Difference between revisions of "Talk:OWASP Java Project Roadmap"

From OWASP
Jump to: navigation, search
(Authorization)
(Cross Site Scripting (XSS))
 
(47 intermediate revisions by 5 users not shown)
Line 1: Line 1:
==J2EE Security for Architects==
+
This is the discussion page for the Java Project Roadmap.  You can add your thoughts and comments below.  Please make them easy to read and end your entries with <nowiki>~~~~</nowiki> to sign your entries.
  
=== Risk Analysis===
+
==Ideas==
To my mind, Risk Analysis is a general exercise that will apply equaly to all apps irrespective of the language used to implement the app.  So would say that this belongs in the Guide rather than the Java project, unless you have some ideas on how to make this Java specific?  --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT)
+
I agree -- suggest deleting this section [[User:Jeff Williams|Jeff Williams]] 09:04, 12 June 2006 (EDT)
+
  
===Mapping Regulatory requirements to technical requirements===
+
* I think we should consider revamping the roadmap with specific article titles and content that we'd like to get written. For example, I'm considering writing an article on how to set up Eclipse to do a code review. It would be nice to link that in here, but I'm not sure just where. I was thinking something like this....
Same as above. --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT)
+
  I agree -- suggest deleting this section [[User:Jeff Williams|Jeff Williams]] 09:04, 12 June 2006 (EDT)
+
  
 +
; [[Using Eclipse for security code review]]
 +
: This article will cover setting up Eclipse with plugins like FindBugs, jlint, PMD, and Metrics. Then it will explore how you can use the various search and code browsing functions to find and diagnose potential vulnerabilities. [[User:Jeff Williams|Jeff Williams]] 15:01, 22 June 2006 (EDT)
 +
 +
Sounds like some excellent content!  Couldn't this fit in to the [http://www.owasp.org/index.php?title=Talk:OWASP_Java_Project_Roadmap#Code_Analysis_Tools Code Analysis Tools]  section (even if we have to rename the section to something like "Code Analysis Techniques")?  Since the Eclipse example is something core to the Java project, I think it should be placed under a real heading, but for other miscellaneous content, I've created a Resources section which could include external articles, books and other resources. [[User:Stephendv|Stephendv]] 04:18, 26 June 2006 (EDT)
 +
 +
==J2EE Security for Architects==
 +
<table border=1 cellpadding=5>
 +
  <tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
 +
  <tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
 +
  <tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
 +
  <tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
 +
</table>
 
===Design considerations===
 
===Design considerations===
This is quite generalShall we narrow it down to the architectural issues that should be considered for each of the popular architectures such as:
+
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Discuss the security implications of common J2EE architectures.  This could be discussed in terms of: Authentication, Authorisation, Data Validation, Cross Site Scripting protectionOther architecture concerns such as scalability, performance and maintainability can also be mentioned, but the focus on security should not be lost.
 +
 
 +
  Any other security concerns that should be addressed during the design phase should also be mentioned here.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
  <tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Architectural considerations
 
* Architectural considerations
 
** EJB Middle tier
 
** EJB Middle tier
 
** Web Services Middle tier
 
** Web Services Middle tier
 
** Spring Middle tier
 
** Spring Middle tier
--[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT)
 
  
===Frameworks you should be aware of (e.g. struts, stinger, etc.)===
+
===Noteworthy Frameworks===
There are many frameworks out there, so I'd suggest we keep this down to frameworks that specifically offer security functionality such as:  
+
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Discuss important and relevant Java security frameworks that would be useful to architects. The information should be at a suitably high level, for example, by discussing the advantages and features as well as the associated costs (direct and indirect) of using the frameworks.</td></tr>
 +
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
  <tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Acegi
 
* Acegi
 
* Commons validator
 
* Commons validator
Line 24: Line 43:
 
* Stinger seems to be parked for a while now, is this correct Jeff?
 
* Stinger seems to be parked for a while now, is this correct Jeff?
 
** Stinger is  
 
** Stinger is  
** CVS HEAD is in a functional state; needs work on docs and new features - Roman
+
** CVS HEAD is in a functional state; needs work on docs and new features [[User:Roman|Roman]] 00:15, 13 June 2006 (EDT)
 
Most web tier frameworks will prevent XSS attacks, so listing them all in this section is a bit verbose, would prefer to see them listed in the XSS section.  --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT)
 
Most web tier frameworks will prevent XSS attacks, so listing them all in this section is a bit verbose, would prefer to see them listed in the XSS section.  --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT)
  
==J2EE Security for Developers==
 
  
===Java Security Basics===  
+
I think Struts should be covered too - Rohyt
 +
 
 +
Struts is important as a web framework, but there are many frameworks that provide the same functionality from a security point of view.  I think it makes sense to discuss struts as a web framework in section on XSS below with the other popular web frameworks rather than give it a special place in this section which only covers security specific frameworks.  --[[User:Stephendv|Stephendv]] 07:22, 18 June 2006 (EDT)
 +
 
 +
==J2EE Security for Developers==
 +
<table border=1 cellpadding=5>
 +
    <tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
 +
  <tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
 +
  <tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
 +
  <tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
 +
</table>
 +
===Java Security Basics===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Provide an introduction into the basic security services provided by the Java language and environment.  Remember to keep this relevant for web developers for the initial release - there may be a potential to expand this to thick clients in subsequent releases.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Class Loading
 
* Class Loading
 
* Bytecode verifier
 
* Bytecode verifier
 
* The Security Manager and security.policy file
 
* The Security Manager and security.policy file
I suggest we do something short here for web developers, and wait on client side apps for now [[User:Jeff Williams|Jeff Williams]] 09:04, 12 June 2006 (EDT)
 
 
I agree --[[User:Stephendv|Stephendv]] 09:48, 12 June 2006 (EDT)
 
  
 
===Input Validation===
 
===Input Validation===
Line 41: Line 73:
  
 
==== SQL Injection====
 
==== SQL Injection====
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Provide cursory background information on SQL injection and refer to the Guide for more indepth coverage (no need to duplicate info in the Guide).  This section should provide practical advise and real-world code examples for developers. If you feel that a popular persistence framework is not covered, please add it!</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
  <tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Overview
 
* Overview
 
* Prevention
 
* Prevention
Line 52: Line 90:
 
** JDO?  
 
** JDO?  
  
====XSS====
+
====Cross Site Scripting (XSS)====
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Provide cursory background information on XSS and refer to the Guide for more indepth coverage.  This section should provide practical advise and real-world code examples for developers.  If you would like to see coverage of a web framework that's not listed, please add it!</td></tr>
 +
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr> 
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Overview
 
* Overview
 
* Prevention
 
* Prevention
Line 58: Line 102:
 
** Manual HTML Encoding
 
** Manual HTML Encoding
 
** Preventing XSS in popular Web Frameworks
 
** Preventing XSS in popular Web Frameworks
*** JSP
+
*** [https://www.owasp.org/index.php/JSP_JSTL JSP/JSTL]
 
*** Struts
 
*** Struts
 
*** Spring MVC
 
*** Spring MVC
 
*** Java Server Faces
 
*** Java Server Faces
*** WebWork?
+
*** WebWork
*** Wicket?
+
*** Wicket
*** Tapestry?
+
*** Tapestry  
* <s>Misc I/P Validation Attacks (e.g. HTTP Response Splitting)</s> - Moved this out to a separate section below.  --[[User:Stephendv|Stephendv]] 08:41, 12 June 2006 (EDT)
+
* CSRF attack
* <s>Using struts</s> Would recommend we cover a number of frameworks as mentioned above. --[[User:Stephendv|Stephendv]] 08:04, 12 June 2006 (EDT)
+
  
 
==== LDAP Injection ====
 
==== LDAP Injection ====
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing LDAP injection.</td></tr>
 +
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr> 
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Overview
 
* Overview
 
* Prevention
 
* Prevention
  
 
==== XPATH Injection ====
 
==== XPATH Injection ====
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing XPATH injection.</td></tr>
 +
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
  <tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Overview
 
* Overview
 
* Prevention
 
* Prevention
  
 
==== Miscellaneous Injection Attacks ====
 
==== Miscellaneous Injection Attacks ====
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Should contain practical real-world advise and code examples.</td></tr>
 +
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
  <tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* HTTP Response splitting
 
* HTTP Response splitting
 +
* Command injection - Runtime.getRuntime().exec()
  
 
=== Authentication===
 
=== Authentication===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Discuss authentication for Java and J2EE apps under the suggested headings below.  Examples for container managed authentication of specific application servers are also welcome.</td></tr>
 +
<tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
  <tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Storing credentials
 
* Storing credentials
 
* Hashing
 
* Hashing
 
* SSL Best Practices
 
* SSL Best Practices
* CAPTCHA systems (jcaptcha?)
+
* CAPTCHA systems (such as jcaptcha)
 +
* Container-managed authentication with Realms
 +
* JAAS Authentication
 +
* Password length & complexity
  
 
===Session Management===
 
===Session Management===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>The generic problems and solutions for session management are covered in the Guide.  This section should focus on Java specific examples.  </td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Logout
 
* Logout
 
* Session Timeout
 
* Session Timeout
 
* Absolute Timeout
 
* Absolute Timeout
 
* Session Fixation
 
* Session Fixation
 +
* Terminating sessions
 +
** Terminating sessions when the browser window is closed
 
   
 
   
 
===Authorization===
 
===Authorization===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* In presentation layer
 
* In presentation layer
 
* In business logic
 
* In business logic
Line 100: Line 185:
 
* JAAS
 
* JAAS
 
* EJB Authorization
 
* EJB Authorization
* Acegi?
+
* Acegi
 
* JACC
 
* JACC
 +
* Check horizontal privilege
  
===Session Management===
 
* Session Fixation
 
* Terminating sessions
 
** Terminating sessions when the browser window is closed
 
* Implementing a session timeout
 
 
 
=== Encryption===
 
=== Encryption===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* JCE
 
* JCE
 
* Storing db secrets
 
* Storing db secrets
 
* Encrypting JDBC connections
 
* Encrypting JDBC connections
+
* JSSE
 +
* Random number generation
 +
 
 
=== Error Handling & Logging===
 
=== Error Handling & Logging===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Java and J2EE specific discussion and examples.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Output Validation
 
* Output Validation
 
* Custom Errors
 
* Custom Errors
 
* Logging - why log? what to log? log4j, etc.
 
* Logging - why log? what to log? log4j, etc.
+
* Exception handling techniques
 +
** fail-open/fail-closed
 +
** resource cleanup
 +
** finally block
 +
** swallowing exceptions
 +
* Exception handling frameworks
 +
** Servlet spec - web.xml
 +
** JSP errorPage
 +
* Web application forensics and how it differs from conventional forensics. This will emphasize the importance of appropriate exception handling and logging  - Rohyt
 +
 
 
=== Web Services Security ===
 
=== Web Services Security ===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Discuss securely implementing Web Services using Java technologies.  Examples using specific frameworks are welcome.  The topic list is a bit light at the moment, please add more topics if they're relevant.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* SAML
 
* SAML
* WS-Security
+
* (X)WS-Security
 +
* SunJWSDP
 +
* XML Signature (JSR 105)
 +
* XML Encryption (JSR 106)
 
* ...?
 
* ...?
 +
I think this section should also include WSS4J and a description of how XWS-Security and WSS4J can be integrated in the major Java Web Services Frameworks, such as Spring-WS, Axis, XFire, etc. (see also http://www.nljug.org/pages/events/content/jfall_2007/sessions/00028/) [[User:Eklaver|Eelco Klaver]] 08:59, 23 October 2007 (EDT)
  
 
=== Code Analysis Tools ===
 
=== Code Analysis Tools ===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>The introduction should cover the advantages and short comings of code analysis tools.  An overview of the current state of the art and the available tools would go well here.  As a start, only open source tools are listed, but if vendors of commercial tools adhere to the [[Tutorial]] guidelines, these submissions will be gladly received.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 +
* Introduction
 
* FindBugs
 
* FindBugs
 
** Creating custom rules
 
** Creating custom rules
Line 132: Line 252:
 
* Jmetrics
 
* Jmetrics
  
== J2EE Security For Deployers ==
+
    I proposed some guidelines for the entire OWASP site
 +
    in the [[Tutorial]] page. What do you think?? [[User:Jeff Williams|Jeff Williams]] 15:01, 22 June 2006 (EDT)
  
 +
    I didn't know this existed.  Replaced the above with a link to the [[Tutorial]] page.  --[[User:Stephendv|Stephendv]] 04:03, 26 June 2006 (EDT)
 +
 +
== J2EE Security For Deployers ==
 +
<table border=1 cellpadding=5>
 +
  <tr><td><b>Deadline for first draft:</b></td><td>19/08/2006</td></tr>
 +
  <tr><td><b>Deadline for first review:</b></td><td>26/08/2006</td></tr>
 +
  <tr><td><b>Deadline for final draft:</b></td><td>11/09/2006</td></tr>
 +
  <tr><td><b>Deadline for final review:</b></td><td>20/09/2006</td></tr>
 +
</table>
 
=== Securing Popular J2EE Servers ===
 
=== Securing Popular J2EE Servers ===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Practical step-by-step guides to securing various J2EE servers.  Examples of secure configurations can also be provided for download.  If configurations are provided, they should be properly commented so that the rationale for configuration settings is clearly explained.  Users of the configurations should be provided with enough information to make their own risk decisions.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Securing Tomcat
 
* Securing Tomcat
 
* Securing JBoss
 
* Securing JBoss
 
* Securing WebLogic
 
* Securing WebLogic
 
* Securing WebSphere
 
* Securing WebSphere
* Securing x...
+
* Others...
Would be nice to include an example secure by default configuration file for each server that has additional comments in it which expands on the security repurcussions of the various sections.
+
  
 
=== Defining a Java Security Policy ===
 
=== Defining a Java Security Policy ===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>Practical information on creating a Java security policies for J2EE servers.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 
* Jeff's tool? --[[User:Stephendv|Stephendv]] 08:37, 12 June 2006 (EDT)
 
* Jeff's tool? --[[User:Stephendv|Stephendv]] 08:37, 12 June 2006 (EDT)
 
* jChains (www.jchains.org)
 
* jChains (www.jchains.org)
 +
 +
=== Protecting Binaries ===
 +
<table border=1 cellpadding=5>
 +
  <tr><td valign="top"><b>Objective:</b></td><td>This should be focussed on web applications, so examples should include applets and web start apps.</td></tr>
 +
  <tr><td valign="top"><b>Status:</b></td><td>Call for volunteers</td></tr>
 +
<tr><td valign="top"><b>Contributors:</b></td><td></td></tr>
 +
  <tr><td><b>Reviewers:</b></td><td></td></tr>
 +
</table>
 +
- Discuss Bytecode Manipulation Tools and Techniques - Rohyt
 +
* Bytecode obfuscation
 +
* Convert bytecode to native machine code
 +
* jarsigner

Latest revision as of 16:27, 11 March 2008

This is the discussion page for the Java Project Roadmap. You can add your thoughts and comments below. Please make them easy to read and end your entries with ~~~~ to sign your entries.

Contents

Ideas

  • I think we should consider revamping the roadmap with specific article titles and content that we'd like to get written. For example, I'm considering writing an article on how to set up Eclipse to do a code review. It would be nice to link that in here, but I'm not sure just where. I was thinking something like this....
Using Eclipse for security code review
This article will cover setting up Eclipse with plugins like FindBugs, jlint, PMD, and Metrics. Then it will explore how you can use the various search and code browsing functions to find and diagnose potential vulnerabilities. Jeff Williams 15:01, 22 June 2006 (EDT)

Sounds like some excellent content! Couldn't this fit in to the Code Analysis Tools section (even if we have to rename the section to something like "Code Analysis Techniques")? Since the Eclipse example is something core to the Java project, I think it should be placed under a real heading, but for other miscellaneous content, I've created a Resources section which could include external articles, books and other resources. Stephendv 04:18, 26 June 2006 (EDT)

J2EE Security for Architects

Deadline for first draft:19/08/2006
Deadline for first review:26/08/2006
Deadline for final draft:11/09/2006
Deadline for final review:20/09/2006

Design considerations

Objective:Discuss the security implications of common J2EE architectures. This could be discussed in terms of: Authentication, Authorisation, Data Validation, Cross Site Scripting protection. Other architecture concerns such as scalability, performance and maintainability can also be mentioned, but the focus on security should not be lost. Any other security concerns that should be addressed during the design phase should also be mentioned here.
Status:Call for volunteers
Contributors:
Reviewers:
  • Architectural considerations
    • EJB Middle tier
    • Web Services Middle tier
    • Spring Middle tier

Noteworthy Frameworks

Objective:Discuss important and relevant Java security frameworks that would be useful to architects. The information should be at a suitably high level, for example, by discussing the advantages and features as well as the associated costs (direct and indirect) of using the frameworks.
Status:Call for volunteers
Contributors:
Reviewers:
  • Acegi
  • Commons validator
  • jGuard
  • Stinger seems to be parked for a while now, is this correct Jeff?
    • Stinger is
    • CVS HEAD is in a functional state; needs work on docs and new features Roman 00:15, 13 June 2006 (EDT)

Most web tier frameworks will prevent XSS attacks, so listing them all in this section is a bit verbose, would prefer to see them listed in the XSS section. --Stephendv 08:04, 12 June 2006 (EDT)


I think Struts should be covered too - Rohyt

Struts is important as a web framework, but there are many frameworks that provide the same functionality from a security point of view. I think it makes sense to discuss struts as a web framework in section on XSS below with the other popular web frameworks rather than give it a special place in this section which only covers security specific frameworks. --Stephendv 07:22, 18 June 2006 (EDT)

J2EE Security for Developers

Deadline for first draft:19/08/2006
Deadline for first review:26/08/2006
Deadline for final draft:11/09/2006
Deadline for final review:20/09/2006

Java Security Basics

Objective:Provide an introduction into the basic security services provided by the Java language and environment. Remember to keep this relevant for web developers for the initial release - there may be a potential to expand this to thick clients in subsequent releases.
Status:Call for volunteers
Contributors:
Reviewers:
  • Class Loading
  • Bytecode verifier
  • The Security Manager and security.policy file

Input Validation

  • Overview

SQL Injection

Objective:Provide cursory background information on SQL injection and refer to the Guide for more indepth coverage (no need to duplicate info in the Guide). This section should provide practical advise and real-world code examples for developers. If you feel that a popular persistence framework is not covered, please add it!
Status:Call for volunteers
Contributors:
Reviewers:
  • Overview
  • Prevention
    • White Listing
    • Prepared Statements
    • Stored Procedures
    • Hibernate
    • Ibatis
    • Spring JDBC
    • EJB 3.0?
    • JDO?

Cross Site Scripting (XSS)

Objective:Provide cursory background information on XSS and refer to the Guide for more indepth coverage. This section should provide practical advise and real-world code examples for developers. If you would like to see coverage of a web framework that's not listed, please add it!
Status:Call for volunteers
Contributors:
Reviewers:
  • Overview
  • Prevention
    • White Listing
    • Manual HTML Encoding
    • Preventing XSS in popular Web Frameworks
      • JSP/JSTL
      • Struts
      • Spring MVC
      • Java Server Faces
      • WebWork
      • Wicket
      • Tapestry
  • CSRF attack

LDAP Injection

Objective:As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing LDAP injection.
Status:Call for volunteers
Contributors:
Reviewers:
  • Overview
  • Prevention

XPATH Injection

Objective:As with the other Injection sections, only provide cursory information on the general case. Should contain practical real-world advise and code examples for preventing XPATH injection.
Status:Call for volunteers
Contributors:
Reviewers:
  • Overview
  • Prevention

Miscellaneous Injection Attacks

Objective:Should contain practical real-world advise and code examples.
Status:Call for volunteers
Contributors:
Reviewers:
  • HTTP Response splitting
  • Command injection - Runtime.getRuntime().exec()

Authentication

Objective:Discuss authentication for Java and J2EE apps under the suggested headings below. Examples for container managed authentication of specific application servers are also welcome.
Status:Call for volunteers
Contributors:
Reviewers:
  • Storing credentials
  • Hashing
  • SSL Best Practices
  • CAPTCHA systems (such as jcaptcha)
  • Container-managed authentication with Realms
  • JAAS Authentication
  • Password length & complexity

Session Management

Objective:The generic problems and solutions for session management are covered in the Guide. This section should focus on Java specific examples.
Status:Call for volunteers
Contributors:
Reviewers:
  • Logout
  • Session Timeout
  • Absolute Timeout
  • Session Fixation
  • Terminating sessions
    • Terminating sessions when the browser window is closed

Authorization

Objective:Java and J2EE specific discussion and examples.
Status:Call for volunteers
Contributors:
Reviewers:
  • In presentation layer
  • In business logic
  • In data layer
  • Declarative v/s Programmatic
  • web.xml configuration
  • Forced browsing
  • JAAS
  • EJB Authorization
  • Acegi
  • JACC
  • Check horizontal privilege

Encryption

Objective:Java and J2EE specific discussion and examples.
Status:Call for volunteers
Contributors:
Reviewers:
  • JCE
  • Storing db secrets
  • Encrypting JDBC connections
  • JSSE
  • Random number generation

Error Handling & Logging

Objective:Java and J2EE specific discussion and examples.
Status:Call for volunteers
Contributors:
Reviewers:
  • Output Validation
  • Custom Errors
  • Logging - why log? what to log? log4j, etc.
  • Exception handling techniques
    • fail-open/fail-closed
    • resource cleanup
    • finally block
    • swallowing exceptions
  • Exception handling frameworks
    • Servlet spec - web.xml
    • JSP errorPage
  • Web application forensics and how it differs from conventional forensics. This will emphasize the importance of appropriate exception handling and logging - Rohyt

Web Services Security

Objective:Discuss securely implementing Web Services using Java technologies. Examples using specific frameworks are welcome. The topic list is a bit light at the moment, please add more topics if they're relevant.
Status:Call for volunteers
Contributors:
Reviewers:
  • SAML
  • (X)WS-Security
  • SunJWSDP
  • XML Signature (JSR 105)
  • XML Encryption (JSR 106)
  • ...?

I think this section should also include WSS4J and a description of how XWS-Security and WSS4J can be integrated in the major Java Web Services Frameworks, such as Spring-WS, Axis, XFire, etc. (see also http://www.nljug.org/pages/events/content/jfall_2007/sessions/00028/) Eelco Klaver 08:59, 23 October 2007 (EDT)

Code Analysis Tools

Objective:The introduction should cover the advantages and short comings of code analysis tools. An overview of the current state of the art and the available tools would go well here. As a start, only open source tools are listed, but if vendors of commercial tools adhere to the Tutorial guidelines, these submissions will be gladly received.
Status:Call for volunteers
Contributors:
Reviewers:
  • Introduction
  • FindBugs
    • Creating custom rules
  • PMD
    • Creating custom rules
  • JLint
  • Jmetrics
   I proposed some guidelines for the entire OWASP site
   in the Tutorial page. What do you think?? Jeff Williams 15:01, 22 June 2006 (EDT)
   I didn't know this existed.  Replaced the above with a link to the Tutorial page.  --Stephendv 04:03, 26 June 2006 (EDT)

J2EE Security For Deployers

Deadline for first draft:19/08/2006
Deadline for first review:26/08/2006
Deadline for final draft:11/09/2006
Deadline for final review:20/09/2006

Securing Popular J2EE Servers

Objective:Practical step-by-step guides to securing various J2EE servers. Examples of secure configurations can also be provided for download. If configurations are provided, they should be properly commented so that the rationale for configuration settings is clearly explained. Users of the configurations should be provided with enough information to make their own risk decisions.
Status:Call for volunteers
Contributors:
Reviewers:
  • Securing Tomcat
  • Securing JBoss
  • Securing WebLogic
  • Securing WebSphere
  • Others...

Defining a Java Security Policy

Objective:Practical information on creating a Java security policies for J2EE servers.
Status:Call for volunteers
Contributors:
Reviewers:
  • Jeff's tool? --Stephendv 08:37, 12 June 2006 (EDT)
  • jChains (www.jchains.org)

Protecting Binaries

Objective:This should be focussed on web applications, so examples should include applets and web start apps.
Status:Call for volunteers
Contributors:
Reviewers:

- Discuss Bytecode Manipulation Tools and Techniques - Rohyt

  • Bytecode obfuscation
  • Convert bytecode to native machine code
  • jarsigner