This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:OWASP Enterprise Security API"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
 
{{ProjectTabs |  
 
{{ProjectTabs |  
−
Proj_ShortDesc= [[Image:Esapi-bannerbug.JPG|200px|right]]Reinventing the wheel when it comes to developing security controls for every web application or web service leads to wasted time and massive security holes. The '''OWASP Enterprise Security API (ESAPI) Toolkits''' help software developers guard against security-related design and implementation flaws. The ESAPI Toolkit architecture is very simple – a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application. There are ESAPI Toolkits for the following platforms:
+
Proj_About= [[Image:Esapi-bannerbug.JPG|200px|right]]Reinventing the wheel when it comes to developing security controls for every web application or web service leads to wasted time and massive security holes. The '''OWASP Enterprise Security API (ESAPI) Toolkits''' help software developers guard against security-related design and implementation flaws. Just as web applications and web services can be Public Key Infrastructure (PKI) enabled (PK-enabled) to perform for example certificate-based authentication, applications and services can be OWASP ESAPI-enabled (ES-enabled) to enable applications and services to protect themselves from attackers.  
−
* '''Java EE''' - This version of the ESAPI Toolkit is currently available.
 
−
* '''.NET''' - This version of the ESAPI Toolkit is currently under development.
 
−
* '''PHP''' - This version of the ESAPI Toolkit is currently under development.|
 
  
−
Proj_Contributors= Project Leader<br>[[:User:Jeff Williams|Jeff Williams]]<br><br>Project Contributors<br>[[User:Jmanico|Jim Manico]] <br>[[User:Wichers|Dave Wichers]]<br> [[User:Arshan|Arshan Dabirsiaghi]] <br> [[User:Jerryhoff|Jerry Hoff]] |
 
−
 
−
Proj_Lists= [http://lists.owasp.org/mailman/listinfo/owasp-esapi '''Subscribe here''']<br>[mailto:[email protected] '''Use here'''] |
 
−
 
−
Proj_License= [http://en.wikipedia.org/wiki/BSD_license '''BSD license'''] |
 
−
 
−
Proj_Type= [[:Category:OWASP_Project#Release Quality Projects|'''Tool''']] |
 
−
 
−
Proj_Sponsor= <div style="background:#ffffff">[http://www.aspectsecurity.com/ http://www.owasp.org/images/d/d1/Aspect_logo.gif]</div> |
 
−
 
−
Proj_Status= Provisory '''[[:Category:OWASP Project Assessment#Release Quality Tool Criteria|Release Quality]]'''<br>(Waiting for Second Reviewer's assessment)<br>[[:OWASP Enterprise Security API Project - Assessment Frame|Please see here for complete information.]] |
 
−
 
−
Proj_Links= [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation]<br>[http://www.youtube.com/watch?v=QAPD1jPn04g ESAPI Video presentation]<br>ESAPI Demo application - [[ESAPI_Swingset|The ESAPI Swingset]]<br>JAVA 1.4 compatible JAR for ESAPI v1.4 - [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar Complete] & [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar Basic] JAR files<br>[http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.4.zip Source files for ESAPI v1.4]<br>[http://code.google.com/p/owasp-esapi-java/ ESAPI Google Code repository]<br>[http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html ESAPI Javadocs]<br>[http://code.google.com/p/owasp-esapi-java/source/browse/#svn/trunk/src/main/java/org/owasp/esapi Browse the Java source at Google]<br>[[ESAPI_Javadocs | Javadocs' information generation]]<br>[http://code.google.com/p/owasp-esapi-java/issues/list Problems with the ESAPI may be reported here] |
 
−
 
−
Proj_Related= [[Top Ten|OWASP Top Ten]]
 
−
}}
 
−
 
−
'''What is ESAPI?'''
 
−
 
−
[[Image:Esapi-beta.JPG|thumb|300px|right|OWASP ESAPI Book]]
 
−
Just as web applications and web services can be Public Key Infrastructure (PKI) enabled (PK-enabled) to perform for example certificate-based authentication, applications and services can be OWASP ESAPI-enabled (ES-enabled) to enable applications and services to protect themselves from attackers. OWASP ESAPI Toolkits empower web application and web service developers with the ability to increase the overall degree of trust that can be placed in their applications and services. ESAPI Toolkit security controls operate using a unique deny-by-default strategy, performing security checks using white lists.
 
  
 +
OWASP ESAPI Toolkits empower web application and web service developers with the ability to increase the overall degree of trust that can be placed in their applications and services. ESAPI Toolkit security controls operate using a unique deny-by-default strategy, performing security checks using white lists. The ESAPI Toolkit architecture is very simple – a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.
 +
<br>
 +
<br>
 
Using an ESAPI Toolkit realizes cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. Available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection! ESAPI Toolkits are designed to automatically take care of many aspects of application security, making these issues invisible to the developers.
 
Using an ESAPI Toolkit realizes cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. Available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection! ESAPI Toolkits are designed to automatically take care of many aspects of application security, making these issues invisible to the developers.
−
 
+
<br>
−
OWASP ESAPI Toolkits provide the same basic interfaces (including common logging interfaces) across common platforms, including Java EE, .NET, and PHP.
+
<br>
−
 
 
'''Additional Benefits'''
 
'''Additional Benefits'''
−
 
+
<br>
 
The use of the ESAPI will also make it much easier for static analysis tools to verify an application, by building ESAPI calls into static analysis tool rulesets.
 
The use of the ESAPI will also make it much easier for static analysis tools to verify an application, by building ESAPI calls into static analysis tool rulesets.
 +
<br>
 +
<br>
 +
'''Where did ESAPI come from?'''
 +
<br>
 +
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications.  If you'd like to volunteer to help on the project, you can contact him at [email protected].
 +
<br>
 +
<br>
  
−
'''Where did ESAPI come from?'''
+
|
  
−
The OWASP ESAPI project is led by [[User:Jeff Williams|Jeff Williams]], who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications.  If you'd like to volunteer to help on the project, you can contact him at [email protected].
+
Proj_Documentation=
 +
<br>'''More About OWASP ESAPI'''
 +
[[Image:Esapi-project.JPG|thumb|left|110px|Project Presentation]]
  
−
More information about the ESAPI can be found [[:Category:OWASP_Enterprise_Security_API#OWASP_ESAPI_Documentation_Downloads here]].
+
* ESAPI interface documentation ([http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html JavaDocs])
 +
* Project presentation ([http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx PowerPoint])
 +
* Video presentation ([http://www.youtube.com/watch?v=QAPD1jPn04g YouTube])
 +
* One Page Conference Handout ([http://www.owasp.org/images/3/31/ESAPI_One_Page_Handout.pdf PDF], [http://www.owasp.org/images/d/d0/ESAPI_One_Page_Handout.doc Word])
 +
<br>
 +
<br>
 +
<br>
 +
<br>
 +
'''Related projects:'''
  
−
==Architecture==
+
* [[Top Ten|OWASP Top Ten]]
 
<br>
 
<br>
−
[[Image:OWASPTopTen.jpg|thumb|600px|right|OWASP ESAPI Top Ten Coverage]]OWASP ESAPI Toolkits are not frameworks! The ESAPI Toolkit architecture is very simple, just a collection of classes that encapsulate the key security operations most applications need. ESAPI Toolkits provide common sets of interfaces for security controls including:
+
====Java EE====
−
 
−
* Authentication
 
−
* Access Control
 
−
* Input Validation
 
−
* Output Encoding/Escaping
 
−
* Cryptography
 
−
* Error Handling and Logging
 
−
* Data Protection
 
−
* Communication Security
 
−
* HTTP Security
 
−
* Security Configuration
 
−
 
−
ESAPI Toolkit interfaces only include methods that are widely useful and focus on the most risky areas. Interfaces are designed to be simple to understand and use. ESAPI Toolkits are designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development.  New development projects should consider ES-enabling their framework to make even more of the security happen automatically. ESAPI Toolkits include an ESAPI filter that can be used to minimize the changes required to your base application.
 
−
 
−
ESAPI Toolkits are designed and implemented to guard against the risks described in the OWASP [[Top Ten]], and to meet the requirements of the [[ASVS | OWASP Application Security Verification Standard (ASVS)]]. Compare this coverage with automated scanning and static analysis tools, and then consider how your time is best spent!
 
−
 
−
==OWASP ESAPI Java EE Beta Code Downloads==
 
 
<br>
 
<br>
 +
Provisory '''[[:Category:OWASP Project Assessment#Release Quality Tool Criteria|Release Quality]]'''<br>(Waiting for Second Reviewer's assessment)<br>[[:OWASP Enterprise Security API Project - Assessment Frame|Please see here for complete information.]]
 +
 +
----
 +
 +
<br>
 +
'''Java Edition of the OWASP ESAPI Toolkit'''
 
[[Image:Esapi-beta.JPG|thumb|110px|left|ESAPI]]
 
[[Image:Esapi-beta.JPG|thumb|110px|left|ESAPI]]
−
Download free:
 
  
−
'''OWASP ESAPI'''
+
* This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better.  Please contact [email protected] for more information.  If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!
 +
* Versions (archived source files are also available on the SVN under tags)
 +
<br>
  
−
This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better.  Please contact [email protected] for more information.  If you're interested in application security, please join the [http://lists.owasp.org/mailman/listinfo/owasp-esapi OWASP ESAPI mailing list] and help make ESAPI better!
 
−
 
−
Versions (archived source files are also available on the SVN under tags)
 
 
<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>
 
<table width="100%" valign="top"><tr><th width="50%">JAR Files</th><th>Source Files</th></tr><tr valign="top"><td>
 
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar ESAPI v1.4 Complete JAR file]  
 
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar ESAPI v1.4 Complete JAR file]  
Line 76: Line 58:
 
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar ESAPI v1.4 Basic JAR file]
 
; [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar ESAPI v1.4 Basic JAR file]
 
: Java 1.4 compatible JAR for ESAPI v1.4 (does not contain many reference implementations)
 
: Java 1.4 compatible JAR for ESAPI v1.4 (does not contain many reference implementations)
 +
 +
----
  
 
</td><td>
 
</td><td>
Line 84: Line 68:
 
</table>
 
</table>
  
−
'''Additional Resources'''
+
<br>ESAPI Demo application - [[ESAPI_Swingset|The ESAPI Swingset]]<br>JAVA 1.4 compatible JAR for ESAPI v1.4 - [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-full-java-1.4.jar Complete] & [http://owasp-esapi-java.googlecode.com/files/owasp-esapi-basic-java-1.4.jar Basic] JAR files<br>[http://owasp-esapi-java.googlecode.com/files/owasp-esapi-java-src-1.4.zip Source files for ESAPI v1.4]<br>[http://code.google.com/p/owasp-esapi-java/ ESAPI Google Code repository]<br>[http://code.google.com/p/owasp-esapi-java/source/browse/#svn/trunk/src/main/java/org/owasp/esapi Browse the Java source at Google]<br>[http://code.google.com/p/owasp-esapi-java/issues/list Problems with the ESAPI may be reported here]
  
−
* Information regarding the ESAPI SVN can be found at [http://code.google.com/p/owasp-esapi-java/ the ESAPI Google Code repository].
+
----
 +
 
 +
'''Using the ESAPI'''
 +
 
 +
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
 +
* Download the latest version of the ESAPI JAR from above.
 +
* Add the ESAPI JAR to your project's build path.
 +
* The current ESAPI JAR has been built for Java 1.6, however support for Java 1.4.2+ is available.  Please see [[ESAPI-Building here]] for information on building ESAPI for a different version of Java. 
 +
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.
  
−
* If you have any problems with the ESAPI, please report them to [http://code.google.com/p/owasp-esapi-java/issues/list the issues section].
+
'''Running Demo App'''
  
−
* For more information about the ESAPI, please view the [http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx ESAPI PowerPoint presentation].
+
The ESAPI Demo application has been named [[ESAPI_Swingset|''The ESAPI Swingset'']].  More information about Swingset is available [[ESAPI_Swingset | here]].
  
−
* If you are generating your own Javadocs for the ESAPI project, information regarding generation can be found [[ESAPI_Javadocs | here]].
+
====PHP====
 
<br>
 
<br>
 +
The PHP Edition of the ESAPI Toolkit is under development and not yet available for download.
 +
<br>
 +
* Contact [mailto:[email protected] Andrew van der Stock] for further details. Volunteers wanted!
 +
<br>
 +
The current plan is as follows:
 +
<br>
 +
<br>
 +
Release 1 (OWASP EU - May 2009)
  
−
==OWASP ESAPI Documentation Downloads==
+
Where I mention a class, it's a 100% equivalence to the J2EE reference implementation @ that point.
−
<br>
+
 
−
[[Image:Esapi-project.JPG|thumb|110px|left|Project Presentation]]
+
* ESAPI main class
−
Download free:
+
* All interfaces (even those that are stubbed out)
 +
* AccessReferenceMap
 +
* Exceptions (i.e. everything in errors/)
 +
* Encoder and everthing in codecs/
 +
* HTTP Utilities
 +
* String Utilities
 +
* Validator
 +
* PHPdoc for all classes builds and is on the site
 +
* SimpleTest tests for the classes implemented in this release
 +
 
 +
 
 +
Release 2 (2H 2009 - OWASP USA if possible, if not, Christmas / NY 2009)
 +
 
 +
* Executor
 +
* SafeFile
 +
* EncryptedProperties
 +
* Encryptor
 +
* Randomizer
 +
* Logger
 +
* IntrusionDetector
 +
* Simple Tests for the new classes
 +
* PHPdoc for all classes builds and is on the site
 +
* No updates to release 1 functionality (for now) - it's too hard to chase a moving target
 +
 
 +
 
 +
Release 3 (1H 2010 - OWASP EU 2010)
 +
 
 +
Equivalence to J2EE Reference Implementation
  
−
'''About OWASP ESAPI'''
+
* Filters:
 +
* SafeRequest, SafeResponse, SafeHTTPFilter, ESAPIFilter, RequestRateThrottler
 +
* Authenticator
 +
* AccessController
 +
* User
 +
* SimpleTests for all classes
 +
* PHPdoc for all classes builds and is on the site
 +
* Updates to release 1/2 functionality to bring them inline with the current J2EE implementation
  
−
* ESAPI interface documentation ([http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html JavaDocs])
 
−
* Project presentation ([http://owasp-esapi-java.googlecode.com/svn/trunk/documentation/OWASP%20ESAPI%20Overview.pptx PowerPoint])
 
−
* Video presentation ([http://www.youtube.com/watch?v=QAPD1jPn04g YouTube])
 
−
* One Page Conference Handout ([http://www.owasp.org/images/3/31/ESAPI_One_Page_Handout.pdf PDF], [http://www.owasp.org/images/d/d0/ESAPI_One_Page_Handout.doc Word])
 
  
 +
Features that will not be ported:
  
−
==Changing/Building/Using the ESAPI==
+
* Tags. There's no equivalent in the PHP world. I might consider a short name function like h() for HTML Encode, but honestly, that's fairly trivial compared to trying to force a JSP-ism onto PHP.  
−
If you would like to work with the ESAPI source code, or build the project, please [[ESAPI-Building | see here]].
 
  
−
===Using the ESAPI===
+
====.NET====
−
If you want to see what the ESAPI is all about, and want to use the built-in implementations,
+
<br>
−
* Download the latest version of the ESAPI JAR from above.
+
The .NET Edition of the ESAPI Toolkit is under development and not yet available for download.
−
* Add the ESAPI JAR to your project's build path.
+
<br>
−
* The current ESAPI JAR has been built for Java 1.6, however support for Java 1.4.2+ is available.  Please see [[ESAPI-Building here]] for information on building ESAPI for a different version of Java.
 
−
* Use the [http://owasp-esapi-java.googlecode.com/svn/trunk_doc/index.html ESAPI's Javadocs ] to take advantage of all the built-in functions of the ESAPI.
 
  
−
===Running Demo App===
+
  |
−
The ESAPI Demo application has been named [[ESAPI_Swingset|''The ESAPI Swingset'']]. More information about Swingset is available [[ESAPI_Swingset | here]].
 
  
−
==Project Sponsors==
+
Proj_Mail= <br>'''Project News:'''<br><br>'''Project Mail List:'''<br>[http://lists.owasp.org/mailman/listinfo/owasp-esapi Subscribe here]<br>[mailto:[email protected] Use here] |
  
−
The OWASP ESAPI project is sponsored by
+
Proj_Related= [[Top Ten|OWASP Top Ten]] |
−
[http://www.aspectsecurity.com http://www.owasp.org/images/d/d1/Aspect_logo.gif]
 
  
−
==Licensing==
+
Proj_Contributors= '''Project Leader'''<br>[[:User:Jeff Williams|Jeff Williams]]<br><br>'''Project Contributors'''<br>[[User:Jmanico|Jim Manico]] <br>[[User:Wichers|Dave Wichers]]<br> [[User:Arshan|Arshan Dabirsiaghi]] <br> [[User:Jerryhoff|Jerry Hoff]]
−
This project licensed under the [http://en.wikipedia.org/wiki/BSD_license BSD license], which is very permissive and about as close to public domain as is possible. You can use or modify ESAPI however you want, even include it in commercial products.
 
  
−
== Articles - More About ESAPI and Using ESAPI ==
+
}}
 +
''This project licensed under the [http://en.wikipedia.org/wiki/BSD_license BSD license], which is very permissive and about as close to public domain as is possible. You can use or modify ESAPI however you want, even include it in commercial products. This project is sponsored by:''
 +
<br>
 +
<br>
 +
[http://www.aspectsecurity.com/ http://www.owasp.org/images/d/d1/Aspect_logo.gif]
 +
<br>

Revision as of 03:55, 7 March 2009

About

Esapi-bannerbug.JPG
Reinventing the wheel when it comes to developing security controls for every web application or web service leads to wasted time and massive security holes. The OWASP Enterprise Security API (ESAPI) Toolkits help software developers guard against security-related design and implementation flaws. Just as web applications and web services can be Public Key Infrastructure (PKI) enabled (PK-enabled) to perform for example certificate-based authentication, applications and services can be OWASP ESAPI-enabled (ES-enabled) to enable applications and services to protect themselves from attackers.


OWASP ESAPI Toolkits empower web application and web service developers with the ability to increase the overall degree of trust that can be placed in their applications and services. ESAPI Toolkit security controls operate using a unique deny-by-default strategy, performing security checks using white lists. The ESAPI Toolkit architecture is very simple – a collection of classes that encapsulate the key security operations most applications need. ESAPI is designed to make it easy to retrofit security into existing applications, as well as providing a solid foundation for new development. ESAPI comes with an ESAPI filter that minimizes the changes required to your base application.

Using an ESAPI Toolkit realizes cost savings through reduced development time, and the increased security due to using heavily analyzed and carefully designed security methods provide developers with a massive advantage over organizations that are trying to deal with security using existing ad hoc secure coding techniques. Available platforms, frameworks, and toolkits (Java EE, Struts, Spring, etc...) simply do not provide enough protection! ESAPI Toolkits are designed to automatically take care of many aspects of application security, making these issues invisible to the developers.

Additional Benefits
The use of the ESAPI will also make it much easier for static analysis tools to verify an application, by building ESAPI calls into static analysis tool rulesets.

Where did ESAPI come from?
The OWASP ESAPI project is led by Jeff Williams, who serves as the volunteer chair of OWASP and is the CEO of Aspect Security. Jeff is a software developer who has specialized in application security since 1995. The ESAPI is the result of over a decade of code review and penetration testing of critical enterprise applications. If you'd like to volunteer to help on the project, you can contact him at [email protected].

FAQ


More About OWASP ESAPI

Project Presentation





Related projects:


Java EE


Provisory Release Quality
(Waiting for Second Reviewer's assessment)
Please see here for complete information.


Java Edition of the OWASP ESAPI Toolkit

ESAPI
  • This release is the first public release and will undoubtably undergo significant revision over the coming months. We are seeking organizations willing to pilot this ESAPI and work with us to make this library better. Please contact [email protected] for more information. If you're interested in application security, please join the OWASP ESAPI mailing list and help make ESAPI better!
  • Versions (archived source files are also available on the SVN under tags)


JAR FilesSource Files
ESAPI v1.4 Complete JAR file
JAVA 1.4 compatible JAR for ESAPI v1.4
ESAPI v1.4 Basic JAR file
Java 1.4 compatible JAR for ESAPI v1.4 (does not contain many reference implementations)
ESAPI v1.4 Source archive
Source files for ESAPI v1.4


ESAPI Demo application - The ESAPI Swingset
JAVA 1.4 compatible JAR for ESAPI v1.4 - Complete & Basic JAR files
Source files for ESAPI v1.4
ESAPI Google Code repository
Browse the Java source at Google
Problems with the ESAPI may be reported here

Using the ESAPI

If you want to see what the ESAPI is all about, and want to use the built-in implementations,

  • Download the latest version of the ESAPI JAR from above.
  • Add the ESAPI JAR to your project's build path.
  • The current ESAPI JAR has been built for Java 1.6, however support for Java 1.4.2+ is available. Please see ESAPI-Building here for information on building ESAPI for a different version of Java.
  • Use the ESAPI's Javadocs to take advantage of all the built-in functions of the ESAPI.

Running Demo App

The ESAPI Demo application has been named The ESAPI Swingset. More information about Swingset is available here.

PHP


The PHP Edition of the ESAPI Toolkit is under development and not yet available for download.


The current plan is as follows:

Release 1 (OWASP EU - May 2009)

Where I mention a class, it's a 100% equivalence to the J2EE reference implementation @ that point.

  • ESAPI main class
  • All interfaces (even those that are stubbed out)
  • AccessReferenceMap
  • Exceptions (i.e. everything in errors/)
  • Encoder and everthing in codecs/
  • HTTP Utilities
  • String Utilities
  • Validator
  • PHPdoc for all classes builds and is on the site
  • SimpleTest tests for the classes implemented in this release


Release 2 (2H 2009 - OWASP USA if possible, if not, Christmas / NY 2009)

  • Executor
  • SafeFile
  • EncryptedProperties
  • Encryptor
  • Randomizer
  • Logger
  • IntrusionDetector
  • Simple Tests for the new classes
  • PHPdoc for all classes builds and is on the site
  • No updates to release 1 functionality (for now) - it's too hard to chase a moving target


Release 3 (1H 2010 - OWASP EU 2010)

Equivalence to J2EE Reference Implementation

  • Filters:
  • SafeRequest, SafeResponse, SafeHTTPFilter, ESAPIFilter, RequestRateThrottler
  • Authenticator
  • AccessController
  • User
  • SimpleTests for all classes
  • PHPdoc for all classes builds and is on the site
  • Updates to release 1/2 functionality to bring them inline with the current J2EE implementation


Features that will not be ported:

  • Tags. There's no equivalent in the PHP world. I might consider a short name function like h() for HTML Encode, but honestly, that's fairly trivial compared to trying to force a JSP-ism onto PHP.

.NET


The .NET Edition of the ESAPI Toolkit is under development and not yet available for download.

News


Project News:

Project Mail List:
Subscribe here
Use here

Contributors/Users

Project Leader
Jeff Williams

Project Contributors
Jim Manico
Dave Wichers
Arshan Dabirsiaghi
Jerry Hoff


This project licensed under the BSD license, which is very permissive and about as close to public domain as is possible. You can use or modify ESAPI however you want, even include it in commercial products. This project is sponsored by:

Aspect_logo.gif

Retrieved from "https://wiki.owasp.org/index.php?title=Category:OWASP_Enterprise_Security_API&oldid=56272"