This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
ESAPI Specification
From OWASP
Revision as of 06:44, 16 June 2011 by Chris Schmidt (talk | contribs)
- 1 Proposed Migration Roadmap
- 2 Core API Specification
- 2.1 AccessController
- 2.2 AccessReferenceMap<Key>
- 2.3 Authenticator
- 2.4 Codec
- 2.5 Encoder
- 2.6 Encryptor
- 2.6.1 PlainText decrypt(CipherText cipherText, SecretKey secretKey) throws EncryptionException
- 2.6.2 CipherText encrypt(PlainText plainText, SecretKey secretKey) throws EncryptionException
- 2.6.3 MessageDigest hash(PlainText plainText, Salt salt, Integer iterations) throws EncryptionException
- 2.6.4 String seal(String data, Long timestamp) throws EncryptionException
- 2.6.5 String sign(String data) throws EncryptionException
- 2.6.6 String unseal(String sealedData) throws EncryptionException
- 2.6.7 void verifySeal(String sealedData) throws DataIntegrityException
- 2.6.8 void verifySignature(String signature, String data) throws InvalidSignatureException
- 2.7 Executor
- 2.8 ExecutorResult
- 2.9 ExecutorTarget
- 2.10 IntrusionDetector
- 2.11 LogFactory
- 2.12 Logger
- 2.13 Randomizer
- 2.13.1 Boolean getRandomBoolean()
- 2.13.2 Byte[] getRandomBytes(Integer len)
- 2.13.3 String getRandomFilename(String extension)
- 2.13.4 String getRandomUUID()
- 2.13.5 Integer getRandomInteger(Integer min, Integer max)
- 2.13.6 Long getRandomLong(Long min, Long max)
- 2.13.7 Float getRandomReal(Float min, Float max)
- 2.13.8 String getRandomString(Integer len, char[] charSet)
- 2.14 Resource
- 2.15 ServiceLocator
- 2.16 User
- 2.16.1 <Type> Type getAccountID()
- 2.16.2 String getAccountName()
- 2.16.3 Long getExpirationTime()
- 2.16.4 Integer getFailedLoginCount()
- 2.16.5 Long getLastFailedLoginTime()
- 2.16.6 String getLastHostAddress()
- 2.16.7 Long getLastLoginTime()
- 2.16.8 Long getLastPasswordChangeTime()
- 2.16.9 String getLocale()
- 2.16.10 Set<String> getRoles()
- 2.16.11 String getScreenName()
- 2.16.12 Boolean isAnonymous()
- 2.16.13 Boolean isEnabled()
- 2.16.14 Boolean isExpired()
- 2.16.15 Boolean isInRole(String role)
- 2.16.16 Boolean isLocked()
- 2.16.17 Boolean isLoggedIn()
- 2.17 Validator
- 2.18 Exceptions
- 2.18.1 AccessDeniedException
- 2.18.2 AccountDisabledException
- 2.18.3 AccountLockedException
- 2.18.4 AuthenticationException
- 2.18.5 EncodingException
- 2.18.6 EncryptionException
- 2.18.7 EnterpriseSecurityException
- 2.18.8 EnterpriseSecurityRuntimeException
- 2.18.9 ExecutionException
- 2.18.10 IncorrectCredentialsException
- 3 Web API Specification
- 3.1 ClientCookie
- 3.2 SecureHttpRequest
- 3.2.1 void assertSecureChannel()
- 3.2.2 void assertSecureRequest()
- 3.2.3 ClientCookie getCookie(String name)
- 3.2.4 List<FileHandle> getFileUploads()
- 3.2.5 <T> T getAttribute(String name)
- 3.2.6 String getHeader(String header)
- 3.2.7 String getParameter(String name)
- 3.2.8 void sendForward(String url)
- 3.2.9 void verifyCsrfToken() throws CsrfException
- 3.3 SecureHttpResponse
- 3.4 SecureHttpSession
- 3.5 WebUser
- 4 Mobile API Specification
- 5 Desktop API Specification
Proposed Migration Roadmap
- ESAPI 2.1
- Create new package org.owasp.esapi.core
- Create new set of Interfaces in new package with each extending it's org.owasp.esapi counterpart
- Deprecate methods in org.owasp.esapi Interfaces
- ESAPI 2.5
- Remove deprecated methods that were deprecated at or before ESAPI 2.0
- Introduce new ServiceLocator API
- ESAPI 3.0
- Seperate Core API into it's own artifact/project called ESAPI-Core
- Create new set of artifacts as outlined in ESAPI_Project_Structure
- Introduce Core API Testing Suite
Core API Specification
AccessController
The AccessController is responsible for determining if the currently logged in user has access to a given resource. The resource can be anything that implements the Resource Interface.
Changes from ESAPI 2.0
- Removed deprecated methods
- Added Generic Stereotypes to the Key and Context parameters)
StereoTypes
| Parameter | Description |
|---|---|
| R | A class that implements the Resource Interface and represents the Resource the user is requesting access to |
| Context | Any object that represents the current context of the Authorization request - this is generally a Key-Value map |
Methods
<R extends Resource,Context> void assertAuthorized(Resource resource, Context context) throws AccessDeniedException
Assert that the currently logged in user can access the given Resource with the given Context parameters
Parameters
| Parameter | Default Value | Description |
|---|---|---|
| resource | The resource that the user is attempting to access | |
| context | The context of the request. This could be any type of object - for instance if requesting access to data, the context may be the resource identifier for the identified resource. |
Exceptions
| Exception | Description |
|---|---|
| AccessDeniedException | If the assertion evaluates to false, an AccessControlException will be thrown with contextual information as to the reason for the failure |
<R extends Resource,Context> boolean isAuthorized(Resource resource, Context context)
Determine if the given resource is accessible by the currently logged in User
Parameters
| Parameter | Default Value | Description |
|---|---|---|
| resource | The resource that the user is attempting to access | |
| context | The context of the request. This could be any type of object - for instance if requesting access to data, the context may be the resource identifier for the identified resource. |
Return
Returns true if the resource is accessible to the currently logged in user and false if it is not.
AccessReferenceMap<Key>
<Type> Key addDirectReference(Type direct)
<Type> Type getDirectReference(Key key)
<Type> Key getIndirectReference(Type directReference)
<Type> Key removeDirectReference(Type directReference)
<Type> void update(Set<Type> directReferences)
Authenticator
User login() throws AuthenticationException
void logout() throws AuthenticationException
Codec
String encode(char c)
String decode(String s)
Encoder
String encode(String s)
String decode(String s)
void addCodec(Codec c)
Set<Codec> getCodecs()
void setCodecs(Set<Codec> codecs)
Encryptor
PlainText decrypt(CipherText cipherText, SecretKey secretKey) throws EncryptionException
CipherText encrypt(PlainText plainText, SecretKey secretKey) throws EncryptionException
MessageDigest hash(PlainText plainText, Salt salt, Integer iterations) throws EncryptionException
String seal(String data, Long timestamp) throws EncryptionException
String sign(String data) throws EncryptionException
String unseal(String sealedData) throws EncryptionException
void verifySeal(String sealedData) throws DataIntegrityException
void verifySignature(String signature, String data) throws InvalidSignatureException
Executor
ExecutorResult executeSystemCommand(ExecutorTarget target, Encoder encoder) throws ExecutionException
ExecutorResult
String getErrorOutput()
String getStandardOutput()
Integer getExitValue()
ExecutorTarget
native FileHandle getExecutable()
native Handle getWorkingDirectory()
OrderedMap<String,String> getParameters()
IntrusionDetector
void addEvent(String eventName, String message)
void addException(Throwable exception)
LogFactory
Still thinking this one through
Logger
Still thinking this one through
Randomizer
Boolean getRandomBoolean()
Byte[] getRandomBytes(Integer len)
String getRandomFilename(String extension)
String getRandomUUID()
Integer getRandomInteger(Integer min, Integer max)
Long getRandomLong(Long min, Long max)
Float getRandomReal(Float min, Float max)
String getRandomString(Integer len, char[] charSet)
Resource
Marker Interface for Resources that a user can request access to.
