Difference between revisions of "OWASP Embedded Application Security"

OWASP Embedded Application Security Project

Each year, the number of enterprise and consumer devices with embedded software are on the rise. Given the publicity with IoT and more devices becoming network connected, it is essential to create secure coding guidelines for embedded software. Embedded Application Security is not often a high priority for embedded devices such as Routers, Managed Switches, IoT devices, and even ATM Kiosks. There are many challenges in the embedded field including ODM supply chain, limited memory, a small stack, and the challenge of pushing firmware updates securely to an endpoint. The goal of this project is to identify the risks in embedded applications on a generalized list of devices, create a list of best practices, draw on the resources that OWASP already has, and bring OWASP expertise to the embedded world.

Introduction

Contextual Output Encoding is a computer programming technique necessary to stop Cross Site Scripting. This project is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. It provides numerous encoding functions to help defend against XSS in a variety of different HTML, JavaScript, XML and CSS contexts.

Quick Overview

The OWASP Java Encoder library is intended for quick contextual encoding with very little overhead, either in performance or usage. To get started, simply add the encoder-1.2.jar, import org.owasp.encoder.Encode and start encoding.

Please look at the javadoc for Encode to see the variety of contexts for which you can encode. Tag libraries and JSP EL functions can be found in the encoder-jsp-1.2.jar.

If you want to try it out or see it in action, head over to "Can You XSS This? (.com)" and hit it with your best XSS attack vectors!

Happy Encoding!

Licensing

The OWASP Java Encoder is free to use under the New BSD License.

What is this?

The OWASP Java Encoder provides:

• Output Encoding functions to help stop XSS
• Java 1.5+ standalone library

Important Links

Java Encoder at GitHub
Issue Tracker

Mailing List

Java Encoder Mailing List

Project Leaders

Author: Jeff Ichnowski @
Jim Manico @
Jeremy Long @

Related Projects

• https://owasp.org/index.php/OWASP_Internet_of_Things_Project
• https://owasp.org/index.php/C-Based_Toolchain_Hardening
• https://owasp.org/index.php/OWASP_Mobile_Security_Project

News and Events

• [18 July 2016] New Project Template

In Print

We will be releasing a user guide soon!

Classifications

New BSD License