This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:OWASP Orizon Project"

From OWASP
Jump to: navigation, search
Line 5: Line 5:
 
[[Category:OWASP Beta Quality Tool]]
 
[[Category:OWASP Beta Quality Tool]]
  
== Overview ==
+
{{ ProjectTabs |
 +
Proj_About =  
  
 
The quest for secure code is what all developers want to achieve (at least we hope so). Software must be reliable. Software must be strong. Software must be '''secure'''.
 
The quest for secure code is what all developers want to achieve (at least we hope so). Software must be reliable. Software must be strong. Software must be '''secure'''.
Line 19: Line 20:
 
The Orizon project, hosted by Sourceforge, is [http://orizon.sourceforge.net here].
 
The Orizon project, hosted by Sourceforge, is [http://orizon.sourceforge.net here].
  
== Goals ==
+
====Goals====
 
 
 
Orizon’s goal is to provide a set of APIs to:
 
Orizon’s goal is to provide a set of APIs to:
 
* Manage a safe coding rules library
 
* Manage a safe coding rules library
Line 31: Line 31:
 
One of OWASP’s newly-created goals is to “eat its own dog food” and Orizon will contribute to this goal by utilizing the recommendations described in the [https://www.owasp.org/index.php/Category:OWASP_Code_Review_Project OWASP Code Review Guide].
 
One of OWASP’s newly-created goals is to “eat its own dog food” and Orizon will contribute to this goal by utilizing the recommendations described in the [https://www.owasp.org/index.php/Category:OWASP_Code_Review_Project OWASP Code Review Guide].
  
== Documentation ==
+
====Join the project====
 +
Orizon wants you!
  
Available online is an  [http://downloads.sourceforge.net/orizon/The_Owasp_Orizon_Project_Internals_v2.2.ppt?use_mirror=osdn Orizon presentation] given at  [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2008_-_Belgium OWASP AppSec EU 2008] in Ghent, May 2008.
+
Of course, as an open source project, '''anybody''' is welcome to join Orizon, and please do. If you are a skilled C#, Java, or ASP developer and you want to share your experience with these languages, feel free to use the mailing list to contribute to these Orizon-supported languages.
  
== Download ==
+
If you are a skilled Java developer why don't you consider writing a bunch of code for Orizon? Or, consider joining the project for documentation, advertising, blog maintenance, etc.
  
The source code is in a Subversion repository and hosted at sourceforge.net.
+
We hope you find the OWASP Orizon Project useful. Please contribute to the project by volunteering for one of the tasks, or by sending your comments, questions, and suggestions to owasp@owasp.org.  
  
The latest release is [http://downloads.sourceforge.net/orizon/orizon-1.0.jar?use_mirror=heanet 1.0].
+
To join the OWASP Orizon Project mailing list or view the archives, please visit the [http://lists.owasp.org/mailman/listinfo/owasp-orizon subscription page.]
 
 
== Dawn ==
 
 
 
In September 2007, while hacking around release 0.50, a decision was made to introduce dynamic code review facilities – first for the Java language. ''Dawn'' was chosen as the name of this new feature in Orizon.
 
 
 
The project team believes that this will be the most cutting edge technology inside of Orizon; it will help developers ''rise'' from buggy and unsafe code to hardened and secure code; hence, the name ''dawn'' for all related dynamic code review.
 
 
 
Dawn was implemented in Orizon release 0.45pre1.
 
 
 
== Bastion ==
 
 
 
Around March 2007, feedback from stressing the importance of reviewing code for security issues brought about the realization that a more lightweight solution needed to be provided for those that were afraid of undertaking a full code review activity, or simply for those who wanted a quickie until the security review was completed..
 
 
 
For this reason, a parallel project called Bastion was realized in order to provide Java developers with classes that embed security checks in their core, giving them a quick fix without having to change too much code.
 
 
 
Please understand that Bastion will not come close to substituting for robust secure coding, but it will provide some minimal secure coding functionality while full-fledged secure coding is being undertaken in other parts of the application.
 
 
 
Starting from Orizon v0.25, Bastion is a separate JAR file. The latest Bastion version is
 
[http://downloads.sourceforge.net/orizon/bastion-0.42-b193.jar?use_mirror=heanet 0.42 Build 193].
 
 
 
A very simple web application that demonstrates how to use Bastion to fix a very generic Cross Site Scripting attack by changing a single line of code can be found
 
[http://downloads.sourceforge.net/orizon/bastion_test.war?use_mirror=heanet here]. To use it, point your browser to ''http://<domain name>/bastion_test'' and follow the instructions.
 
 
 
The Bastion test application is built against a very old Orizon version when Bastion was still contained inside of Orizon. Because the current focus of the project is on the Orizon APIs, the Bastion code remains unchanged since April.
 
 
 
A few words need to be said here: there is no intention to reinvent the wheel. The Web is full of libraries that sanitize source code in order to mitigate an attack on a web application. Bastion is just our small contribution to the community; we really hope that you'll appreciate it.
 
  
== The library ==
 
  
For a code review tool, the most important factor is its knowledge, which are the security checks that is applied to the source code. No matter how many features a tool has or how fancy is its UI, a poor security check library means that the tool is useless.
 
  
Orizon organizes safe coding best practices in XML rules that are contained in files called recipes. The mantra chosen for the project is that "coding is like cooking" and the goal is to choose the correct set of recipes.
+
====Download====
  
Recipes are gathered together in a zip file named Library.
+
The latest release is [http://downloads.sourceforge.net/orizon/orizon_1.17.zip?use_mirror=heanet 1.17].
  
Following is the layout of the knowledge inside of Orizon.
+
====The blog====
 
 
=== The XML schema ===
 
 
 
The Orizon XML schema used to describe secure coding checks can be difficult to read. On this [http://www.owasp.org/index.php/OWASP_Orizon_Project_XML page], more details about how an XML rule is built can be found.
 
 
 
== Blog ==
 
  
 
The Orizon blog is proudly hosted by SourceForge [http://orizon.sourceforge.net/blog here].
 
The Orizon blog is proudly hosted by SourceForge [http://orizon.sourceforge.net/blog here].
  
== Future development ==
+
|
  
The first draft of the project roadmap was far too optimistic. Refer to the official Orizon Roadmap [http://orizon.sourceforge.net/roadmap.html page] for an updated and more realistic project roadmap.
+
Proj_Documentation= Available online is an  [http://downloads.sourceforge.net/orizon/The_Owasp_Orizon_Project_Internals_v2.2.ppt?use_mirror=osdn Orizon presentation] given at  [http://www.owasp.org/index.php/OWASP_AppSec_Europe_2008_-_Belgium OWASP AppSec EU 2008] in Ghent, May 2008.
 
 
== Presentations ==
 
 
 
All presentations listed here were given by Paolo Perego.
 
  
 
  '''Owasp Orizon Internals @ Owasp AppSec NY 2008, New York 22-25th September 2008'''
 
  '''Owasp Orizon Internals @ Owasp AppSec NY 2008, New York 22-25th September 2008'''
Line 105: Line 68:
 
I will talk to [http://www.webb.it SMAU eAcademy2006] next Saturday 7th October 2006 about code review and safe coding. [http://webb.it/event/eventview/5772/1/0,0/code_review_e_principi_di_programmazione_sicura Here] you can find more information (for now, only in Italian). The last part of the speech will be about introducing the Orizon project and giving a development roadmap.
 
I will talk to [http://www.webb.it SMAU eAcademy2006] next Saturday 7th October 2006 about code review and safe coding. [http://webb.it/event/eventview/5772/1/0,0/code_review_e_principi_di_programmazione_sicura Here] you can find more information (for now, only in Italian). The last part of the speech will be about introducing the Orizon project and giving a development roadmap.
  
== Project creation ==
+
A slideshare space is available to for the presentations used in Owasp [http://www.slideshare.net/thesp0nge | conferences]
  
'''OWASP Orizon Project Created! - 09:24, 2 October 2006 (EDT)'''
+
|
  
The Open Web Application Security Project is proud to announce the OWASP Orizon Project!
 
  
== Feedback and participation ==
 
  
Orizon wants you!
 
  
Of course, as an open source project, '''anybody''' is welcome to join Orizon, and please do. If you are a skilled C#, Java, or ASP developer and you want to share your experience with these languages, feel free to use the mailing list to contribute to these Orizon-supported languages.
+
}}
  
If you are a skilled Java developer why don't you consider writing a bunch of code for Orizon? Or, consider joining the project for documentation, advertising, blog maintenance, etc.
 
  
We hope you find the OWASP Orizon Project useful. Please contribute to the project by volunteering for one of the tasks, or by sending your comments, questions, and suggestions to [email protected].
+
== Project creation ==
  
To join the OWASP Orizon Project mailing list or view the archives, please visit the [http://lists.owasp.org/mailman/listinfo/owasp-orizon subscription page.]
+
'''OWASP Orizon Project Created! - 09:24, 2 October 2006 (EDT)'''
  
== Project contributors ==
+
The Open Web Application Security Project is proud to announce the OWASP Orizon Project!
  
- [[User:Thesp0nge|thesp0nge]] 09:47, 2 October 2006 (EDT)
 
  
 
== Project sponsor ==
 
== Project sponsor ==
  
 
[https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008 OWASP Summer of Code 2008]
 
[https://www.owasp.org/index.php/OWASP_Summer_of_Code_2008 OWASP Summer of Code 2008]

Revision as of 14:25, 19 May 2009


PROJECT IDENTIFICATION
Project Name OWASP Orizon Project
Short Project Description This project born in 2006 in order to provide a framework to all Owasp projects developing code review services. The project is in a quite stable stage and it is usable for Java static code review and some dynamic tests against XSS. Owasp Orizon includes also APIs for code crawling, usable for code crawling tools.
Key Project Information Project Leader
Paolo Perego
Project Contributors
See here
Mailing list
Subscribe here
Use here

License
Creative Commons Attribution Share Alike 3.0

Project Type
Tool

Sponsor
OWASP SoC 08
Release Status Main Links Related Projects

Beta Quality
Please see here for complete information.

The Owasp OrizonProject in Power Point
Orizon Safe coding and beyond - Word File
Orizon 1.19 - The Latest Release
Orizon internal draft
Orizon site at sourceforge
Orizon blog

OWASP Code Review Guide


About

The quest for secure code is what all developers want to achieve (at least we hope so). Software must be reliable. Software must be strong. Software must be secure.

How secure does my software have to be? The correct answer is hard to find. But security is a problem that even a development team must consider.

Should skilled developers also be security gurus? Not necessarily, but it is important to provide security tools that will augment their development skills. And so our quest for secure code begins...

The OWASP Orizon project was created with the aim of providing a common ground for safe coding and code review methodologies to be applied to software. The project is approaching its first major release and it will be able to be used in a production environment in the near future.

Orizon must give thanks to Findbugs, the OWASP LAPSE Project, RATS, and Flawfinder for ideas and inspiration.

The Orizon project, hosted by Sourceforge, is here.

Goals

Orizon’s goal is to provide a set of APIs to:

  • Manage a safe coding rules library
  • Apply these rules to a generic source file
  • Support the most widely used programming languages
  • Create reports that shows source code assessment results
  • Allow developers to build code review tools
  • Help people understand how important it is to apply safe coding rules while making software

One of OWASP’s newly-created goals is to “eat its own dog food” and Orizon will contribute to this goal by utilizing the recommendations described in the OWASP Code Review Guide.

Join the project

Orizon wants you!

Of course, as an open source project, anybody is welcome to join Orizon, and please do. If you are a skilled C#, Java, or ASP developer and you want to share your experience with these languages, feel free to use the mailing list to contribute to these Orizon-supported languages.

If you are a skilled Java developer why don't you consider writing a bunch of code for Orizon? Or, consider joining the project for documentation, advertising, blog maintenance, etc.

We hope you find the OWASP Orizon Project useful. Please contribute to the project by volunteering for one of the tasks, or by sending your comments, questions, and suggestions to [email protected].

To join the OWASP Orizon Project mailing list or view the archives, please visit the subscription page.


Download

The latest release is 1.17.

The blog

The Orizon blog is proudly hosted by SourceForge here.

FAQ

Available online is an Orizon presentation given at OWASP AppSec EU 2008 in Ghent, May 2008.

Owasp Orizon Internals @ Owasp AppSec NY 2008, New York 22-25th September 2008

Orizon@AppSec NY 2008

Owasp Orizon Internals @ Owasp AppSec EU 2008, Ghent 21-22nd May 2008

Orizon@AppSec EU 2008

Owasp Orizon Internals @ Owasp Day Italy 2008, Rome 31st March 2008

Orizon@Owasp Day in Italy

OWASP Orizon Project @ SMAU eAcademy, Milan 4-7th October 2006

I will talk to SMAU eAcademy2006 next Saturday 7th October 2006 about code review and safe coding. Here you can find more information (for now, only in Italian). The last part of the speech will be about introducing the Orizon project and giving a development roadmap.

A slideshare space is available to for the presentations used in Owasp [http://www.slideshare.net/thesp0nge

News

{{{Proj_Mail}}}

Contributors/Users

{{{Proj_Contributors}}}



Project creation

OWASP Orizon Project Created! - 09:24, 2 October 2006 (EDT)

The Open Web Application Security Project is proud to announce the OWASP Orizon Project!


Project sponsor

OWASP Summer of Code 2008

Pages in category "OWASP Orizon Project"

This category contains only the following page.