ESAPI Secure Coding Guideline - Revision history

Jeff Williams at 20:10, 4 May 2008

2008-05-04T20:10:06Z

Jeff Williams at 03:12, 3 May 2008

2008-05-03T03:12:27Z

Jeff Williams at 03:07, 3 May 2008

2008-05-03T03:07:45Z

Jeff Williams at 03:04, 3 May 2008

2008-05-03T03:04:11Z

Jeff Williams at 02:56, 3 May 2008

2008-05-03T02:56:23Z

Jeff Williams at 17:18, 16 April 2008

2008-04-16T17:18:19Z

Jeff Williams: /* Banned APIs */

2008-04-15T14:41:57Z

‎Banned APIs

Jeff Williams: /* Banned APIs */

2008-04-15T14:32:56Z

‎Banned APIs

Jeff Williams: /* Banned APIs */

2008-04-14T17:49:17Z

‎Banned APIs

Jeff Williams: /* Banned APIs */

2008-04-14T17:48:47Z

‎Banned APIs

@@ Line 1: / Line 1: @@
 =Using Security Controls=
@@ Line 80: / Line 83: @@
 |-
 | align="center" | '''AC001'''
-| The application shall use <code></code> to
+| Only the container provided JSESSIONID should be used as a session identifier.
 | TBD
 |}
@@ Line 148: / Line 171: @@
-==Input Validation and Encoding==
+==Input Validation==
 {|class="wikitable" style="text-align:left;" width="100%"
 |-
@@ Line 156: / Line 179: @@
 |-
 | align="center" | '''AC001'''
-| The application shall use <code></code> to
+| The application shall avoid the use of hidden fields.
 | TBD
 |}
@@ Line 162: / Line 221: @@
@@ Line 170: / Line 245: @@
 ! width="45%" | Requirement
 ! width="45%" | Code Example
 |-
 | align="center" | '''AC001'''
@@ Line 177: / Line 276: @@
 | The application shall use an EncryptedProperties to store all security relevant data, such as passwords, credentials, codes, configuration information, addresses, etc…

← Older revision		Revision as of 03:12, 3 May 2008
Line 436:		Line 436:


−	[[Category:OWASP ~~ESAPI Project~~]]	+	[[Category:OWASP Enterprise Security API]]

@@ Line 62: / Line 62: @@
 | align="center" | '''AU014'''
 | The application shall verify the strength of any user account name with the <code>Authenticator.verifyAccountNameStrength()</code> method.
 | TBD
 |}

@@ Line 13: / Line 13: @@
 |-
 | align="center" | '''AU002'''
-| All requests for pages that require authentication shall call <code>ESAPI.authenticator().login()</code>.
+| All requests for pages that require authentication shall call the <code>ESAPI.authenticator().login()</code> method.
 | TBD
 |-
 | align="center" | '''AU003'''
-| Form fields used for passwords must use <code>type=password</code> to mask the password from view.
+| The application shall provide the user with a logout link on every page that invokes the <code>ESAPI.authenticator().logout()</code> method.
 | TBD
 |-
 | align="center" | '''AU004'''
-| The application shall never put passwords into HTML, including repopulating form fields.
+| Form fields used for passwords must use <code>type=password</code> to mask the password from view.
 | TBD
 |-
 | align="center" | '''AU005'''
-| The application shall use the <code>FIXME</code> to set a "remember me" cookie for automatic authentication, but only if a user specifically authorizes it.
+| The application shall never put passwords into HTML, including repopulating form fields.
 | TBD
 |-
 | align="center" | '''AU006'''
-| Account creation and registration functions should protect against automated tools.
+| The application shall use the <code>FIXME</code> to set a "remember me" cookie for automatic authentication, but only if a user specifically authorizes it.
 | TBD
 |-
@@ Line 40: / Line 40: @@
 | TBD
 |-
-| align="center" | '''AU0009'''
+| align="center" | '''AU009'''
 | Link and form URLs for all transactions shall be updated with the <code>HTTPUtilities.addCSRFToken()</code> method to add a CSRF token.
 | TBD
 |-
-| align="center" | '''AU0010'''
+| align="center" | '''AU010'''
 | All HTTP requests for transactions shall be verified using the <code>HTTPUtilities.verifyCSRFToken()</code> method to check that the request is not forged.
 | TBD
 |}

@@ Line 9: / Line 9: @@
 |-
 | align="center" | '''AU001'''
-| The application shall use <code></code> to
+| All site interaction from page containing the login form to the page confirming logout (inclusive) must use SSL.
 | TBD
 |}

← Older revision		Revision as of 17:18, 16 April 2008
Line 377:		Line 377:
	\| TBD		\| TBD
	\|}		\|}
		+
		+
		+	[[Category:OWASP ESAPI Project]]

@@ Line 319: / Line 319: @@
 | align="center" | '''BAN011'''
 | ServletResponse.sendRedirect()
-| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities.html HTTPUtilities.safeSendRedirect()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities.html HTTPUtilities.safeSendRedirect()]
 | TBD
 |-

@@ Line 269: / Line 269: @@
 | align="center" | '''BAN001'''
 | System.out.println()
-| Logger.*
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/ILogger.html Logger.*]
 | TBD
 |-
 | align="center" | '''BAN002'''
 | Throwable.printStackTrace()
-| Logger.*
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/ILogger.html Logger.*]
 | TBD
 |-
 | align="center" | '''BAN003'''
 | Runtime.exec()
-| Executor.safeExec()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IExecutor.html Executor.safeExec()]
 | TBD
 |-
 | align="center" | '''BAN004'''
 | Session.getId()
-| Randomizer.getRandomString() (better not to use at all)
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/interfaces/IRandomizer.html Randomizer.getRandomString] (better not to use at all)
 | TBD
 |-
 | align="center" | '''BAN005'''
-| Session.getId()
+| ServletRequest.getUserPrincipal()
-| Randomizer.getRandomString() (better not to use at all)
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IAuthenticator.html Authenticator.getCurrentUser()]
 | TBD
 |-
 | align="center" | '''BAN006'''
-| ServletRequest.getUserPrincipal()
+| ServletRequest.isUserInRole()
-| Authenticator.getCurrentUser()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IAccessController.html AccessController.isAuthorized*()]
 | TBD
 |-
 | align="center" | '''BAN007'''
-| ServletRequest.isUserInRole()
+| Session.invalidate()
-| AccessController.isAuthorized*()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IAuthenticator.html Authenticator.logout()]
 | TBD
 |-
 | align="center" | '''BAN008'''
-| Session.invalidate()
+| Math.Random.*
-| Authenticator.logout()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IRandomizer.html Randomizer.*]
 | TBD
 |-
 | align="center" | '''BAN009'''
-| Math.Random.*
+| File.createTempFile()
-| Randomizer.*
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IRandomizer.html Randomizer.getRandomFilename()]
 | TBD
 |-
 | align="center" | '''BAN010'''
-| File.createTempFile()
+| ServletResponse.setContentType()
-| Randomizer.getRandomFilename()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities.html HTTPUtilities.setContentType()]
 | TBD
 |-
 | align="center" | '''BAN011'''
-| ServletResponse.setContentType()
+| ServletResponse.sendRedirect()
-| HTTPUtilities.setContentType()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities.html HTTPUtilities.safeSendRedirect()
 | TBD
 |-
 | align="center" | '''BAN012'''
-| ServletResponse.sendRedirect()
+| RequestDispatcher.forward()
-| HTTPUtilities.sendSafeRedirect()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities.html HTTPUtilities.safeSendForward()]
 | TBD
 |-
 | align="center" | '''BAN013'''
-| RequestDispatcher.forward()
+| ServletResponse.addHeader()
-| HTTPUtilities.sendSafeForward()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities.html HTTPUtilities.safeSetHeader()/safeSetHeader()]
 | TBD
 |-
 | align="center" | '''BAN014'''
-| ServletResponse.addHeader()
+| ServletResponse.addCookie()
-| HTTPUtilities.addSafeHeader()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities.html HTTPUtilities.safeAddCookie()]
 | TBD
 |-
 | align="center" | '''BAN015'''
-| ServletResponse.addCookie()
+| ServletRequest.isSecure()
-| HTTPUtilities.addSafeCookie()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities.html HTTPUtilties.isSecureChannel()]
 | TBD
 |-
 | align="center" | '''BAN016'''
-| ServletRequest.isSecure()
+| Properties.*
-| HTTPUtilties.isSecureChannel()
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IEncryptedProperties.html EncryptedProperties.*]
 | TBD
 |-
 | align="center" | '''BAN017'''
-| Properties.*
+| ServletContext.log()
-| EncryptedProperties.*
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/ILogger.html Logger.*]
 | TBD
 |-
 | align="center" | '''BAN018'''
-| ServletContext.log()
+| java.security and javax.crypto
-| Logger.*
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IEncryptor.html Encryptor.*]
 | TBD
 |-
 | align="center" | '''BAN019'''
-| java.security and javax.crypto
+| java.net.URLEncoder/Decoder
-| Encryptor.*
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IEncoder.html Encoder.encodeForURL()/decodeForURL()]
 | TBD
 |-
 | align="center" | '''BAN020'''
 | java.sql.Statement.execute
 | PreparedStatement.execute
 | TBD
 |-
-| align="center" | '''BAN022'''
+| align="center" | '''BAN021'''
 | ServletResponse.encodeURL
-| HTTPUtilities.safeEncodeURL (better not to use at all)
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities HTTPUtilities.safeEncodeURL()] (better not to use at all)
 | TBD
 |-
-| align="center" | '''BAN023'''
+| align="center" | '''BAN022'''
 | ServletResponse.encodeRedirectURL
-| HTTPUtilities.safeEncodeRedirectURL (better not to use at all)
+| [http://owasp-esapi-java.googlecode.com/svn/trunk/javadoc/org/owasp/esapi/IHTTPUtilities HTTPUtilities.safeEncodeRedirectURL()] (better not to use at all)
 |}