OWASP EJSF Project

From OWASP
Revision as of 08:12, 14 October 2013 by Samuel Matthey Gil (Talk | contribs)

Jump to: navigation, search

Category:Vulnerability Category:Access Control

Contents

Introduction

Modern web application frameworks have made it easy to develop high quality web applications, but developing a secure application still requires programmers to possess a deep understanding of security vulnerabilities and attacks. Sometimes it is difficult for an experienced developer to find and eliminate all the vulnerabilities. This demo represents the JSF-ESAPI framework based on JSF2.0 and OWASP ESAPI. It helps developers write a secure and lower-risk JSF based on a web application with minimal configuration and without extensive prior knowledge of the web security. The figure below shows a complete integration of the JSF-ESAPI framework with JSF2.0 and ESAPI. It works as a middleware and consists of four important modules. ESAPI Validation is the first module which verifies the user input as given in the XSS prevention cheat sheet provided by OWASP. It consists of many user-defined validator tags and generates appropriate error messages if the user input is not valid. In this way it performs a strong validation. There are also some tags available in the correspondence validators in ESAPI, and they also filter the XSS relevant code from the input. The file-based authorization module simplifies the user’s role, such as admin, user, etc. and gives the permission to visualize certain components at the presentation layer based on assigned roles. ESAPI Filtering layer compares the valid form token with tokens stored in the session for that user. If the token is mitigated or changed by man in the middle during the process of a request-response exchange, it will give the appropriate exception. The last module is a render module, which renders the output after filtering the XSS content and encodes the vulnerable characters such as <,>,”,’ etc. as given in the XSS prevention cheat sheet provided by OWASP. This framework will help developers to prevent a myriad of security problems including cross-site scripting, CSRF (cross-site request forgery), automatic input validation, and automatic output validation with escaped “true” or without this parameter, authorization. All the features are included in one framework. Advantages:

  • It requires minimal configuration to use the framework.
  • It ensures retrofit security in the existing application.
  • It provides the same performance as JSF framework.
  • Automatic filtering of the XSS vulnerable code from output takes place when escape equals true” or “false”.
  • The input validation is easy and no additional coding is required.
  • It has a layered architecture. It uses what you need and leaves what you don’t need at the moment.
  • One framework includes the most secure features."

Objective

This project is a continuation of the Master thesis (Master Thesis - Applied Computer Science, Albert-Ludwigs-Universität Freiburg im Breisgau - "Development of the Security Framework based on OWASP ESAPI for JSF2.0" by Rakeshkumar Kachhadiya) created in May 2012.

The goal is to facilitate the work of computer scientists, when they will implement a new application, it will be automatically safe without them realizes. It is important to improve more security on the ‘File based authorization’ module.

The 'File based authorization' module gives permission to visualize some areas or pages at the presentation layer as per given user rights.

It’s responsible to maintain the user information in the file with their assigned roles but also setting the rendering components false if the accessible user tries to retrieve the page.

Installation

  • Download all external librairies in the 'Downloads' section. No all librairies are required! Check all librairies dependencies for this project in this page
  • Download the three files (taglib.xml, faces-config.xml, web.xml) available in this archive
  • Add all librairies to your JSF project buildpath
  • Make the same with the esapi.jar file, this jar archive contain all important classes
  • Copy the three files (taglib.xml, faces-config.xml, web.xml) to your web/WEB-INF directory of your JSF project

Downloads

Jar file

Jar file Rakeshkumar esapi project

Config files


Librairies

AntiSamy 1.2.jar

commons-digester3-3.1.jar

commons-fileupload-1.2.2.jar

esapi-2.0.1.jar

jdom-1.0.jar

jsf-impl.jar

jsp-2.1-6.1.9.jar

jsp-api-6.0.14.jar

jstl-1.2.jar

log4j-1.2.16.jar

servlet-2.3.jar

Sources files

Zip file containing the sources of the project and a build.xml file

zip

Examples

Zip Guess game example

Zip Auction site example

Documentation

PDF file containing a presentation and a demonstration of a 'file based authorization' attack and a solution to protect it.

Security_framework_OWASP_esapi_JSF_14.05.2013.pdf


Step by step installation guide for the two examples :

Guess example documentation

Auction example documentation


Project About

PROJECT INFO
What does this OWASP project offer you?
RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP EJSF Project (home page)
Purpose: Modern web application frameworks have made it easy to develop high quality web applications, but developing a secure application still requires programmers to possess a deep understanding of security vulnerabilities and attacks. Sometimes it is difficult for an experienced developer to find and eliminate all the vulnerabilities. This demo represents the JSF-ESAPI framework based on JSF2.0 and OWASP ESAPI. It helps developers write a secure and lower-risk JSF based on a web application with minimal configuration and without extensive prior knowledge of the web security. The figure below shows a complete integration of the JSF-ESAPI framework with JSF2.0 and ESAPI. It works as a middleware and consists of four important modules. ESAPI Validation is the first module which verifies the user input as given in the XSS prevention cheat sheet provided by OWASP. It consists of many user-defined validator tags and generates appropriate error messages if the user input is not valid. In this way it performs a strong validation.

There are also some tags available in the correspondence validators in ESAPI, and they also filter the XSS relevant code from the input. The file-based authorization module simplifies the user’s role, such as admin, user, etc. and gives the permission to visualize certain components at the presentation layer based on assigned roles. ESAPI Filtering layer compares the valid form token with tokens stored in the session for that user. If the token is mitigated or changed by man in the middle during the process of a request-response exchange, it will give the appropriate exception.

The last module is a render module, which renders the output after filtering the XSS content and encodes the vulnerable characters such as <,>,”,’ etc. as given in the XSS prevention cheat sheet provided by OWASP.

This framework will help developers to prevent a myriad of security problems including cross-site scripting, cross-site request forgery, automatic input validation, and automatic output validation with escaped “true” or without this parameter, authorization. All the features are included in one framework.

Advantages:- (1) It requires minimal configuration to use the framework. (2) It ensures retrofit security in the existing application. (3) It provides the same performance as JSF framework. (4) Automatic filtering of the XSS vulnerable code from output takes place when escape equals true” or “false”. (5) The input validation is easy and no additional coding is required. (6) It has a layered architecture. It uses what you need and leaves what you don’t need at the moment. (7) One framework includes the most secure features."

License: GNU GPL v3 License (allows commercial use, but requires that modifications to your code stay open source, thus prohibiting proprietary forks of your project)
who is working on this project?
Project Leader(s):
  • Prof.Dr. Emmanual Benoist @
  • Rakeshkumar Kachhadiya @
Project Contributor(s):
  • Matthey Samuel @
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation: View
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
  • Contact Prof.Dr. Emmanual Benoist @ to contribute to this project
  • Contact Prof.Dr. Emmanual Benoist @ to review or sponsor this project
  • Contact the GPC to report a problem or concern about this project or to update information.
current release
https://github.com/OWASP/EJSF
last reviewed release
https://github.com/OWASP/EJSF


other releases