ESAPI Pictures For Javadoc

Architecture Overview Custom Enterprise Web Application Enterprise Security API Authenticator User AccessController AccessReferenceMap Validator Encoder HTTPUtilities Encryptor EncryptedProperties Randomizer Exception Handling Logger IntrusionDetector SecurityConfiguration Existing Enterprise Security Services/Libraries

OWASP Top Ten Coverage OWASP Top Ten OWASP ESAPI A1. Cross Site Scripting (XSS) A2. Injection Flaws A3. Malicious File Execution A4. Insecure Direct Object Reference A5. Cross Site Request Forgery (CSRF) A6. Leakage and Improper Error Handling A7. Broken Authentication and Sessions A8. Insecure Cryptographic Storage A9. Insecure Communications A10. Failure to Restrict URL Access OWASP ESAPI Validator, Encoder Encoder HTTPUtilities (upload) AccessReferenceMap User (csrftoken) EnterpriseSecurityException, HTTPUtils Authenticator, User, HTTPUtils Encryptor HTTPUtilities (secure cookie, channel) AccessController

Enforcing Access Control isAuthorizedForFunction() isAuthorizedForData() isAuthorizedForURL() isAuthorizedForService() User Controller Business Functions Data Layer Backend Presentation Layer isAuthorizedForFunction() isAuthorizedForFile() Roles

Handling Authentication and Identity User Controller Business Functions Data Layer Backend Presentation Layer ESAPI Authentication Access Control Logging Intrusion Detection Users

Handling Direct Object References getDirectReference() User Controller Business Functions Data Layer Backend Presentation Layer getIndirectReference() http://app?file=Report123.xls Access Reference Map Report123.xls http://app?file=1 http://app?id=9182374 Acct:9182374 http://app?id=7d3J93

Decoding/Encoding Untrusted Data Codecs: HTML Entity Codec Percent Codec JavaScript Codec VBScript Codec CSS Codec … Decoding Engine Validation Engine User Controller Business Functions Data Layer Backend PresentationLayer Encode: encodeForHTML() encodeForHTMLAttribute() encodeForJavaScript() encodeForCSS() encodeForURL() Encode: encodeForSQL() encodeForLDAP() encodeForXML() encodeForXPath() encodeForOS() Encoding Engine Encoding Engine

Validating Untrusted Input/Output Validate: getValidDate() getValidCreditCard() getValidSafeHTML() getValidInput() getValidNumber() getValidFileName() getValidRedirect() safeReadLine() … Validation Engine User Controller Business Functions Data Layer Backend PresentationLayer Validate: getValidDate() getValidCreditCard() getValidInput() getValidNumber() … Validation Engine

Enhancing HTTP HTTP Utilities User Controller Business Functions Input Utilities: assertSecureRequest() getCSRFToken getSafeFileUploads() safeSendForward() verifyCSRFToken() … HTTP Utilities User Controller Business Functions Data Layer Backend Presentation Layer Output Utilities: addCSRFToken() changeSessionIdentifier() safeSetContentType() setNoCacheHeaders() setRememberToken() verifyCSRFToken() … HTTP Utilities

Security Logging User Controller Business Functions Data Layer Backend Presentation Layer ESAPI Logging: fatal() error() warning() info() debug() trace() … Logger

Logout User, Lock Account Detecting Intrusions User Controller Business Functions Data Layer Backend Presentation Layer ESAPI Authentication Logging Quota Exceeded Intrusion Detection Tailorable Quotas Users Log Intrusion Event Logout User, Lock Account

Basic Cryptography User Controller Business Functions Data Layer Backend PresentationLayer Crypto: encrypt() / decrypt() hash() seal() / unseal() sign() verifySeal() verifySignature() Encryptor

new EncryptedProperties() Encrypted Properties File set() / get() User Controller Business Functions Data Layer Backend PresentationLayer Encryptor Encrypted Properties Encrypted Properties File

Safe OS Command Execution executeSystemCommand() User Controller Business Functions Data Layer Backend PresentationLayer