Category:OWASP Enterprise Security API - Revision history

Kevin W. Wall: Update Javadoc link on main tab to reference 2.2.0.0 release.

2019-06-28T17:39:23Z

Update Javadoc link on main tab to reference 2.2.0.0 release.

Kevin W. Wall: Add Google Tink as recommendation for strong crypto.

2018-08-22T00:52:36Z

Add Google Tink as recommendation for strong crypto.

Kevin W. Wall: Fix bad grammar.

2017-11-10T20:46:28Z

Fix bad grammar.

Kevin W. Wall: Remove broken documentation link for unsupported "ESAPI for PHP".

2017-11-10T20:43:55Z

Remove broken documentation link for unsupported "ESAPI for PHP".

Kevin W. Wall: Edit downloads section to remove links of unsupported versions.

2017-11-09T03:36:13Z

Edit downloads section to remove links of unsupported versions.

Kevin W. Wall: Change link for 'ESAPI for JavaScript' from obsolete Google Code link to GitHub link.

2017-02-04T01:04:17Z

Change link for 'ESAPI for JavaScript' from obsolete Google Code link to GitHub link.

Kevin W. Wall: Replaced Chris Schmidt as project co-lead with Matt Seil, who is stepping in to replace him.

2016-12-17T03:19:17Z

Replaced Chris Schmidt as project co-lead with Matt Seil, who is stepping in to replace him.

Kevin W. Wall: Add new tab to ESAPI page

2015-12-17T02:30:03Z

Add new tab to ESAPI page

Kevin W. Wall: Updated project lead.

2015-12-15T05:56:08Z

Updated project lead.

Kevin W. Wall: Get rid of more references to Google Code site.

2015-12-15T05:46:52Z

Get rid of more references to Google Code site.

@@ Line 93: / Line 93: @@
 *The [[ESAPI Swingset|ESAPI Swingset]] sample application demonstrates how to leverage ESAPI to protect a web application.
 *LAMP should be spelled LAMPE ([http://www.owasp.org/images/a/ac/LAMP_Should_be_Spelled_LAMPE.pdf PDF])
-*ESAPI for Java interface documentation ([http://www.javadoc.io/doc/org.owasp.esapi/esapi/2.1.0 JavaDocs])
+*ESAPI for Java interface documentation ([http://www.javadoc.io/doc/org.owasp.esapi/esapi/2.2.0.0 JavaDocs])
 |}

@@ Line 127: / Line 127: @@
 * General HTML sanitization: [https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project OWASP Java HTML Sanitizer]
 * Validation: [http://beanvalidation.org/ JSR-303/JSR-349 Bean Validation]
-*Strong cryptography: [https://github.com/google/keyczar Keyczar]
+*Strong cryptography: [https://github.com/google/tink Google Tink], [https://github.com/google/keyczar Keyczar]
 * Authentication / authorization: [https://shiro.apache.org/ Apache Shiro]
 * CSRF protection: [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project OWASP CSRFGuard Project] or [https://www.owasp.org/index.php/CSRFProtector_Project OWASP CSRFProtector Project]

@@ Line 131: / Line 131: @@
 * CSRF protection: [https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project OWASP CSRFGuard Project] or [https://www.owasp.org/index.php/CSRFProtector_Project OWASP CSRFProtector Project]
-Note that it not the suggestion to suggest that ESAPI is dead, but rather to acknowledge the fact that it isn't being as well-maintained as most F500 companies would like for their enterprise software. There may be alternatives, such as companies that you can purchase ESAPI support from. Those are not being considered here for various reasons, not the least of which is to remain vendor neutral.  Rather, instead these recommendations should be taken as possible alternatives to secure your application. It is not a perfect world that we live in, but I would be remiss as an appsec guy if I were to plug ESAPI over other good security solutions simply because of my contributions to / involvement with ESAPI. I think that ESAPI has it's place and I will do my best to maintain it, but not to the exclusion of my family or day job. If you would like to volunteer to help, you know where to find me.
+Note that this is not to suggest that ESAPI is dead, but rather to acknowledge the fact that it isn't being as well-maintained as most F500 companies would like for their enterprise software. There may be alternatives, such as companies that you can purchase ESAPI support from. Those are not being considered here for various reasons, not the least of which is to remain vendor neutral.  Rather, instead these recommendations should be taken as possible alternatives to secure your application. It is not a perfect world that we live in, but I would be remiss as an appsec guy if I were to plug ESAPI over other good security solutions simply because of my contributions to / involvement with ESAPI. I think that ESAPI has it's place and I will do my best to maintain it, but not to the exclusion of my family or day job. If you would like to volunteer to help, you know where to find me.
 -[mailto:kevin.w.wall@gmail.com kevin wall]

@@ Line 93: / Line 93: @@
 *The [[ESAPI Swingset|ESAPI Swingset]] sample application demonstrates how to leverage ESAPI to protect a web application.
 *LAMP should be spelled LAMPE ([http://www.owasp.org/images/a/ac/LAMP_Should_be_Spelled_LAMPE.pdf PDF])
 *ESAPI for Java interface documentation ([http://www.javadoc.io/doc/org.owasp.esapi/esapi/2.1.0 JavaDocs])
 |}

@@ Line 75: / Line 75: @@
 *[https://search.maven.org/#search|ga|1|esapi ESAPI for Java Downloads (binaries)]
 *[https://github.com/ESAPI/esapi-java-legacy ESAPI for Java (source)]<br>
 *[https://github.com/ESAPI/owasp-esapi-js ESAPI for Javascript]<br>
 | valign="top"  style="padding-left:25px;width:33%;" |

@@ Line 80: / Line 80: @@
 *{{#switchtablink:ColdFusion.2FCFML|ESAPI for ColdFusion & CFML}}<br>
 *{{#switchtablink:Python|ESAPI for Python}}<br>
-*[http://code.google.com/p/owasp-esapi-js/downloads/detail?name=esapi4js-0.1.3.zip ESAPI for Javascript]<br>
+*[https://github.com/ESAPI/owasp-esapi-js ESAPI for Javascript]<br>
 | valign="top"  style="padding-left:25px;width:33%;" |

@@ Line 19: / Line 19: @@
 The following organizations are a few of the many organizations that are starting to adopt ESAPI to secure their web applications: [http://www.americanexpress.com/ American Express], [http://www.apache.org/ Apache Foundation], [http://www.boozallen.com Booz Allen Hamilton], [http://www.aspectsecurity.com/ Aspect Security], [http://www.coraid.com Coraid], [http://www.thehartford.com/ The Hartford], [http://www.infinitecampus.com Infinite Campus], [http://www.lockheedmartin.com/ Lockheed Martin], [http://cwe.mitre.org/top25/index.html MITRE], [http://enterprise.spawar.navy.mil/ U.S. Navy - SPAWAR], [http://www.worldbank.org/ The World Bank], [http://www.sans.org/top25errors/ SANS Institute].
-Please let us know how your organization is using OWASP ESAPI. Include your name, organization's name, and brief description of how you are using it. The project co-leads can be reached [mailto:chris.schmidt@owasp.org here] and [mailto:kevin.w.wall@gmail.com here].
+Please let us know how your organization is using OWASP ESAPI. Include your name, organization's name, and brief description of how you are using it. The project co-leads can be reached  [mailto:kevin.w.wall@gmail.com here] and [mailto:xeno6696@gmail.com here].
 | valign="top"  style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" |

@@ Line 109: / Line 109: @@
 *I use ESAPI to be our security package for all our product, this way we can set one standard for all products. --[mailto:yairr@liveperson.com Yair]
 *I use ESAPI for Java to educate developers about application security principals at several of the world’s largest organizations. --[mailto:jim.manico@owasp.org Jim]<br>
 = Glossary  =

@@ Line 74: / Line 74: @@
 [[Image:Asvs-step2.jpg]]'''2. Get ESAPI'''
-*[http://code.google.com/p/owasp-esapi-java/downloads/list ESAPI for Java Downloads (binaries)]
+*[https://search.maven.org/#search|ga|1|esapi ESAPI for Java Downloads (binaries)]
 *[https://github.com/ESAPI/esapi-java-legacy ESAPI for Java (source)]<br>
 *{{#switchtablink:.NET|ESAPI for .NET}}<br>
@@ Line 90: / Line 90: @@
 *The [[ESAPI Swingset|ESAPI Swingset]] sample application demonstrates how to leverage ESAPI to protect a web application.
 *LAMP should be spelled LAMPE ([http://www.owasp.org/images/a/ac/LAMP_Should_be_Spelled_LAMPE.pdf PDF])
-*ESAPI for Java interface documentation ([http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html JavaDocs])
+*ESAPI for Java interface documentation ([http://www.javadoc.io/doc/org.owasp.esapi/esapi/2.1.0 JavaDocs])
 *ESAPI for PHP interface documentation ([http://owasp-esapi-php.googlecode.com/svn/trunk_doc/latest/index.html phpdoc])