This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:Java"

From OWASP
Jump to: navigation, search
m
m (All pages moved categories, so this list is now empty)
 
(44 intermediate revisions by 6 users not shown)
Line 1: Line 1:
−
<div style="width:100%;border:0,margin:0;overflow: hidden;">[[File:OWASP_Java_Project_Header.png|link=]]</div>
 
 
= Main =
 
= Main =
−
CAUTION - THIS PAGE IS UNDER REVIEW BY OWASP MANAGEMENT TO DETERMINE IF IT IS A LEGITIMATE POSTING AS OF JANUARY 14, 2016.  P.RITCHIE OWASP EXECUTIVE DIRECTOR
 
−
 
 
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 
| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
Line 23: Line 20:
 
* Provide a stream of security related information, like vulnerabilities and security patches, related to the Java and JVM universe.
 
* Provide a stream of security related information, like vulnerabilities and security patches, related to the Java and JVM universe.
 
* Build an ecosystem allowing to all actors interested to discuss, share and learn.
 
* Build an ecosystem allowing to all actors interested to discuss, share and learn.
−
 
−
 
  
 
== Licensing ==
 
== Licensing ==
Line 31: Line 26:
  
 
Oracle® and Java™ are [http://www.oracle.com/us/legal/trademarks/index.html|registered trademarks of Oracle] and/or its affiliates. Other names may be trademarks of their respective owners.
 
Oracle® and Java™ are [http://www.oracle.com/us/legal/trademarks/index.html|registered trademarks of Oracle] and/or its affiliates. Other names may be trademarks of their respective owners.
−
 
  
 
== What's Hot! ==
 
== What's Hot! ==
Line 37: Line 31:
 
See the "Tasks and Roadmap" tab for more information.  
 
See the "Tasks and Roadmap" tab for more information.  
  
−
[[OWASP Java Project WIPRO 1 2015|Wiki Pages Review Operation - 2015/2016]]
+
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
−
 
 
−
 
 
−
 
 
−
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 
−
 
 
−
== Team ==
 
  
−
Lead: (under discussion with board)
+
[[File:OWASP_Java_Wiki_logo.png|frame]]
  
 
<br/>
 
<br/>
Line 51: Line 39:
 
== Meta ==
 
== Meta ==
  
−
Last Update: 1/2016
+
Last Update: '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
 
<br/>
 
<br/>
Line 65: Line 53:
 
== Related Projects ==
 
== Related Projects ==
  
−
* [[OWASP_Project|Main Project Repository]]
+
* [[OWASP_Project|OWASP Project Repository]]
 
* [[Language|Languages Repository]]
 
* [[Language|Languages Repository]]
−
* [[OWASP_.NET_Project|OWASP .NET]]
+
* [[OWASP_.NET_Project|.NET Project]]
−
* [[OWASP_Ruby_Project|OWASP Ruby]]
+
* [[Ruby|Ruby]]
−
* [[OWASP_PHP_Project|OWASP PHP]]
+
* [[PHP|PHP]]
−
* [[OWASP_Python_Project|OWASP Python]]
+
* [[Perl|Perl]]
−
* [[OWASP_C/C++_Project|OWASP C/C++]]
+
* [[Python|Python]]
−
* [[OWASP_SQL_Project|OWASP SQL and PL/SQL]]
+
* [[JavaScript|JavaScript]]
 +
* [[C/C++|C/C++]]
 +
* [[SQL|SQL, PL/SQL, DB Scripting]]
 
* [[OWASP_Internet_of_Things_Project|OWASP IoT Security]]
 
* [[OWASP_Internet_of_Things_Project|OWASP IoT Security]]
 
* [[OWASP_Mobile_Security_Project|OWASP Mobile Security]]
 
* [[OWASP_Mobile_Security_Project|OWASP Mobile Security]]
−
 
−
| valign="top"  style="padding-left:25px;width:200px;" |
 
−
 
−
==Classifications==
 
−
 
−
  {| width="200" cellpadding="2"
 
−
  |-
 
−
  |
 
−
  |
 
−
  |-
 
−
  | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
 
−
  |-
 
−
  | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
 
−
  |-
 
−
  |
 
−
  |}
 
  
 
|}
 
|}
  
−
= Resources =
+
= Related OWASP Projects =
  
−
{| style="padding:0; margin:0; margin-top:10px; text-align:left; width:100%;" |-
+
== Security Tools ==
−
| valign="top" style="border-right: 1px dotted gray; padding-right:25px; width:30%; float:left;" |
 
−
 
 
−
== Mailing List ==
 
−
 
 
−
[http://lists.owasp.org/mailman/listinfo/java-project OWASP Java and JVM Technologies Mailing List]
 
−
 
 
−
| valign="top" style="padding-left:25px; width:30%; min-width:30%; border-right:1px dotted gray; padding-right:25px; float:left;" |
 
−
 
 
−
== Twitter Feed ==
 
−
 
 
−
[https://twitter.com/owasp Twitter, OWASP]
 
−
 
 
−
 
 
−
| valign="top" style="padding-left:25px; width:30%; float:left;" |
 
−
 
 
−
== Code Repository ==
 
−
 
 
−
[https://github.com/owasp GitHub OWASP Global Repository]
 
  
 +
{| width="100%"
 +
| colspan="2" | [[OWASP_Dependency_Check|OWASP Dependency Check]]
 +
|-
 +
| width="20" | &nbsp;
 +
| Dependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. Currently <b>Java</b>, .NET, Ruby, Node.js, and Python projects are supported.
 +
|-
 +
| colspan="2" | [[OWASP_SonarQube_Project|OWASP SonarQube Project]]
 +
|-
 +
| width="20" | &nbsp;
 +
| The first goal of the OWASP SonarQube Project is to a create a referential of check specifications targeting OWASP vulnerabilities that can be detected by SAST tools (Static Application Security Testing). From there, the second goal is to provide a reference implementations of most of those checks in the Open Source SonarQube language analyzers (<b>Java</b>, JavaScript, PHP and C#). SonarQube is an Open Source platform for managing code quality.
 
|}
 
|}
  
−
== Related Project Resources ==
+
== Secure Coding Libraries ==
−
 
 
−
[[OWASP_Project|Main Project Repository]]
 
−
 
 
−
[[Language|Programming Languages Repository]]
 
−
 
 
−
[[OWASP_.NET_Project|OWASP .NET Technology Knowledge Base]]
 
−
 
 
−
[[OWASP_C/C++_Project|OWASP C/C++ Technology Knowledge Base]]
 
−
 
 
−
[[OWASP_Ruby_Project|OWASP Ruby Technology Knowledge Base]]
 
−
 
 
−
[[OWASP_PHP_Project|OWASP PHP Technology Knowledge Base]]
 
−
 
 
−
[[OWASP_Python_Project|OWASP Python Technology Knowledge Base]]
 
−
 
 
−
[[OWASP_SQL_Project|OWASP SQL and SQL Scripting Technology Knowledge Base]]
 
−
 
 
−
[[OWASP_Internet_of_Things_Project|OWASP IoT Security Project]]
 
−
 
 
−
[[OWASP_Mobile_Security_Project|OWASP Mobile Security Project]]
 
−
 
 
−
 
 
−
 
 
−
 
 
−
 
 
−
 
 
−
 
 
−
 
 
−
 
 
−
= OWASP Project Pages =
 
−
 
 
−
== Tools Chain ==
 
  
 
{| width="100%"  
 
{| width="100%"  
−
| colspan="2" | [[OWASP_SonarQube_Project|OWASP SonarQube Project]]
+
|-
 +
| colspan="2" | [[OWASP_AppSensor_Project|OWASP AppSensor]]
 
|-
 
|-
 
| width="20" | &nbsp;
 
| width="20" | &nbsp;
−
| The first goal of the OWASP SonarQube Project is to a create a referential of check specifications targetting OWASP vulnerabilities and that can be detected by SAST tools (Static Application Security Testing). From there, the second goal is to provide a reference implementations of most of those checks in the Open Source SonarQube language analysers (Java, JavaScript, PHP and C#). SonarQube is an Open Source platform for managing code quality.
+
| The AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement intrusion detection and automated response into applications.
 
|-
 
|-
−
| colspan="2" | &nbsp;
+
| colspan="2" | [[CSRFGuard|OWASP CSRFGuard]]
 
|-
 
|-
−
| colspan="2" | [[OWASP_Dependency_Check|OWASP Dependency Check]]
+
| width="20" | &nbsp;
 +
| CSRFGuard is a Java library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.
 +
|-
 +
| colspan="2" | [[OWASP_Java_Encoder_Project|OWASP Java Encoder Project]]
 
|-
 
|-
 
| width="20" | &nbsp;
 
| width="20" | &nbsp;
−
| Dependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. Currently Java, .NET, Ruby, Node.js, and Python projects are supported.
+
| The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend against Cross Site Scripting.
−
|}
+
|-
−
 
 
−
<br/>
 
−
 
 
−
<br/>
 
−
 
 
−
== Libraries ==
 
−
 
 
−
{| width="100%"
 
 
| colspan="2" | [[OWASP_Java_HTML_Sanitizer|OWASP Java HTML Sanitizer]]
 
| colspan="2" | [[OWASP_Java_HTML_Sanitizer|OWASP Java HTML Sanitizer]]
 
|-
 
|-
Line 178: Line 108:
 
| The OWASP HTML Sanitizer is a fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS.
 
| The OWASP HTML Sanitizer is a fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS.
 
|-
 
|-
−
| colspan="2" | &nbsp;
+
| colspan="2" | [[OWASP_Security_Logging_Project|OWASP Security Logging Project]]
 +
|-
 +
| width="20" | &nbsp;
 +
| The OWASP Security Logging project provides developers and ops personnel with APIs for logging security-related events. The aim is to let developers use the same set of logging APIs they are already familiar with from over a decade of experience with Log4J and its successors, while also adding powerful security features.
 
|-
 
|-
−
| colspan="2" | [[OWASP_Java_Encoder_Project|OWASP Java Encoder Project]]
+
| colspan="2" | [[OWASP_ESAPI|OWASP Enterprise Security API (ESAPI)]]
 
|-
 
|-
 
| width="20" | &nbsp;
 
| width="20" | &nbsp;
−
| The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend against Cross Site Scripting.
+
| ESAPI (The OWASP Enterprise Security API) for Java is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. This project has seen major updates as recently as February 2016.
 
|}
 
|}
−
 
−
<br/>
 
−
 
−
<br/>
 
  
 
== General Documents ==
 
== General Documents ==
Line 202: Line 131:
 
|}
 
|}
  
−
<br/>
+
= Related 3rd Party Projects =
 +
 
 +
A list of third party (i.e. not part of Java SE or EE) security frameworks. This page contains a list of Java security libraries and frameworks and indicates which security features each library supports.
 +
 
 +
==Enterprise==
 +
* [http://shiro.apache.org/ Apache Shiro] is a Java security framework that performs authentication, authorization, cryptography, and session management.
 +
* [http://projects.spring.io/spring-security/ Spring Security] provides security services for Java EE-based enterprise software applications. Services include authentication, authorization and protection against attacks like session fixation, clickjacking and cross site request forgery.
 +
* [http://www.hdiv.org/ HDIV] A web application security framework that provides a number of functions.
  
−
<br/>
+
== Access Control (Authentication and Authorization) ==
 +
* [http://oaccframework.org/ OACC] is an application security framework for Java designed for fine grained (object level) access control. OACC uses the abstraction of a ''resource'' for the application objects being secured. This key abstraction enables OACC to provide a rich API that includes grant, revoke and query capabilities for storing and managing the application's security relationships.
 +
* [http://picketlink.org/appsecurity/ PicketLink]  provides authentication, single sign on, permission based access control and other security features.
  
−
== Retired, Inactive or Outdated Projects ==
+
== Encryption ==
 +
* [https://github.com/google/keyczar Keyczar] is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys.
 +
* [http://www.bouncycastle.org/ Bouncycastle] is a lightweight Java cryptography API <i>provider</i>.
 +
* [http://www.jasypt.org/ Jasypt] is a Java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.
  
−
{| width="100%"
+
== XML Security ==
−
| colspan="3" | [[https://www.owasp.org/index.php/OWASP_ESAPI#tab=Downloads|OWASP ESAPI Project Java Implementation]]
+
* The [http://santuario.apache.org/ Apache Santuario] project is aimed at providing implementation of the primary security standards for XML: XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.
−
|-
 
−
| width="20" | &nbsp;
 
−
| The Java and Java EE implementation of ESAPI Project is outdated and integrates various security issues, according to the bug tracker. It is strongly recommended to not employ this library in production code anymore and use alternative OWASP libraries instead. It still is useful for learning purposes.
 
−
| width="20" | &nbsp;
 
−
| [[https://owasp-esapi.atlassian.net/projects/ESAPILEG/issues/ESAPILEG-309?filter=allopenissues|Bug Tracker]]
 
−
|}
 
  
−
= Tasks and Roadmap =
+
== Validation ==
 +
* [http://www.sapia-oss.org/projects/vlad/home.html Vlad] stands for "validation". This projects indeed aims at offering a simple, high-level, extensible, generic validation framework that can easily be integrated into existing applications.
 +
* [https://www.owasp.org/index.php/Protect_FileUpload_Against_Malicious_File This OWASP article] and [https://github.com/righettod/document-upload-protection code snippet] proposes a way to protect a file upload feature against submission of files that may contain malicious code.
 +
* [http://commons.apache.org/proper/commons-validator/ The Apache Common's validator] can be used to perform validation.
  
 +
= Resources =
  
−
== Ongoing Operations ==
+
== Mailing List ==
  
−
{| width="100%"
+
[http://lists.owasp.org/mailman/listinfo/java-project OWASP Java and JVM Technologies Mailing List]
−
| colspan="2" | [[OWASP Java Project WIPRO 1 2015|Wiki Pages Review Operation - 2015/2016]]
 
−
|-
 
−
| width="20" | &nbsp;
 
−
| General review of all Java and JVM related pages in the wiki.
 
−
|}
 
  
 +
== Code Repository ==
  
 +
[https://github.com/owasp GitHub OWASP Global Repository]
  
−
<br/>
+
== Related Project Resources ==
  
−
== Upcoming Operations ==
+
[[OWASP_Project|OWASP Project Repository]]
  
−
None at the moment. Everything is ongoing or in early idea state.
+
[[Language|Languages Repository]]
  
−
<br/>
+
[[OWASP_.NET_Project|.NET Project]]
  
−
== Ideas ==
+
[[Ruby|Ruby Technology Knowledge Base]]
  
−
If you have ideas for new operations, documentations, documents, projects, please drop a line on the mailing list or in a mail to project team.
+
[[PHP|PHP Technology Knowledge Base]]
  
−
{| width="100%"
+
[[Perl|Perl Technology Knowledge Base]]
−
| colspan="2" | Java and JVM security related net resources guide
 
−
|-
 
−
| width="20" | &nbsp;
 
−
| The OWASP Java and JVM Technology Knowledge Base is principally about creating deep, rich guidance for Java and JVM developers using all kind of security resources. The idea is to have an effort of building a internet resource guide for everything arounf the JVM universe. Information, blogs, articles, tools, test servers and more. Important however is that this list is seriously curated.
 
−
|-
 
−
| colspan="2" | &nbsp;
 
−
|-
 
−
| colspan="2" | Concrete guidline for Java and JVM developers
 
−
|-
 
−
| width="20" | &nbsp;
 
−
| Clear checklists, around various topics, language, servers and frameworks.
 
−
|}
 
  
−
<br/>
+
[[Python|Python Technology Knowledge Base]]
−
== Archived Operations ==
 
  
−
None at the moment.
+
[[JavaScript|JavaScript Technology Knowledge Base]]
  
−
<br/>
+
[[C/C++|C/C++ Technology Knowledge Base]]
  
 +
[[SQL|SQL, PL/SQL and DB Scripting Technology Knowledge Base]]
  
 +
[[OWASP_Internet_of_Things_Project|OWASP IoT Security Project]]
  
 +
[[OWASP_Mobile_Security_Project|OWASP Mobile Security Project]]
  
 +
= Tasks and Roadmap =
  
 +
== Roadmap ==
  
 +
* Build Java and JVM security related net resources guide
 +
* The OWASP Java and JVM Technology Knowledge Base is principally about creating deep, rich guidance for Java and JVM developers using all kind of security resources. The idea is to have an effort of building a internet resource guide for everything around the JVM universe. Information, blogs, articles, tools, test servers and more. Important however is that this list is seriously curated.
 +
* Concrete guideline for Java and JVM developers
 +
* Clear checklists, around various topics, language, servers and frameworks.
  
 +
<br/>
  
 
= Get involved =
 
= Get involved =
−
 
−
There are many ways of getting involved in an OWASP documentation project.
 
  
 
The first step would be to establish contact with the project leaders and/or the entire team. This can be done using a direct and private message, or by joining the public mailing list to say hello.
 
The first step would be to establish contact with the project leaders and/or the entire team. This can be done using a direct and private message, or by joining the public mailing list to say hello.
Line 286: Line 217:
  
 
To get involved join the mailing list, follow this link: [http://lists.owasp.org/mailman/listinfo/java-project OWASP Java and JVM Mailing List]
 
To get involved join the mailing list, follow this link: [http://lists.owasp.org/mailman/listinfo/java-project OWASP Java and JVM Mailing List]
−
 
−
 
−
 
−
 
−
 
  
  
Line 316: Line 242:
  
  
−
'''IMPORTANT: all pages of these project are currently under review. A lot are outdated and are in the process of being removed or updated.''' The review effort is coordinated on this page: [[OWASP Java Project WIPRO 1 2015|Wiki Pages Review Operation - 2015/2016]].
+
'''IMPORTANT: all pages of these project are currently under review. A lot are outdated and are in the process of being removed or updated.'''  
 +
 
 +
 
  
 
<!-- Wikimedia insert classified page list here -->
 
<!-- Wikimedia insert classified page list here -->

Latest revision as of 21:55, 10 November 2017

About

The OWASP Java™ and JVM Technology Knowledge Base is the clearing house for all information related to building secure web/distributed applications and services based on Java and JVM technologies. The focus of these pages is on guidance for developers and architects using Java frameworks and JVM based technologies for web application development, on OWASP components that use Java and on participation in OWASP projects that use Java and JVM technologies. Moreover, we aim to provide security related guidance for system administrators managing Java and JVM based applications and tools.

The project is not limited to Java. It aims to also address topics around the JVM in general.

Community content is key to security information. The project depends on content from developers throughout the Java and JVM ecosystem.

Purpose

  • Provide deep, rich guidance for Java developers in using the security features of Java and of Java frameworks.
  • Address security in relation to the Java Virtual Machine and derived technologies.
  • Guide system administrators in managing Java and JVM related components and applications.
  • Create guidance for use of OWASP components that are designed for use with Java or other JVM languages.
  • Focus on information about working with and on OWASP tools built using Java or other JVM technologies.
  • Provide a stream of security related information, like vulnerabilities and security patches, related to the Java and JVM universe.
  • Build an ecosystem allowing to all actors interested to discuss, share and learn.

Licensing

OWASP Java™ and JVM Technology Knowledge Base is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

Oracle® and Java™ are trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

What's Hot!

See the "Tasks and Roadmap" tab for more information.

OWASP Java Wiki logo.png


Meta

Last Update: 11/10/2017


Other Resources

Mailing List

GitHub (OWASP)


Related Projects

Roadmap

  • Build Java and JVM security related net resources guide
  • The OWASP Java and JVM Technology Knowledge Base is principally about creating deep, rich guidance for Java and JVM developers using all kind of security resources. The idea is to have an effort of building a internet resource guide for everything around the JVM universe. Information, blogs, articles, tools, test servers and more. Important however is that this list is seriously curated.
  • Concrete guideline for Java and JVM developers
  • Clear checklists, around various topics, language, servers and frameworks.


The first step would be to establish contact with the project leaders and/or the entire team. This can be done using a direct and private message, or by joining the public mailing list to say hello.

When it comes to participating in project activities, everything depends on the time you are willing and able to invest. It is however very important to not jump into too many things at the beginning, later having to back out or to let unfinished things behind you. It is much better to start with small tasks, increasing intensity and investment over time.

Please also be patient with expecting the "merge" of your work into the existing project pages and code. As everywhere in live, trust has to be built-up.

The Java and JVM knowledge base has currently multiple tasks open, which can be found on the adequate section of this page. Not all tasks require a wiki account. Please take something you are interested in and start participating. Work load is not the only outcome when participating in open projects. You are getting a lot of things back: recognition, satisfaction, knowledge and contacts, sometime friends.

Sounds cool? Then jump in...

To get involved join the mailing list, follow this link: OWASP Java and JVM Mailing List



The previous version of this JAVA Project home page is archived here: OWASP Java Project Archive (8.2010)








IMPORTANT: all pages of these project are currently under review. A lot are outdated and are in the process of being removed or updated.

Retrieved from "https://wiki.owasp.org/index.php?title=Category:Java&oldid=235309"