ESAPI Specification - Revision history

Chris Schmidt at 03:52, 18 June 2011

2011-06-18T03:52:31Z

2011-06-17T05:41:45Z

2011-06-17T05:41:05Z

2011-06-17T05:40:42Z

2011-06-16T07:12:00Z

2011-06-16T07:02:03Z

2011-06-16T06:51:08Z

2011-06-16T06:48:19Z

2011-06-16T06:44:12Z

2011-06-16T06:13:13Z

@@ Line 91: / Line 91: @@
 Note that in addition to defeating all forms of parameter tampering attacks, there is a side benefit of the AccessReferenceMap. Using random strings as indirect object references, as opposed to simple integers makes it impossible for an attacker to guess valid identifiers. So if per-user AccessReferenceMaps are used, then request forgery (CSRF) attacks will also be prevented.
 === Methods ===
 ==== <Type> Key addDirectReference(Type direct) ====
 ==== <Type> Type getDirectReference(Key key) ====
 ==== <Type> Key getIndirectReference(Type directReference) ====
 ==== <Type> Key removeDirectReference(Type directReference) ====
 ==== <Type> void update(Set<Type> directReferences)  ====
 == Authenticator ==

← Older revision		Revision as of 05:41, 17 June 2011
Line 390:		Line 390:
	= Desktop API Specification =		= Desktop API Specification =

−	[[Category:~~ESAPI~~]]	+	[[Category:OWASP Enterprise Security API]]

← Older revision		Revision as of 05:40, 17 June 2011
Line 86:		Line 86:

	== AccessReferenceMap<Key> ==		== AccessReferenceMap<Key> ==
		+	The AccessReferenceMap interface is used to map from a set of internal direct object references to a set of indirect references that are safe to disclose publicly. This can be used to help protect database keys, filenames, and other types of direct object references. As a rule, developers should not expose their direct object references as it enables attackers to attempt to manipulate them.
		+
		+	Indirect references are handled as strings, to facilitate their use in HTML. Implementations can generate simple integers or more complicated random character strings as indirect references. Implementations should probably add a constructor that takes a list of direct references.
		+
		+	Note that in addition to defeating all forms of parameter tampering attacks, there is a side benefit of the AccessReferenceMap. Using random strings as indirect object references, as opposed to simple integers makes it impossible for an attacker to guess valid identifiers. So if per-user AccessReferenceMaps are used, then request forgery (CSRF) attacks will also be prevented.

	=== Methods ===		=== Methods ===

@@ Line 21: / Line 21: @@
 === Changes from ESAPI 2.0 ===
 * Removed deprecated methods
-* Added Generic Stereotypes to the Key and Context parameters)
+* Added Generic Stereotypes to the Resource and Context parameters)
 === StereoTypes ===

← Older revision		Revision as of 06:51, 16 June 2011
Line 1:		Line 1:
		+	<pre>This document is currently under development - Please use the Discussion page for threaded conversation</pre>
		+
	= Proposed Migration Roadmap =		= Proposed Migration Roadmap =
	* ESAPI 2.1		* ESAPI 2.1

@@ Line 257: / Line 257: @@
 = Web API Specification =
 == ClientCookie ==
 == SecureHttpRequest ==

@@ Line 12: / Line 12: @@
 ** Introduce Core API Testing Suite
-= Core API =
+= Core API Specification =
 == AccessController ==
@@ Line 234: / Line 234: @@
 === <Type> void assertValid(Type data) ===
-= Exceptions =
+== Exceptions ==
-== AccessDeniedException extends EnterpriseSecurityException ==
+=== AccessDeniedException ===
-== AccountDisabledException extends AuthenticationException ==
+=== AccountDisabledException ===
-== AccountLockedException extends AuthenticationException ==
+=== AccountLockedException ===
-== AuthenticationException extends EnterpriseSecurityException ==
+=== AuthenticationException ===
-== EncodingException extends EnterpriseSecurityRuntimeException ==
+=== EncodingException ===
-== EncryptionException extends EnterpriseSecurityException ==
+=== EncryptionException ===
-== EnterpriseSecurityException extends Exception ==
+=== EnterpriseSecurityException ===
-== EnterpriseSecurityRuntimeException extends RuntimeException ==
+=== EnterpriseSecurityRuntimeException ===
-== ExecutionException extends EnterpriseSecurityException ==
+=== ExecutionException ===
-== IncorrectCredentialsException extends AuthenticationException ==
+=== IncorrectCredentialsException ===

@@ Line 58: / Line 58: @@
 ! Description
 |-
-| AccessDeniedException
+| [[#AccessDeniedException|AccessDeniedException]]
 | If the assertion evaluates to false, an AccessControlException will be thrown with contextual information as to the reason for the failure
 |}
@@ Line 237: / Line 237: @@
 == AccessDeniedException extends EnterpriseSecurityException ==
 == AuthenticationException extends EnterpriseSecurityException ==
@@ Line 249: / Line 253: @@
 == ExecutionException extends EnterpriseSecurityException ==