This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Category:OWASP Java Project"
(→Joining the Project) |
(→Java Security Overview) |
||
| Line 14: | Line 14: | ||
The goals of this project are to provide information about building, configuring, deploying, operating, and maintaining secure Java applications. We cover the following topics | The goals of this project are to provide information about building, configuring, deploying, operating, and maintaining secure Java applications. We cover the following topics | ||
| − | ; | + | ; [[J2EE Security for Architects]] |
| − | : | + | : Provides information about the design and architectural considerations for a Java web application. Common architectures such as EJB, Web Services and Spring Middle tiers are discussed. |
| − | ; | + | ; [[J2EE Security for Developers]] |
| − | : This section covers dangerous Java calls and common vulnerabilities associated with them, such as Runtime.exec(), Statement.execute(), readline(), etc... The dangers of native code, dynamic code, and reflection will be discussed. We'll also talk about using tools like PMD, jlint, FindBugs, Eclipse, jad, and more. This section will also cover standard security mechanisms in the JDK, such as cryptography, logging, encryption, error handling. | + | : This section covers dangerous Java calls and common vulnerabilities associated with them, such as Runtime.exec(), Statement.execute(), readline(), etc... The dangers of native code, dynamic code, and reflection will be discussed. We'll also talk about using tools like PMD, jlint, FindBugs, Eclipse, jad, and more. This section will also cover standard security mechanisms in the JDK, such as cryptography, logging, encryption, error handling. Securing elements of an application, such as servlets, JSPs, controllers, business logic, and persistence layers will be covered. We'll discuss handling request parameters, encoding, injection, and more. We'll also discuss the use of security mechanisms such as log4j, BouncyCastle, XML encryption, XML signature, and other technologies. |
| − | ; | + | ; [[J2EE Security for Deployers]] |
| − | : These articles cover topics specifically related to the J2EE environment. We discuss minimizing the attack surface in web.xml, configuring error handlers, | + | : These articles cover topics specifically related to the J2EE environment. We discuss minimizing the attack surface in web.xml, configuring error handlers, and performing hardening of popular J2EE application servers. |
| − | |||
| − | |||
| − | |||
[[Category:Platform]] | [[Category:Platform]] | ||
[[Category:OWASP Project]] | [[Category:OWASP Project]] | ||
Revision as of 09:44, 26 June 2006
About
The OWASP Java Project's goal is to enable Java and J2EE developers to build secure applications efficiently. See the OWASP Java Project Roadmap for more information on our plans.
Joining the Project
Stephen de Vries and Rohyt Belani lead the project. We're currently building out the OWASP Java Project Roadmap. Please submit your ideas for where we should spend our efforts there. If you'd like to contribute, visit the Tutorial, join the mailing list and pick a topic from the OWASP Java Project Roadmap
Java Security Overview
While Java and J2EE contain many security technologies, it is not easy to produce an application without security vulnerabilities. Most application security vulnerabilities apply to Java applications just like other environments. The notable exception is buffer overflow and related issues that do not apply to Java applications.
The goals of this project are to provide information about building, configuring, deploying, operating, and maintaining secure Java applications. We cover the following topics
- J2EE Security for Architects
- Provides information about the design and architectural considerations for a Java web application. Common architectures such as EJB, Web Services and Spring Middle tiers are discussed.
- J2EE Security for Developers
- This section covers dangerous Java calls and common vulnerabilities associated with them, such as Runtime.exec(), Statement.execute(), readline(), etc... The dangers of native code, dynamic code, and reflection will be discussed. We'll also talk about using tools like PMD, jlint, FindBugs, Eclipse, jad, and more. This section will also cover standard security mechanisms in the JDK, such as cryptography, logging, encryption, error handling. Securing elements of an application, such as servlets, JSPs, controllers, business logic, and persistence layers will be covered. We'll discuss handling request parameters, encoding, injection, and more. We'll also discuss the use of security mechanisms such as log4j, BouncyCastle, XML encryption, XML signature, and other technologies.
- J2EE Security for Deployers
- These articles cover topics specifically related to the J2EE environment. We discuss minimizing the attack surface in web.xml, configuring error handlers, and performing hardening of popular J2EE application servers.
Media in category "OWASP Java Project"
This category contains only the following file.
