This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Category:OWASP Orizon Project
Click here to return to OWASP Projects page.
Click here to see (& edit, if wanted) the template.
| PROJECT IDENTIFICATION | |||||||
|---|---|---|---|---|---|---|---|
| Project Name | OWASP Orizon Project | ||||||
| Short Project Description | This project born in 2006 in order to provide a framework to all Owasp projects developing code review services. The project is in a quite stable stage and it is usable for Java static code review and some dynamic tests against XSS. Owasp Orizon includes also APIs for code crawling, usable for code crawling tools. | ||||||
| Key Project Information | Project Leader Paolo Perego |
Project Contributors See here |
Mailing list Subscribe here Use here |
Project Type |
Sponsor OWASP SoC 08 | ||
| Release Status | Main Links | Related Projects |
|---|---|---|
|
The Owasp OrizonProject in Power Point |
Overview
The quest for secure code is what all developers want (I hope so) to achieve. Software must be reliable. Software must be strong. Software must be secure.
How much my software has to be secure? The correct answer is hard to find. But security is a problem that even a development team must take care for. Must be a skilled developer also a security guru? Don't know, not necessarly. But it's important that someone give him the tools to merge security know how to his development skills, and so our quest for secure code starts...
Orizon borns with the aim to provide a common ground to safe coding and code review methodologies applied to software. By now Orizon is still a bunch of ideas and few lines of code. In a year I hope Orizon will be the common engine in which security code review related tools are built upon
Orizon must give thanks di LAPSE Project (that you may find between OWASP Projects) RATS, Flawfinder for ideas and inspiration.
Orizon page at sourceforge is this.
Goals
Owasp Orizon goal is to provide a set of APIs to:
- manage a safe coding rules library
- apply these rules to a generic source file
- support the widespread used programming language (Java, C#, ASP.NET, C, C++, ...)
- create report to show source code assessment results
- let developers build code review tools
- help people understand how much important is applying safe coding rules while making software
Owasp Orizon will implement all security checks described in the Code review Guide.
Documentation
Available online it is the slideshow used during Owasp AppSec EU 2008 in Ghent, May 2008.
Download
By now all the code is in subversion repository hosted at sourceforge.net.
Last release is: 0.90
Dawn
In September 2007, while hacking around release 0.50, I decided to introduce dynamic code review facilities, just for Java language by now. Looking for a name of this Orizon's piece of code, I choosed dawn.
I think this will be the most cutting edge technology inside Orizon. It will help developers to raise from a buggy and unsafe code into an hardened one... so that's because of the name dawn for all related to dynamic code review.
Dawn is contained in Orizon since release 0.45pre1.
Bastion
Sometimes around March 2007, looking to the results in tell people how good would be reviewing their code for security issues, I realized that a quick workaround has to be provided for whom scared about a full code review activity or simply for whom who want to have a quick fix meanwhile the security review has been completed.
For such a reason I realized a parallel project, called Bastion, in order to provide to Java developers, classes that embed security checks in their core in order to have a quick fix without changing so much in the code.
Please, let me explain, that this won't substitute a security code review at all. Bastion would give a primer help meanwhile effort has been spent over source code to leverage security branches.
Starting from Orizon v0.25, Bastion is a separated JAR file. Latest Bastion version is: 0.42 Build 193
I realized also a very simple web application that shows how to use bastion in order to fix a very dummy Cross Site Scripting attack with a single line of code changed. The WAR file containing the aforementioned web application could be found here
The base url is setted up to bastion_test, so after starting up your preferred application server, run your browser to http://url/bastion_test and follow the instructions.
The application is built against a very old orizon version, indeed bastion was still contained inside orizon. Since my latest work is related to Orizon APIs, Bastion code is the same from April to nowadays.
A few words need to be spent here. I'm not reinventing the wheel. The Web is full of library sanitizing source code trying to mitigate an attack over a web application. Bastion is just my small contribute to the community, I really hope you'll appreciate this.
The library
For a code review tool the most important thing is the knowledge, the security checks being applied to the source code. No matter how good is your tool or fancy is your UI, a poor security check library means your tool is useless.
Orizon organizes safe coding best practices in XML rules contained in files called recipes. The mantra I choose is that "coding is like cooking", the goal is to choose the right recipe.
Recipes are gathered togheter in a zip file called Library.
This is the layout of the knowledge inside orizon.
The XML schema
Orizon XML schema used to describe secure coding checks can be hard to read. In this page you can find more details about how an XML rule is built.
Blog
Owasp blog is now proudly hosted by sourceforge here.
Future Development
This is the updated project RoadMap. I was too optimistic in my first roadmap draft. This is a more realistic timeline...
For an up to date roadmap you have to refer to official Orizon Roadmap page
Speeches
Owasp Orizon Internals @ Owasp AppSec NY 2008, New York 22-25th September 2008
Owasp Orizon Internals @ Owasp AppSec EU 2008, Ghent 21-22nd May 2008
Owasp Orizon Internals @ Owasp Day Italy 2008, Rome 31st March 2008
OWASP Orizon Project @ SMAU eAcademy, Milan 4-7th October 2006
I will talk to SMAU eAcademy2006 next saturday 7th October 2006 about code review and safe coding. Here you can find more informations in italian only by now. Last part of the speech will be about introducing Orizon project, giving development roadmap
2.10.2006
OWASP Orizon Project Created! - 09:24, 2 October 2006 (EDT)
The Open Web Application Security Project is proud to announce the OWASP Orizon Project!
Feedback and Participation:
Orizon wants you Of course, as opensource project, anyone is welcome tho join Orizon, and please do it. If you are a C#, Java or ASP skilled developer and you want to share your experience with such languages feel free to use mailing list to contribute in Orizon supported languages.
If you are a Java skilled developer why don't you think about writing some bunch of codes for Orizon?
If you write quite well or, it's not so difficult, better than me, please think about joining the project for documentation, advertising, blog maintenance ...
We hope you find the OWASP Orizon Project useful. Please contribute to the Project by volunteering for one of the Tasks, sending your comments, questions, and suggestions to [email protected]. To join the OWASP Orizon Project mailing list or view the archives, please visit the subscription page.
Project Contributors
--thesp0nge 09:47, 2 October 2006 (EDT)
Project Sponsor
Pages in category "OWASP Orizon Project"
This category contains only the following page.
