OWASP Summer of Code 2008 Applications - Revision history

Deleted user: /* OWASP Application Security Verification Standard */

2008-12-05T16:15:13Z

‎OWASP Application Security Verification Standard

Leocavallari: /* The Application Security Desk Reference - ASDR */

2008-06-16T18:52:00Z

‎The Application Security Desk Reference - ASDR

Camargoneves: Undo revision 27774 by Camargoneves (Talk)

2008-04-08T00:14:55Z

Undo revision 27774 by Camargoneves (Talk)

Show changes

Camargoneves: /* P025 OWASP Positive Security Project */

2008-04-07T02:23:04Z

‎P025 OWASP Positive Security Project

Show changes

Pauloc: /* OWASP AntiSamy .NET */

2008-04-04T15:46:15Z

‎OWASP AntiSamy .NET

Arshan: typo fix

2008-04-03T17:49:37Z

typo fix

Pauloc: /* OWASP AntiSamy .NET */

2008-03-31T20:00:41Z

‎OWASP AntiSamy .NET

Pauloc: /* OWASP AntiSamy .NET */

2008-03-31T20:00:06Z

‎OWASP AntiSamy .NET

Jason Li at 18:56, 28 March 2008

2008-03-28T18:56:25Z

Davidrook: /* Fortify Code Review Project */

2008-03-28T18:27:23Z

‎Fortify Code Review Project

@@ Line 391: / Line 391: @@
 *Secure web portal application development
 *Secure web portal integration
-*Secure instant messaging application development, including three patents
+*Secure instant messaging application development, including patents
 The applicant also has a background in cryptomodule testing:
@@ Line 442: / Line 442: @@
 The applicant has a uniquely-qualified perspective given his experience with TCSEC, TTAP, CC, FIPS 140-1, and FIPS 140-2 evaluation programs, and his real-world perspective as a developer and integrator of security-related applications.
 == GTK+ GUI for w3af project ==

@@ Line 16: / Line 16: @@
 The ASDR is a reference volume that contains basic information about all the foundational topics in application security. It intends to replace and refresh [[OWASP Honeycomb Project|Honeycomb Project]] with a new structure for articles and relationship between categories, thus making it a release quality doc.
-This idea raised when finished the [[Attack|Attack Reference Guide]] for [[OWASP Spring Of Code 2007|OWASP Spring Of Code 2007]], where it was identified that OWASP reference articles need some special attention. Jeff Williams is totally supporting this project.
+This idea raised while finishing the [[Attack|Attack Reference Guide]] for [[OWASP Spring Of Code 2007|OWASP Spring Of Code 2007]], where it was identified that OWASP reference articles needed some special attention. Jeff Williams is totally supporting this project.
 We already have defined which type of article we should include on Desk Reference, as follows:
@@ Line 27: / Line 27: @@
 * [[:Category:Business Impact|Business Impacts]]
-*Road Map: A complete project roadmap can be found on '''[[ASDR Table of Contents|ASDR Table of Contents]]'''. Basically, the following activities should be performed, some of them already started:
+*Road Map: A complete project roadmap can be found on '''[[OWASP_ASDR_Workplan]]'''. Basically, the following activities should be performed, some of them already started:
 ** Define articles templates for each reference type
 ** Define subcategories for articles classification

@@ Line 919: / Line 919: @@
 == OWASP AntiSamy .NET ==
-* Arshan Dabirsiaghi<br> - Please, '''contact [mailto:paulo.coimbra@owasp.org Paulo Coimbra] asap'''.
+* Arshan Dabirsiaghi<br>
 '''Executive Summary'''<br>

@@ Line 689: / Line 689: @@
 May 1, 2008-June 1, 2008 - Document points of detection within the application for the attack patterns & identify key information to log
-June 1, 2008-June 13, 2008 - Pier Review & Revisions
+June 1, 2008-June 13, 2008 - Peer Review & Revisions
 June 15, 2008 - Status Report
@@ Line 697: / Line 697: @@
 June 16, 2008-Aug 15, 2008 - Define recommended response actions for the security alerts
-Aug 16, 2008-Aug 30, 2008 - Pier Review & Revisions
+Aug 16, 2008-Aug 30, 2008 - Peer Review & Revisions
 Aug 31, 2008 - Project Complete

@@ Line 919: / Line 919: @@
 == OWASP AntiSamy .NET ==
-* Arshan Dabirsiaghi<br> - Please, '''contact [mailto:paulo.coimbra@owasp.org Paulo Coimbra]asap'''.
+* Arshan Dabirsiaghi<br> - Please, '''contact [mailto:paulo.coimbra@owasp.org Paulo Coimbra] asap'''.
 '''Executive Summary'''<br>

@@ Line 1,448: / Line 1,448: @@
 Current occupation: IT Audit- Senior, Eisner LLP
-== OWASP JSP Testing Tool ==
+== P028 - OWASP UI Component Verification Project (a.k.a. OWASP JSP Testing Tool) ==
 Submitted by Jason Li
@@ Line 1,467: / Line 1,467: @@
 The following initial steps should be made to create a first run draft of the project:
-* Identify or Create Tag Library Parser: The first step of this project is to determine a way to parse tag libraries and instantiate tag objects for testing. The Java EE API includes interfaces to parse and instantiate JSP tags so an initial investigation into existing implementations of tag parsers may yield an adequate source. However, since the interfaces are specified as protected and application server implementation specific, the interdependencies may require the creation of such a parser from scratch
+* '''Identify or Create Tag Library Parser''': The first step of this project is to determine a way to parse tag libraries and instantiate tag objects for testing. The Java EE API includes interfaces to parse and instantiate JSP tags so an initial investigation into existing implementations of tag parsers may yield an adequate source. However, since the interfaces are specified as protected and application server implementation specific, the interdependencies may require the creation of such a parser from scratch
-* Basic Test of Tags: The second step is to use the parser and apply some basic initial test cases to test the protection of attributes from tainted input
+* '''Basic Test of Tags''': The second step is to use the parser and apply some basic initial test cases to test the protection of attributes from tainted input
-* Design Report Format: The third step is to tabulate the results and create a simple format to convey those results.
+* '''Design Report Format''': The third step is to tabulate the results and create a simple format to convey those results.
 After this step, the project should be considered halfway towards its goals. Additionally, the following steps should be made to move towards project completion:
-* Refine Tag Testing: After initial proof of concept, significant effort should be made to vary the testing of tag attributes to give a reasonable level of assuredness regarding the accuracy of the results
+* '''Refine Tag Testing''': After initial proof of concept, significant effort should be made to vary the testing of tag attributes to give a reasonable level of assuredness regarding the accuracy of the results
-* Refine Report Format: Feedback should be solicited and improvements incorporated to the design of the report
+* '''Refine Report Format''': Feedback should be solicited and improvements incorporated to the design of the report
-* Documentation and Release: Once test cases and report format have been improved, documentation for the project should be created and the project source code prepared for release.
+* '''Documentation and Release''': Once test cases and report format have been improved, documentation for the project should be created and the project source code prepared for release.
 === Future Vision ===

← Older revision		Revision as of 18:27, 28 March 2008
Line 1,183:		Line 1,183:

	I'm very passionate about Application Security and I want to use this passion to help the Application Security community. I think the project should be selected so that the objectives of both the OWASP and Fortify can be achieved.		I'm very passionate about Application Security and I want to use this passion to help the Application Security community. I think the project should be selected so that the objectives of both the OWASP and Fortify can be achieved.
		+
		+	'''Project Plan:'''
		+
		+	My project plan can be found here: http://docs.google.com/Present?docid=dcd4c73_0ghsncvcf&skipauth=true

	== Source Code Review OWASP Projects ==		== Source Code Review OWASP Projects ==