This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "ESAPI Secure Coding Guideline"
From OWASP
(→Banned APIs) |
(→Banned APIs) |
||
| Line 308: | Line 308: | ||
|- | |- | ||
| align="center" | '''BAN009''' | | align="center" | '''BAN009''' | ||
| − | | Math.Random.* | + | | Math.Random.* |
| + | | Randomizer.* | ||
| TBD | | TBD | ||
|- | |- | ||
Revision as of 17:49, 14 April 2008
Using Security Controls
Authentication
| ID | Requirement | Code Example |
|---|---|---|
| AU001 | The application shall use |
TBD |
Session Management
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
Access Control
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use assertAuthorizedForURL() to verify authorization before allowing access to each URL.
|
TBD |
| AC002 | The application shall use assertAuthorizedForFunction() to verify authorization before allowing access to each business function.
|
TBD |
| AC003 | The application shall use assertAuthorizedForFile() to verify authorization before allowing access to files.
|
TBD |
| AC004 | The application shall use assertAuthorizedForData() to verify authorization before allowing access to data.
|
TBD |
| AC005 | The application shall use assertAuthorizedForService() to verify authorization before allowing access to each backend service.
|
TBD |
| AC006 | The application shall use isAuthorizedFor* methods to verify authorization before including user interface controls in HTML output.
|
TBD |
| AC007 | The application shall use AccessReferenceMap.getIndirectReference() to reference all application objects such as filenames, directory paths, and database keys.
|
TBD |
| AC008 | The application shall prevent access to all resources that should not be directly accessed by users (such as resources, XML files, JSP files, properties) by storing them in a protected directory, such as WEB-INF.
|
TBD |
| AC009 | The application shall use HTTPUtilities.sendSafeForward() for all forwards, to ensure that they cannot be used to bypass access checks.
|
TBD |
| AC0010 | The appplication must use only trusted data used in access control decisions. | TBD |
| AC0011 | Administrative functions for the application shall be deployed as a separate application with increased authentication controls. | TBD |
Input Validation and Encoding
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
Data Protection
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
| The application shall use an EncryptedProperties to store all security relevant data, such as passwords, credentials, codes, configuration information, addresses, etc…
Using Services Securely
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
Error Handling
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
Logging and Intrusion Detection
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
Secure Configuration and Deployment
| ID | Requirement | Code Example |
|---|---|---|
| SC001 | Production code shall not contain code not intended for use, such as debug, test, and dead code. | TBD |
| SC002 | The application's source code shall not contain secrets that would compromise security if disclosed. | TBD |
| SC003 | The application team shall run code quality tools such as FindBugs and PMD to find quality problems. | TBD |
Avoiding Specific Risks
Cross Site Scripting
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
Cross Site Request Forgery
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
Thread Safety Problems
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall avoid the use of shared storage, such as class variables, instance variables, or singletons, in all multithreaded code. | TBD |
Denial of Service
| ID | Requirement | Code Example |
|---|---|---|
| AC001 | The application shall use |
TBD |
Banned APIs
The following calls are dangerous and should be replaces with the safer calls provided by ESAPI.
| ID | Banned Call | ESAPI Replacement | Code Example |
|---|---|---|---|
| BAN001 | System.out.println() | Logger.* | TBD |
| BAN002 | Throwable.printStackTrace() | Logger.* | TBD |
| BAN003 | Runtime.exec() | Executor.safeExec() | TBD |
| BAN004 | Session.getId() | Randomizer.getRandomString() (better not to use at all) | TBD |
| BAN005 | Session.getId() | Randomizer.getRandomString() (better not to use at all) | TBD |
| BAN006 | ServletRequest.getUserPrincipal() | Authenticator.getCurrentUser() | TBD |
| BAN007 | ServletRequest.isUserInRole() | AccessController.isAuthorized*() | TBD |
| BAN008 | Session.invalidate() | Authenticator.logout() | TBD |
| BAN009 | Math.Random.* | Randomizer.* | TBD |
| BAN010 | File.createTempFile() | Randomizer.getRandomFilename() | TBD |
| BAN011 | ServletResponse.setContentType() | HTTPUtilities.setContentType() | TBD |
| BAN012 | ServletResponse.sendRedirect() | HTTPUtilities.sendSafeRedirect() | TBD |
| BAN013 | RequestDispatcher.forward() | HTTPUtilities.sendSafeForward() | TBD |
| BAN014 | ServletResponse.addHeader() | HTTPUtilities.addSafeHeader() | TBD |
| BAN015 | ServletResponse.addCookie() | HTTPUtilities.addSafeCookie() | TBD |
| BAN016 | ServletRequest.isSecure() | HTTPUtilties.isSecureChannel() | TBD |
| BAN017 | Properties.* | EncryptedProperties.* | TBD |
| BAN018 | ServletContext.log() | Logger.* | TBD |
| BAN019 | java.security and javax.crypto | Encryptor.* | TBD |
| BAN020 | java.net.URLEncoder/Decoder | Encoder.encodeForURL/decodeForURL | TBD |
| BAN021 | java.sql.Statement.execute | PreparedStatement.execute | TBD |
| BAN022 | ServletResponse.encodeURL | HTTPUtilities.safeEncodeURL (better not to use at all) | TBD |
| BAN023 | ServletResponse.encodeRedirectURL | HTTPUtilities.safeEncodeRedirectURL (better not to use at all) |
