDK 1.4. Java 1.4.2 is used by ESAPI to keep it backward compatible with environments that are still using older versions of Java. Please be sure this is [http://java.sun.com/j2se/1.4.2/download.html downloaded] and installed.

* Once Java 1.4 is installed, open the ''Navigator view'' in Eclipse. If this is currently hidden, from the toolbar click ''Window'' -> ''Show View'' -> ''Navigator''.
* ''Right-click on the ESAPI project root folder'' in the Navigator view and select ''Properties''.
* From the left column, select ''Java Build Path''. Under the ''Libraries'' tab, be sure the ''JRE'' listed is version ''1.4''. If it is not, remove the current JRE and click ''Add Library'' and select an alternate JRE. If you are having trouble figuring out what version the current JRE is, select ''Installed JREs'' and look at the location to which each version is mapped.
* From the left column, select ''Java Compiler''. Be sure ''Compiler compliance level'', ''Generated .class files compatibility'', and ''Source compatibility'' are all set to ''1.4''.
* Close the properties window.
* ''Right-click the ESAPI project root folder'' and select ''Refresh''.
* From the toolbar, select ''Project'' -> ''Clean..'' and select the ESAPI project. Click ''OK''.
* ESAPI should now be compiled.

==Building==

Building ESAPI should be easy with the included Ant build scripts.

There are two build scripts included in the ESAPI trunk repository.
* Full build of ESAPI with all available reference implementations.
* Basic build of ESAPI without reference implementations.

While the reference implementations are generally good for independent developers, most businesses will want to create their own security implementations based around the companies standard practices and infrastructure. This is why the Basic version is provided.

To build either version, simple ''right-click the build script'' for the desired build, select ''Run As'' -> ''Ant Build''. The script should run, with output directed to the Console. When complete, the dist directory should contain a new JAR, the build directory will contain all class files (even the reference implementation class files in the Basic build), and javadoc/api will contain the newly generated Javadocs.

===Problems Building?===
If you have any problems while performing the steps above, be sure you have Apache Ant installed.
''For help setting up Eclipse or integrating Ant within Eclipse, please read [http://www.onjava.com/pub/a/onjava/excerpt/anttdg2_ch11/index.html?page=1 this article]''.

Compile problems after the build are usually caused by dependency issues. Please check your Java Build Path to be sure all the necessary files are included.

As of ESAPI v1.3.0, the necessary Libraries are:

* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/antisamy-bin.1.2.jar antisamy-bin.1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-css.jar batik-css.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/batik-util.jar batik-util.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-codec-1.3.jar commons-codec-1.3.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2.jar commons-fileupload-1.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-fileupload-1.2-sources.jar commons-fileupload-1.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-httpclient-3.1.jar commons-httpclient-3.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2.jar commons-io-1.3.2.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-io-1.3.2-sources.jar commons-io-1.3.2-sources.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/commons-logging-1.1.1.jar commons-logging-1.1.1.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/jsp-api.jar jsp-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/junit-4.4.jar junit-4.4.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/nekohtml.jar nekohtml.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/proguard.jar proguard.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/servlet-api.jar servlet-api.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xercesImpl.jar xercesImpl.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis.jar xml-apis.jar]
* [http://owasp-esapi-java.googlecode.com/svn/trunk/lib/xml-apis-ext.jar xml-apis-ext.jar]
* [http://java.sun.com/j2se/1.4.2/download.html JRE System Library (1.4.2)]

''Note: not all of these libraries may be required if you do not plan on using the ESAPI reference implementations!''

Please remember, ESAPI requires J2SE 1.4.2.

====If any of these files are missing====
To check if the above files are on your Java Build Path in Eclipse, Right-Click the ESAPI project folder and select properties, then select ''Java Build Path'' from the left column, and choose ''Libraries'' from the tabs on the right.

All of the files listed above, aside from the JRE, should have been downloaded in the source zip file. They should be located in /lib.

==Running Test Cases==

* From the ''Navigator'' view, select test/org/owasp/esapi/AllTests.java
* ''Right-click'' -> ''Run As'' -> ''Run Configurations...''
* Choose the JUnit configuration
* Select the ''Arguments'' tab and enter a VM argument
** -Dorg.owasp.esapi.resources="<path to your esapi project>/test/testresources"
* run tests and verify that they all pass

==Running Demo App==

The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is available [http://www.owasp.org/index.php/ESAPI_Swingset here].

__NOTOC__

[[Category:OWASP Enterprise Security API]]

Category:OWASP Enterprise Security API

2008-11-03T22:01:20Z

Kevin.Fealey: /* Download Now */

=OWASP Enterprise Security API (ESAPI) Project=

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar ESAPI v1.4 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.4

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar ESAPI v1.4 Basic JAR file]
: Java 1.4 compatible JAR for ESAPI v1.4 (does not contain many reference implementations)

</td><td>
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.4.zip ESAPI v1.4 Source archive]
: Source files for ESAPI v1.4

</td></tr>
</table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* At the moment, ESAPI is set up for Java 1.4.2. If you would like to use the ESAPI reference implementations with a Java 1.6 application, there are some lines of code that need to be uncommented. Please see [https://www.owasp.org/index.php/ESAPI-Building here] for information on editing the ESAPI. More information regarding this topic will be added to the Wiki soon. For now, please contact [http://www.owasp.org/index.php/User:Jeff_Williams Jeff Williams] if you plan to use ESAPI with a Java 1.6 project.
* As stated above, ESAPI requires Java 1.4.2. Be sure to set your workspace settings regarding this.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is [[ESAPI_Swingset | available here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project licensed under the [http://en.wikipedia.org/wiki/BSD_license BSD license], which is very permissive and about as close to public domain as is possible. You can use or modify ESAPI however you want, even include it in commercial products.

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__

ESAPI Swingset

2008-10-31T20:08:07Z

Kevin.Fealey: /* Download/Run */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 04b require SSL for the login demo page. Instructions are included in the version of 04b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 04b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_04b.zip ESAPI Swingset 04b bundled with Apache Tomcat]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Readme file with easy setup instructions
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.zip ESAPI Swingset 04b Source Code]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.war ESAPI Swingset 04b WAR file]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go
Note: the Secure Login page requires SSL be configured on your web server!

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]
[[Category: OWASP Enterprise Security API]]

ESAPI Swingset

2008-10-31T18:30:13Z

Kevin.Fealey: /* ESAPI Swingset WAR file */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_04b.zip ESAPI Swingset 04b bundled with Apache Tomcat]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Readme file with easy setup instructions
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.zip ESAPI Swingset 04b Source Code]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.war ESAPI Swingset 04b WAR file]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go
Note: the Secure Login page requires SSL be configured on your web server!

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]
[[Category: OWASP Enterprise Security API]]

ESAPI Swingset

2008-10-31T18:29:43Z

Kevin.Fealey: /* ESAPI Swingset WAR file */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_04b.zip ESAPI Swingset 04b bundled with Apache Tomcat]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Readme file with easy setup instructions
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.zip ESAPI Swingset 04b Source Code]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.war ESAPI Swingset 04b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go
Note: the Secure Login page requires SSL be configured on your web server!

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]
[[Category: OWASP Enterprise Security API]]

ESAPI Swingset

2008-10-31T18:28:51Z

Kevin.Fealey: /* ESAPI Swingset WAR file */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_04b.zip ESAPI Swingset 04b bundled with Apache Tomcat]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Readme file with easy setup instructions
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.zip ESAPI Swingset 04b Source Code]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.war ESAPI Swingset 04b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]
[[Category: OWASP Enterprise Security API]]

ESAPI Swingset

2008-10-31T18:28:34Z

Kevin.Fealey: /* ESAPI Swingset Source Code */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_04b.zip ESAPI Swingset 04b bundled with Apache Tomcat]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Readme file with easy setup instructions
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_04b.zip ESAPI Swingset 04b Source Code]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.war ESAPI Swingset 03b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]
[[Category: OWASP Enterprise Security API]]

ESAPI Swingset

2008-10-31T18:27:36Z

Kevin.Fealey: /* ESAPI Swingset/Apache Tomcat Bundle */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_04b.zip ESAPI Swingset 04b bundled with Apache Tomcat]]
Added: October 31, 2008

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Readme file with easy setup instructions
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.zip ESAPI Swingset 03b Source Code]]

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.war ESAPI Swingset 03b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]
[[Category: OWASP Enterprise Security API]]

ESAPI Swingset

2008-10-31T18:26:54Z

Kevin.Fealey: /* ESAPI Swingset/Apache Tomcat Bundle */

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_04b.zip ESAPI Swingset 03b bundled with Apache Tomcat]]

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Readme file with easy setup instructions
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.zip ESAPI Swingset 03b Source Code]]

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.war ESAPI Swingset 03b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]
[[Category: OWASP Enterprise Security API]]

ESAPI Javadocs

2008-10-31T16:07:36Z

Kevin.Fealey:

==How to create Javadocs for ESAPI using Eclipse v3.4==
First off, notice a folder called "javadoc resources" in the root directory of your ESAPI project. This folder contains images referenced from the Javadoc as well as overview-summary.html, which is the title page for the ESAPI Javadoc. The instructions below make reference to these files.

===To Generate Javadocs===
# ''Be sure you are in the Java EE perspective.'' To change your perspective, click the ''Window'' button on the main toolbar. Then click ''Open Perspective'' and choose ''Java EE''. If Java EE is not in the list, select ''Other..'' and find ''Java EE''. If Java EE is not in the list under Other, you may need to download Eclipse Ganymede (v3.4) for Java EE developers. Javadoc creation functionality may be built into your version of Eclipse, but that has not been tested.
# Then, click the ''Project'' button on the main toolbar. Select ''Generate Javadoc...''
# Find the Javadoc executable to use. This is usually javadoc.exe within your java bin directory, as shown in figure 1.
# Select the ESAPI source, but not the test files within your ESAPI project, as shown in figure 1.
# You should create Javadoc for members with visibility: Package, as shown in figure 1.
# Select the Javadoc output directory. This will likely be /doc under your ESAPI project folder.
# Click ''Next''.

Figure 1:

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/wiki/Generate%20Javadoc1.jpg

# Designate a title for this Javadoc. Generally, this should be "OWASP Enterprise Security API (ESAPI)".
# Use Default: Under Basic Options, make sure all checkboxes are selected, as shown in Figure 2.
# Use Default: Make sure Javadocs for referenced archives are not generated, as shown in Figure 2.
# Use Default: No custom style sheet should be specified, as shown in Figure 2.
# Click ''Next''.

Figure 2:

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/wiki/Generate%20Javadoc2.jpg

# ''The Overview page must be selected, as shown in Figure 3''. ''It should point to overview-summary.html in the javadoc resources folder''.
# Use Default: The JRE source compatibility should be selected as 1.4, as shown in Figure 3.
# Click ''Finish''.

Figure 3:

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/wiki/Generate%20Javadoc3.jpg

# If it isn't already there, copy the folder "doc-files" from "javadoc resources" to org/owasp/esapi within your new javadoc directory.
# To view these new javadocs, double click on: <yourdocsfolder>/index.html

=== Submitting these new javadocs to SVN ===
# To submit these newly generated javadocs, simply use Team --> Commit in Eclipse. Note: Please check in updates into the existing /doc directory, rather than creating a new directory.
# If you receive version control errors during the submit, follow the following steps:
* Navigate to your ESAPI Project/javadoc/org/owasp/esapi/doc-files directory.
* Delete the folder called .svn from this folder and all subdirectories (wiki).
* In the Navigator view in Eclipse, Right-click the doc-files folder and select "Team" -> "Add to svn:ignore...".
* In the Navigator view in Eclipse, Right-click the doc-files folder again and select "Team" -> "Add to Version Control". You should receive a message saying that you previously asked to ignore this file. Click yes.

== Why do my newly generated Javadocs render as plain text in my browser? ==
Unfortunately, using this method of Javadoc generation does not set MIME types for the HTML files generated. This means that to the browser, your HTML files are just text files, and will display as such. Luckily Subclipse has a function to fix this. We are going to tell Subclipse to automatically set the MIME type of HTML files to text/html and the MIME type of CSS files to text/css every time it commits a change.

# The first thing you need to do is enable auto properties for your SVN client. If you do not enable auto properties, you will have to manually set the properties (MIME type) of every HTML and CSS file.
* In Windows, open a terminal by typing "cmd" (with no quotes) into "Run" on the Start menu. If you are using Vista, you can type "cmd" directly into the "Start Searching" bar.
* Type (again, and from now on, with no quotes) "cd %APPDATA%" and hit enter.
* Type "cd Subversion" and hit enter.
* Type "notepad config". This will open the SVN configuration file in notepad.
* Find the line "enable-auto-props = yes" and remove the # from the front of it. This enables auto properties.
# Then, tell Subversion which MIME types to set for which files:
* Towards the bottom of the file, find a section called ''[auto-props]''. Add the following to this section:
*.html = svn:mime-type=text/html
*.css = svn:mime-type=text/css
# Save the file.
''Any further commits to the SVN should set the MIME type properly.''

Your Javadoc should be ready to commit and view!

[[Category: OWASP Enterprise Security API]]

ESAPI Swingset

2008-10-31T16:06:57Z

Kevin.Fealey:

The ESAPI Swingset is a web application which demonstrates the many uses of the Enterprise Security API ([[ESAPI]]).

Swingset is now in beta stage. Much of Swingset is still incomplete, but many ESAPI functions are working.
==Download/Run==
This Swingset/Apache Tomcat bundle contains everything you need to get Swingset up and running in a matter of minutes. No installation is necessary (assuming you have a Java JRE or JDK installed), just edit one line of a batch file or shell script and you're ready to go!

'''Downloads

Note: Version 03b require SSL for the login demo page. Instructions are included in the version of 03b bundled with Tomcat. If you do not know how/do not want to set up SSL on your own, it is recommended that you download the ESAPI Swingset 03b bundled with Apache Tomcat below. In the root directory of the .zip file, there is a README with very simple instructions for setting up SSL for this application. A .keystore file is provided, so user's will not have to generate their own keys.

Be aware, in some browsers, navigating to the login page will provide a warning that the digital signature provided may not be legitimate. The certificate provided is self-signed for demonstration purposes. The warning can safely be ignored for this page. More detailed information will follow in the coming weeks.'''

===ESAPI Swingset/Apache Tomcat Bundle===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/Swingset__with_tomcat_03b.zip ESAPI Swingset 03b bundled with Apache Tomcat]]

'''What is included in this download?'''

This download includes:
*Apache Tomcat version 6.0.18
*ESAPI Swingset application
*Batch file for easy loading of Apache Tomcat in Windows
*Shell script for easy loading of Apache Tomcat in Unix will be bundled soon
*Everything you need to try Swingset

===ESAPI Swingset Source Code===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.zip ESAPI Swingset 03b Source Code]]

'''What is included in this download?'''

This download includes:
*All ESAPI Swingset source files

===ESAPI Swingset WAR file===
*[[http://owasp-esapi-java-swingset.googlecode.com/files/ESAPI_Swingset_03b.war ESAPI Swingset 03b WAR file]]

'''What is included in this download?'''

This download includes:
*The ESAPI Swingset WAR file -- just drop it in your Apache Tomcat Webapps directory and you're ready to go

==Download the JRE or JDK==
If it is not already installed, please download a Java JRE or JDK version 5 or later.
Please note that, Tomcat 5.5 and above uses the Eclipse JDT Java compiler for compiling
JSP pages. This means you no longer need to have the complete
Java Development Kit (JDK) to run Tomcat, but a Java Runtime Environment
(JRE) is sufficient.
*The Java JRE is available [http://java.com/en/download/ here]
*The Java JDK is available [http://java.sun.com/javase/downloads/index.jsp here]

==Setup and Run Swingset==
===Setup Swingset for Windows===
#Extract ESAPI_Swingset.zip to a directory of your choice.
#Open Windows Explorer and Navigate to the directory to which ESAPI_Swingset.zip was extracted
#Open Tomcat_6.0.18_start.bat with notepad
#Set either of the two, JRE_HOME or JAVA_HOME enviornment variable for Tomcat to run.
#Save the file

:* To set JAVA_HOME environment variable. You need to change the line "set JAVA_HOME=jdk_directory" to your Java install directory, where "jdk_directory" is the root of your Java directory. For many, the line will look like: "set JAVA_HOME=C:\Program Files\Java\jdk1.6.0_10". Please remember that Swingset requires JDK/JRE version 5 or higher.
:* To set JRE_HOME change the "JRE_HOME=C:\Program Files\Java\jre1.6.0_10" so that it points to your JRE installation directory

===Running Swingset on Windows===
#Navigate to the ESAPI_Swingset directory
#Execute Tomcat_6.0.18_start.bat. This can be done through the command line or by double clicking the file.
#If you followed the installation instructions in this wiki, Tomcat should now be running
#Open a web browser and navigate to [http://localhost:8080/main http://localhost:8080/main]
#You should see the ESAPI Swingset start page

==How Can I help with Swingset==
The ESAPI Swingset is still in an early beta stage. Many pages within Swingset are still incomplete, and we could certainly use some help getting them finished. If you are interested in helping, please check out Swingset's [[http://code.google.com/p/owasp-esapi-java-swingset/source/checkout SVN repository]].

If you have any ideas for how the ESAPI Swingset could be better, or if you would like to submit new code, please contact [[User:Jeff Williams|Jeff Williams]].

==Project Sponsors==
The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

[[Category: OWASP Download]]
[[Category: OWASP Project]]
[[Category: OWASP Enterprise Security API]]

Category:OWASP Enterprise Security API

2008-10-23T15:56:15Z

Kevin.Fealey: /* Using the ESAPI */

=OWASP Enterprise Security API (ESAPI) Project=

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.3.jar ESAPI v1.3.0 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.2.1.jar ESAPI v1.2.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.1.1.jar ESAPI v1.1.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.1.1

</td><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.3.zip ESAPI v1.3.0 Source archive]
: Source files for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.2.1.zip ESAPI v1.2.1 Source archive]
: Source files for ESAPI 1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.1.1.zip ESAPI v1.1.1 Source archive]
: Source files for ESAPI 1.1.1

</td></tr></table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* At the moment, ESAPI is set up for Java 1.4.2. If you would like to use the ESAPI reference implementations with a Java 1.6 application, there are some lines of code that need to be uncommented. Please see [https://www.owasp.org/index.php/ESAPI-Building here] for information on editing the ESAPI. More information regarding this topic will be added to the Wiki soon. For now, please contact [http://www.owasp.org/index.php/User:Jeff_Williams Jeff Williams] if you plan to use ESAPI with a Java 1.6 project.
* As stated above, ESAPI requires Java 1.4.2. Be sure to set your workspace settings regarding this.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is [[ESAPI_Swingset | available here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project is dual-licensed under GPL and BSD. Pick whichever one fits your corporate policy...[JFM]

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__

Category:OWASP Enterprise Security API

2008-10-23T15:55:01Z

Kevin.Fealey: /* Using the ESAPI */

=OWASP Enterprise Security API (ESAPI) Project=

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.3.jar ESAPI v1.3.0 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.2.1.jar ESAPI v1.2.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.1.1.jar ESAPI v1.1.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.1.1

</td><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.3.zip ESAPI v1.3.0 Source archive]
: Source files for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.2.1.zip ESAPI v1.2.1 Source archive]
: Source files for ESAPI 1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.1.1.zip ESAPI v1.1.1 Source archive]
: Source files for ESAPI 1.1.1

</td></tr></table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* At the moment, ESAPI is set up for Java 1.4.2. If you would like to use the ESAPI reference implementations with a Java 1.6 application, there are some lines of code that need to be uncommented. Please see [https://www.owasp.org/index.php/ESAPI-Building here] for information on editing the ESAPI. More information regarding this topic will be added to the Wiki soon. For now, please contact [Jeff Williams] if you plan to use ESAPI with a Java 1.6 project.
* As stated above, ESAPI requires Java 1.4.2. Be sure to set your workspace settings regarding this.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is [[ESAPI_Swingset | available here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project is dual-licensed under GPL and BSD. Pick whichever one fits your corporate policy...[JFM]

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__

Category:OWASP Enterprise Security API

2008-10-23T15:52:50Z

Kevin.Fealey: /* Using the ESAPI */

=OWASP Enterprise Security API (ESAPI) Project=

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.3.jar ESAPI v1.3.0 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.2.1.jar ESAPI v1.2.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.1.1.jar ESAPI v1.1.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.1.1

</td><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.3.zip ESAPI v1.3.0 Source archive]
: Source files for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.2.1.zip ESAPI v1.2.1 Source archive]
: Source files for ESAPI 1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.1.1.zip ESAPI v1.1.1 Source archive]
: Source files for ESAPI 1.1.1

</td></tr></table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* At the moment, ESAPI is set up for Java 1.4.2. If you would like to use ESAPI with a Java 1.6 application, there are some lines of code that need to be uncommented. More information regarding this topic will be added to the Wiki soon. For now, please contact [Jeff Williams] if you plan to use ESAPI with a Java 1.6 project.
* As stated above, ESAPI requires Java 1.4.2. Be sure to set your workspace settings regarding this.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is [[ESAPI_Swingset | available here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project is dual-licensed under GPL and BSD. Pick whichever one fits your corporate policy...[JFM]

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__

ESAPI Getting Started Guide

2008-10-23T15:15:40Z

Kevin.Fealey: /* Step 2: Setting ESAPI configuration properties */

ESAPI is very easy to use. This tutorial shows how to get a simple application working with the reference implementation of ESAPI. Please remember that the reference implementation is a simple example. The Authenticator uses a text-based password file. This is to make it easy to test ESAPI without installing a database or directory. Enterprises will want to create their own implementation of the API that works with their identity management solution.

==Step 1: Setting up a resources directory==

Create a directory to hold ESAPI resources. This should be a secure location as it will contain a significant amount of security information. For example, you might create a directory called "C:\resources" (Windows) and use the operating system access control mechanisms (NTFS on Windows) to restrict access.

==Step 2: Setting ESAPI configuration properties==
If it isn't there already, copy the default [http://owasp-esapi-java.googlecode.com/svn/trunk/resources/ESAPI.properties ESAPI.Properties] file into your resources directory. Edit the MasterPassword property and choose a long, difficult-to-guess string, as the security of your application depends on it.

MasterPassword=xxxxx

Also copy the [http://owasp-esapi-java.googlecode.com/svn/trunk/resources/antisamy-esapi.xml antisamy.xml] file into your resources directory, which defines the [[antisamy]] policy that you'll use in ESAPI.

==Step 3: Configuring user accounts==
The simplest way to get started is to create an "admin" account to work with. ESAPI has a command line tool that will create your users.txt file. Type the below, for example (all one line):

java -Dorg.owasp.esapi.resources="c:\resources"
-classpath owasp-esapi-java-1.1.1.jar
org.owasp.esapi.Authenticator yourname yourpass admin

==Step 4: Hello, ESAPI!==
You should be able to use any application container. The instructions below are for Tomcat.

# Do a clean Tomcat 5.5/6.0 install (or use an existing container).
# Unzip [[Image:Test.zip]] and put the ''test'' directory in the ''webapps'' folder.
# Run tomcat/bin/startup.bat (or .sh).

* You should enable SSL by uncommenting the SSL Connector in tomcat/conf/server.xml (or /etc/tomcat/server.xml, etc.). Otherwise ESAPI will warn that you're sending a session id over an insecure connection.

==Step 5: Run==
Just browse to https://localhost:8443/test/test.jsp (or http://localhost:8080/test/test.jsp) and log in with the credentials you set up.

This JSP performs a lot of "global" checks including authentication, validation, and anti-CSRF. Typically you will want to leave these steps to a framework or a filter (see the [[ESAPI Filter]]). This JSP is just to demonstrate some of the features of ESAPI.

[[Category:OWASP Enterprise Security API]]

Category:OWASP Enterprise Security API

2008-10-23T14:54:36Z

Kevin.Fealey: /* Architecture */

=OWASP Enterprise Security API (ESAPI) Project=

===What is ESAPI?===
The '''ESAPI''' is a free and open collection of all the security methods that a developer needs to build a secure web application. You can just use the interfaces and build your own implementation using your company's infrastructure. Or, you can use the reference implementation as a starting point. In concept, the API is language independent. However, the first deliverables from the project are a Java API and a Java reference implementation. Efforts to build ESAPI in .NET and PHP are already underway.

===Why ESAPI?===
Unfortunately, the available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection. This leaves developers with responsibility for designing and building security mechanisms. This reinventing the wheel for every application leads to wasted time and massive security holes.

The cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. This API is designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

===Where did ESAPI come from?===
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at jeff.williams@owasp.org.

More information about the ESAPI can be found in the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]

==Architecture==

The ESAPI architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. New development projects should consider integrating ESAPI into their framework to make even more of the security happen automatically. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

The ESAPI covers most of the key security challenges facing application developers. ESAPI provides the capability for developers to create applications that are protected against almost all of the risks described in the OWASP [[Top Ten]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent.

http://owasp-esapi-java.googlecode.com/svn/trunk/doc/org/owasp/esapi/doc-files/OWASPTopTen.jpg

There are two key parts to the ESAPI:
* A set of interfaces
* A reference implementation

By using the ESAPI, applications across an organization will be easier to develop, more consistent, and easier to update in a single place. The use of the ESAPI will make it much easier for static analysis tools to verify an application, as the ESAPI calls can be built into the ruleset.

==Download Now==

This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact jeff.williams@owasp.org for more information. If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!

Versions (archived source files are also available on the SVN under tags)

<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.3.jar ESAPI v1.3.0 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.2.1.jar ESAPI v1.2.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-1.1.1.jar ESAPI v1.1.1 Complete JAR file]
: JAVA 1.4 compatible JAR for ESAPI v1.1.1

</td><td>

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.3.zip ESAPI v1.3.0 Source archive]
: Source files for ESAPI v1.3.0

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.2.1.zip ESAPI v1.2.1 Source archive]
: Source files for ESAPI 1.2.1

; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.1.1.zip ESAPI v1.1.1 Source archive]
: Source files for ESAPI 1.1.1

</td></tr></table>

===Resources===
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].

* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].

* The ESAPI [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html Javadocs] are located [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html here].

* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].

* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [https://www.owasp.org/index.php/ESAPI_Javadocs here].

==Changing/Building/Using the ESAPI==
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].

===Using the ESAPI===
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
* Download the latest version of the ESAPI JAR from above.
* Add the ESAPI JAR to your project's build path.
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk/doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.

===Running Demo App===
The ESAPI Demo application has been named ''The ESAPI Swingset''. More information about Swingset is [[ESAPI_Swingset | available here]].

==Project Sponsors==

The OWASP ESAPI project is sponsored by
[http://www.aspectsecurity.com https://www.owasp.org/images/d/d1/Aspect_logo.gif]

==Licensing==
This project is dual-licensed under GPL and BSD. Pick whichever one fits your corporate policy...[JFM]

[[Category:OWASP Download]]
[[Category:OWASP Project]]

__NOTOC__