This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Category:Scala"

From OWASP
Jump to: navigation, search
(→‎Secure Coding Libraries)
 
(41 intermediate revisions by the same user not shown)
Line 31: Line 31:
 
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
  
−
[[File:OWASP_Java_Wiki_logo.png|frame]]
+
[[File:Scala logo.png|frame]]
−
 
 
−
<br/>
 
  
 
== Meta ==
 
== Meta ==
Line 74: Line 72:
 
|-
 
|-
 
| width="20" | &nbsp;
 
| width="20" | &nbsp;
−
| Dependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. Currently <b>Java</b>, .NET, Ruby, Node.js, and Python projects are supported.
+
| Dependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. Currently <b>Scala</b>, .NET, Java, Ruby, Node.js, and Python projects are supported.
 +
More info visit : https://github.com/albuch/sbt-dependency-check
 
|-
 
|-
 
| colspan="2" | [[OWASP_SonarQube_Project|OWASP SonarQube Project]]
 
| colspan="2" | [[OWASP_SonarQube_Project|OWASP SonarQube Project]]
Line 94: Line 93:
 
|}
 
|}
  
−
= Related 3rd Party Projects =
+
= Security Frameworks =
−
 
 
−
A list of third party (i.e. not part of Java SE or EE) security frameworks. This page contains a list of Java security libraries and frameworks and indicates which security features each library supports.
 
−
 
 
−
==Enterprise==
 
−
* [http://shiro.apache.org/ Apache Shiro] is a Java security framework that performs authentication, authorization, cryptography, and session management.
 
−
* [http://projects.spring.io/spring-security/ Spring Security] provides security services for Java EE-based enterprise software applications. Services include authentication, authorization and protection against attacks like session fixation, clickjacking and cross site request forgery.
 
−
* [http://www.hdiv.org/ HDIV] A web application security framework that provides a number of functions.
 
−
 
 
−
== Access Control (Authentication and Authorization) ==
 
−
* [http://oaccframework.org/ OACC] is an application security framework for Java designed for fine grained (object level) access control. OACC uses the abstraction of a ''resource'' for the application objects being secured. This key abstraction enables OACC to provide a rich API that includes grant, revoke and query capabilities for storing and managing the application's security relationships.
 
−
* [http://picketlink.org/appsecurity/ PicketLink]  provides authentication, single sign on, permission based access control and other security features.
 
−
 
 
−
== Encryption ==
 
−
* [https://github.com/google/keyczar Keyczar] is an open source cryptographic toolkit designed to make it easier and safer for developers to use cryptography in their applications. Keyczar supports authentication and encryption with both symmetric and asymmetric keys.
 
−
* [http://www.bouncycastle.org/ Bouncycastle] is a lightweight Java cryptography API <i>provider</i>.
 
−
* [http://www.jasypt.org/ Jasypt] is a Java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.
 
−
 
 
−
== XML Security ==
 
−
* The [http://santuario.apache.org/ Apache Santuario] project is aimed at providing implementation of the primary security standards for XML: XML-Signature Syntax and Processing and XML Encryption Syntax and Processing.
 
−
 
 
−
== Validation ==
 
−
* [http://www.sapia-oss.org/projects/vlad/home.html Vlad] stands for "validation". This projects indeed aims at offering a simple, high-level, extensible, generic validation framework that can easily be integrated into existing applications.
 
−
* [https://www.owasp.org/index.php/Protect_FileUpload_Against_Malicious_File This OWASP article] and [https://github.com/righettod/document-upload-protection code snippet] proposes a way to protect a file upload feature against submission of files that may contain malicious code.
 
−
* [http://commons.apache.org/proper/commons-validator/ The Apache Common's validator] can be used to perform validation.
 
  
 +
{| class="wikitable"
 +
|-
 +
! Framework !! Authentication !! Authorization !! CSRF !! XSS !! SQLInjection !! OWASP page !! Notes
 +
|-
 +
| [https://www.playframework.com/documentation/2.0.4/ScalaSecurity Play] || ✓ || ✓ || - || - || - ||[[Scala_Frameworks/Play|Play Security Guidelines]]||
 +
|-
 +
| [http://deadbolt.ws/#service Deadbolt 2] ||  || ✓ || -  || - || -|| - || Fine-grained authorization for controllers & templates
 +
|-
 +
| [https://github.com/pac4j/play-pac4j Play-pac4j] || ✓ ||  ✓ ||  ✓  || - || - || - || Security Library for Play framework , uses Deadbolt as dependency
 +
|-
 +
| [https://auth0.com/authenticate/scala/oauth2/ Scala-oauth2-provider] || ✓ || - || - || - || - || - || Authentication Play 2 Scala with Generic OAuth2 Provider
 +
|-
 +
| [http://www.securesocial.ws/ SecureSocial] || ✓ || - || - || - || - || - || Supports up to 2.5.12 Play versions (Actual one 2.6.x)
 +
|-
 +
| [https://www.silhouette.rocks/ Silhouette - Play Framework Library] || ✓ || - || - || - || - || - || For the Playframework
 +
|-
 +
| [https://liftweb.net/ Lift] || ✓ || ✓ || ✓ || ✓ || ✓ || - || Created for Web application security
 +
|-
 +
| [https://index.scala-lang.org/akka/akka-http/akka-http-core/10.0.10?target=_2.12 Akka (Akka-http)] || ✓ || ✓ || - || - || - || - || Primary focus is HTTP-based services
 +
|-
 +
| [http://spray.io/ Spray] || ✓ || ✓ || - || - || - || - || [http://spray.io spray library is not longer maintained, replaced by akka-http]
 +
|}
 +
 +
Reference
 +
https://www.47deg.com/blog/security-frameworks-for-scala/
 
= Resources =
 
= Resources =
  
Line 160: Line 160:
 
== Roadmap ==
 
== Roadmap ==
  
−
* [[OWASP Java Project WIPRO 1 2015|Wiki Pages Review Operation - 2016]] General review of all Java and JVM related pages in the wiki.
+
* General review of all Scala and JVM related pages in the wiki.
−
* Build Java and JVM security related net resources guide
+
* Build Scala and JVM security related resources guide
−
* The OWASP Java and JVM Technology Knowledge Base is principally about creating deep, rich guidance for Java and JVM developers using all kind of security resources. The idea is to have an effort of building a internet resource guide for everything around the JVM universe. Information, blogs, articles, tools, test servers and more. Important however is that this list is seriously curated.
+
* Concrete guideline for Scala and JVM developers
−
* Concrete guideline for Java and JVM developers
 
 
* Clear checklists, around various topics, language, servers and frameworks.
 
* Clear checklists, around various topics, language, servers and frameworks.
  
Line 204: Line 203:
  
 
<br/>
 
<br/>
−
 
−
 
−
'''IMPORTANT: all pages of these project are currently under review. A lot are outdated and are in the process of being removed or updated.''' The review effort is coordinated on this page: [[OWASP Java Project WIPRO 1 2015|Wiki Pages Review Operation - 2015/2016]].
 
  
  

Latest revision as of 10:53, 19 November 2017

About

The OWASP Scala and JVM Technology Knowledge Base is the clearing house for all information related to building secure web/distributed applications and services based on Java and JVM technologies. The focus of these pages is on guidance for developers and architects using Scala frameworks and JVM based technologies for Backend development

Purpose

  • Provide deep, rich guidance for Scala developers in using the security features of Scala frameworks.
  • Address security in relation to the Java Virtual Machine and derived technologies.
  • Guide system administrators in managing Scala and JVM related components and applications.
  • Create guidance for use of OWASP components that are designed for use with Scala or other JVM languages.
  • Focus on information about working with and on OWASP tools built using Scala or other JVM technologies.
  • Provide a stream of security related information, like vulnerabilities and security patches, related to the Scala and JVM universe.
  • Build an ecosystem allowing to all actors interested to discuss, share and learn.

Licensing

OWASP Java™ and JVM Technology Knowledge Base is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

Oracle® and Java™ are trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

What's Hot!

See the "Tasks and Roadmap" tab for more information.

Wiki Pages Review Operation - 2015/2016

Scala logo.png

Meta

Last Update: 11/19/2017


Other Resources

Mailing List

GitHub (OWASP)


Related Projects

Framework Authentication Authorization CSRF XSS SQLInjection OWASP page Notes
Play ✓ ✓ - - - Play Security Guidelines
Deadbolt 2 ✓ - - - - Fine-grained authorization for controllers & templates
Play-pac4j ✓ ✓ ✓ - - - Security Library for Play framework , uses Deadbolt as dependency
Scala-oauth2-provider ✓ - - - - - Authentication Play 2 Scala with Generic OAuth2 Provider
SecureSocial ✓ - - - - - Supports up to 2.5.12 Play versions (Actual one 2.6.x)
Silhouette - Play Framework Library ✓ - - - - - For the Playframework
Lift ✓ ✓ ✓ ✓ ✓ - Created for Web application security
Akka (Akka-http) ✓ ✓ - - - - Primary focus is HTTP-based services
Spray ✓ ✓ - - - - spray library is not longer maintained, replaced by akka-http

Reference https://www.47deg.com/blog/security-frameworks-for-scala/

Roadmap

  • General review of all Scala and JVM related pages in the wiki.
  • Build Scala and JVM security related resources guide
  • Concrete guideline for Scala and JVM developers
  • Clear checklists, around various topics, language, servers and frameworks.


The first step would be to establish contact with the project leaders and/or the entire team. This can be done using a direct and private message, or by joining the public mailing list to say hello.

When it comes to participating in project activities, everything depends on the time you are willing and able to invest. It is however very important to not jump into too many things at the beginning, later having to back out or to let unfinished things behind you. It is much better to start with small tasks, increasing intensity and investment over time.

Please also be patient with expecting the "merge" of your work into the existing project pages and code. As everywhere in live, trust has to be built-up.

The Java and JVM knowledge base has currently multiple tasks open, which can be found on the adequate section of this page. Not all tasks require a wiki account. Please take something you are interested in and start participating. Work load is not the only outcome when participating in open projects. You are getting a lot of things back: recognition, satisfaction, knowledge and contacts, sometime friends.

Sounds cool? Then jump in...

To get involved join the mailing list, follow this link: OWASP Java and JVM Mailing List



The previous version of this JAVA Project home page is archived here: OWASP Java Project Archive (8.2010)








(The pages in the "old" category "OWASP Java Project" have to be moved into the category "Java". Work is in progress).

► OWASP Java Project
no pages or subcategories

Pages in category "Scala"

This category contains only the following page.

S

Retrieved from "https://wiki.owasp.org/index.php?title=Category:Scala&oldid=235616"