This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Category:Java

From OWASP

Revision as of 10:49, 10 November 2017 by Imifos (talk | contribs) (Removed mention of an inactive effort.)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Jump to: navigation, search

About

The OWASP Java™ and JVM Technology Knowledge Base is the clearing house for all information related to building secure web/distributed applications and services based on Java and JVM technologies. The focus of these pages is on guidance for developers and architects using Java frameworks and JVM based technologies for web application development, on OWASP components that use Java and on participation in OWASP projects that use Java and JVM technologies. Moreover, we aim to provide security related guidance for system administrators managing Java and JVM based applications and tools.

The project is not limited to Java. It aims to also address topics around the JVM in general.

Community content is key to security information. The project depends on content from developers throughout the Java and JVM ecosystem.

Purpose

Provide deep, rich guidance for Java developers in using the security features of Java and of Java frameworks.
Address security in relation to the Java Virtual Machine and derived technologies.
Guide system administrators in managing Java and JVM related components and applications.
Create guidance for use of OWASP components that are designed for use with Java or other JVM languages.
Focus on information about working with and on OWASP tools built using Java or other JVM technologies.
Provide a stream of security related information, like vulnerabilities and security patches, related to the Java and JVM universe.
Build an ecosystem allowing to all actors interested to discuss, share and learn.

Licensing

OWASP Java™ and JVM Technology Knowledge Base is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

Oracle® and Java™ are trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

What's Hot!

See the "Tasks and Roadmap" tab for more information.

Other Resources

Mailing List

GitHub (OWASP)

Related Projects

Security Tools

OWASP Dependency Check
	Dependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. Currently Java, .NET, Ruby, Node.js, and Python projects are supported.
OWASP SonarQube Project
	The first goal of the OWASP SonarQube Project is to a create a referential of check specifications targeting OWASP vulnerabilities that can be detected by SAST tools (Static Application Security Testing). From there, the second goal is to provide a reference implementations of most of those checks in the Open Source SonarQube language analyzers (Java, JavaScript, PHP and C#). SonarQube is an Open Source platform for managing code quality.

Secure Coding Libraries

OWASP AppSensor
	The AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement intrusion detection and automated response into applications.
OWASP CSRFGuard
	CSRFGuard is a Java library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.
OWASP Java Encoder Project
	The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend against Cross Site Scripting.
OWASP Java HTML Sanitizer
	The OWASP HTML Sanitizer is a fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS.
OWASP Security Logging Project
	The OWASP Security Logging project provides developers and ops personnel with APIs for logging security-related events. The aim is to let developers use the same set of logging APIs they are already familiar with from over a decade of experience with Log4J and its successors, while also adding powerful security features.
OWASP Enterprise Security API (ESAPI)
	ESAPI (The OWASP Enterprise Security API) for Java is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. This project has seen major updates as recently as February 2016.

General Documents

OWASP Secure Coding Practices - Quick Reference Guide	OWASP Codes of Conduct	OWASP Cheat Sheets Series
OWASP Testing Project	OWASP Web Top 10	OWASP Vulnerable Web Applications Directory

A list of third party (i.e. not part of Java SE or EE) security frameworks. This page contains a list of Java security libraries and frameworks and indicates which security features each library supports.

Enterprise

Apache Shiro is a Java security framework that performs authentication, authorization, cryptography, and session management.
Spring Security provides security services for Java EE-based enterprise software applications. Services include authentication, authorization and protection against attacks like session fixation, clickjacking and cross site request forgery.
HDIV A web application security framework that provides a number of functions.

Access Control (Authentication and Authorization)

OACC is an application security framework for Java designed for fine grained (object level) access control. OACC uses the abstraction of a resource for the application objects being secured. This key abstraction enables OACC to provide a rich API that includes grant, revoke and query capabilities for storing and managing the application's security relationships.
PicketLink provides authentication, single sign on, permission based access control and other security features.

Encryption

Keyczar is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys.
Bouncycastle is a lightweight Java cryptography API provider.
Jasypt is a Java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.

XML Security

The Apache Santuario project is aimed at providing implementation of the primary security standards for XML: XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.

Validation

Vlad stands for "validation". This projects indeed aims at offering a simple, high-level, extensible, generic validation framework that can easily be integrated into existing applications.
This OWASP article and code snippet proposes a way to protect a file upload feature against submission of files that may contain malicious code.
The Apache Common's validator can be used to perform validation.

IMPORTANT: all pages of these project are currently under review. A lot are outdated and are in the process of being removed or updated.

(The pages in the "old" category "OWASP Java Project" have to be moved into the category "Java". Work is in progress).

► OWASP Java Project

no pages or subcategories

Pages in category "Java"

The following 52 pages are in this category, out of 52 total.

B

Bytecode obfuscation

C

D

E

Exception handling techniques

H

I

J

L

M

N

Null Dereference

O

OWASP CSRFGuard Project/es

P

R

Return Inside Finally Block

S

T

Traducción Español

U

X

XPATH Injection Java

Retrieved from "https://wiki.owasp.org/index.php?title=Category:Java&oldid=235239"

Categories: