You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Clarify instructions how to checkout a specific new branch.
* Update info with respect to ESAPI mailing lists (move from Mailman to Google Groups).
* Minor updates to release notes (mostly about deprecated and/or removed methods).
* Changes in support of GitHub Issue # 483:
1. Change ESAPI version from 2.2.0.0-RC2-SNAPSHOT to 2.2.0.0-RC2.
2. Change references to ESAPI mailing lists from Mailman to Google Groups.
3. Update dependencies:
a) org.apache.commons:commons-collections4 -- from 4.2 to 4.3
b) org.apache.xmlgraphics:batik-css -- from 1.10 to 1.11
c) org.bouncycastle:bcprov-jdk15on -- from 1.60 to 1.61
4. Update org.sonatype.oss:oss-parent -- from version 5 to version 9
* Correctly marked several methods that were intended to be deprecated back in ESAPI 1.6, but were incorrectly so designated.
Decided to leave these around for a while since compiler would not issue proper warning the way they were.
* More clearly document via comments the intended fall-through in a switch statement.
* Remove unneeded cast to String that was giving compiler warning.
* Remove unneeded cast to String that was causing compiler warning.
* Mark method as @deprecated to get rid of compiler warning.
* Delete the previously deprecated method getSerialVersionUID().
Noted in 2.2.0.0 release notes.
* Mark previously deprecated method as @deprecated to suppress compiler warning.
* Changes to stop calling deprecated method SecurityConfiguration.getDisableIntrusionDetection().
Still needs a little work. (See comment in code regarding static import.)
* Mark previously deprecated method as @deprecated to suppress compiler warning.
* Remove some redundant casts to suppress compiler warnings.
* Remove redundant case to suppress compiler warnings.
* Delete previously deprecated protected field, MAX_REDIRECT_LOCATION.
No replacement; noted in 2.2.0.0 release notes.
* Remove unnecessary cast to suppress compiler warning.
* Mark previously deprecated method as @deprecated to suppress compiler warnings.
* Added serialVersionUID field to suppress compiler warning.
* Remove unnecessary cast to suppress compiler warnings.
* Delete unnecessary cast to suppress compiler warning.
* Add method testDeprecatedMethods() for simple sanity check.
* Upgrade AntiSamy dependency from 1.5.7 to 1.5.8.
* Updated with respect to moving to AntiSamy 1.5.8 were all the CVEs have been addressed.
* Fix failing tests that I accidentally broke. Thanks and a tip of the hat to @jeremiahjstacey for pointers of how to fix this.
Copy file name to clipboardExpand all lines: README.md
+10-3Lines changed: 10 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,7 +42,7 @@ When reporting an issue, please be clear and try to ensure that the ESAPI develo
42
42
### Find an Issue?
43
43
If you have found a bug, then create an issue on the esapi-legacy-java repo: https://github.com/ESAPI/esapi-java-legacy/issues
44
44
45
-
NOTE: Please do NOT use GitHub issues to ask questions about ESAPI. If you wish to do this, post to either of the 2 mailing lists found at the bottom of this page. If we find questions as GitHub issues, we simply will close them and direct you to do this anyhow.
45
+
NOTE: Please do NOT use GitHub issues to ask questions about ESAPI. If you wish to do this, post to either of the 2 mailing lists (now on Google Groups) found at the bottom of this page. If we find questions as GitHub issues, we simply will close them and direct you to do this anyhow.
46
46
47
47
### Find a Vulnerability?
48
48
If you have found a vulnerability in ESAPI legacy, first search the issues list (see above) to see if it has already been reported. If it has not, then please contact both Kevin W. Wall (kevin.w.wall at gmail.com) and Matt Seil (matt.seil at owasp.org) directly. Please do not report vulnerabilities via GitHub issues or via the ESAPI mailing lists as we wish to keep our users secure while a patch is implemented and deployed. If you wish to be acknowledged for finding the vulnerability, then please follow this process. (Eventually, we would like to have BugCrowd handle this, but that's still a ways off.) Also, when you post the email describing the vulnerability, please do so from an email address that you usually monitor.
@@ -64,5 +64,12 @@ Channel: #esapi<br/>
64
64
Webchat http://webchat.freenode.net/
65
65
66
66
*Mailing lists:*
67
-
[ESAPI-Users mailing list](https://lists.owasp.org/mailman/listinfo/esapi-user/) and
As of 2019-03-25, ESAPI's 2 mailing lists were officially moved OFF of their Mailman mailing lists to a new home on Google Groups.
68
+
69
+
The names of the 2 Google Groups are "[esapi-project-users](mailto:[email protected])" and "[esapi-project-dev](mailto:[email protected])", which you may POST to after you subscribe to them via "[Subscribe to ESAPI Users list](https://groups.google.com/forum/#!forum/esapi-project-users/join)" and "[Subscribe to ESAPI Developers list](https://groups.google.com/forum/#!forum/esapi-project-dev/join)" respectively.
70
+
71
+
Old archives for the old Mailman mailing lists for ESAPI-Users and ESAPI-Dev are still available at https://lists.owasp.org/pipermail/esapi-users/ and https://lists.owasp.org/pipermail/esapi-dev/ respectively.
72
+
73
+
For a general overview of Google Groups and its web interface, see https://groups.google.com/forum/#!overview
74
+
75
+
For assistance subscribing and unsubscribing to Google Groups, see https://webapps.stackexchange.com/questions/13508/how-can-i-subscribe-to-a-google-mailing-list-with-a-non-google-e-mail-address/15593#15593
* Upgrade to require JDK 7 or later. JDK 6 is no longer supported by ESAPI.
13
13
* Upgrade to require Java Servlet API 3.0.1 or later. See "Appendix: Dependency Updates (as reflected in pom.xml)" below for additional details.
14
-
* 106 GitHub issues closed. (Note: Includes previously incorrectly closed issues that were reopened, fixed, and then closed again.)
14
+
* 100+ GitHub issues closed. (Note: Includes previously incorrectly closed issues that were reopened, fixed, and then closed again.)
15
15
* Upgraded versions of several ESAPI dependencies (i.e., 3rd party jars), including several that had unpatched CVEs. See "Appendix: Dependency Updates (as reflected in pom.xml)" below for full details.
16
16
* Known vulnerabilities still not addressed:
17
-
- ESAPI uses "vulnerable" version of AntiSamy (1.5.7), which is supposedly vulnerable to CVE-2018-100643. I have confirmed that AntiSamy--as currently used by ESAPI--is NOT vulnerable to this CVE as it only uses AntiSamy's CleanResults.getCleanHTML(). Furthermore, I believe that this CVE is a false positive. See my comments on this AntiSamy issue at https://github.com/nahsra/antisamy/issues/32#issuecomment-449595373.
18
17
- There is this critical CVE in log4j 2.x before 2.8.2: CVE-2017-5645. It is a Java deserialization vulnerability that can lead to arbitrary remote code execution. Some private vulnerability databases claim that this same vulnerability is present in log4j 1.x even though the CVE itself does not claim that. However, examination of this CVE shows that the vulnerability is associated with implementations of TcpSocketServer and UdpSocketServer, which implement fully functional socket servers that can be used to listen on network connections and record log events sent to server from various client applications. For ESAPI to be vulnerable to that, first someone would have to have an implementation of wone of those servers running and secondly, they would have to change ESAPI's log4j.xml configuration file so that it uses log4j's SocketAppender rather than the default ConsoleAppender that ESAPI's default deployment uses. Thus even if this vulnerability were present in log4j 1.x, ESAPI's use of ConsoleAppender makes it a non-issue.
19
18
- There is a known and unpatched vulnerability in the SLF4J Extensions that some vulnerability scanners may pick up and associate with ESAPI's use of slf4j-api-1.7.25.jar. (Note that OWASP Dependency Check does NOT flag this vulnerability [CVE-2018-8088], but others may.) According to NVD, this vulnerability is associated with "org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2". Fortunately, I have confirmed that this Java deserialization does not impact ESAPI. First off, the default configuration of ESAPI.properties does not use SLF4J, but even if an application should choose to use it, ESAPI does not include the slf4j-ext jar and it has been confirmed that the vulnerable class (org.slf4j.ext.EventData) is not included in the slf4j-api jar that ESAPI does. Unfortunately, this CVE is not patched in the latest SLF4J packages, so even if we were to update it to latest version (currently 1.80-beta2, as of 12/31/2018), any scanners that associate ESAPI with CVE-2018-8088 would still have this false positive. But the important thing to ESAPI users is to know that if this CVE is identified for ESAPI, that it is a false positive.
20
19
- Otherwise, ESAPI 2.2.0.0 addresses all know CVEs except for CVE-2013-5960 (which I have fixed in a private BitBucket repo, but getting it to be backward compatible is proving to be more difficult than anticipated.) Besides, if you want to use encryption in Java, I'd highly recommend using Google Tink, which is much more fully featured than ESAPI. (Tink allows key rotation, storing keys in various cloud HSMs, etc.)
public static String encodeObject( java.io.Serializable serializableObject )
180
183
public static String encodeObject( java.io.Serializable serializableObject, int options )
181
184
public static Object decodeToObject( String encodedObject )
185
+
186
+
483 More miscellaneous prep work for ESAPI 2.2.0.0 release
187
+
Specifically, CipherText.getSerialVersionUID() and DefaultSecurityConfiguration.MAX_FILE_NAME_LENGTH have actually been deleted from the ESAPI code base. For the former, use CipherText.cipherTextVersion() instead. For the latter, there is no replacement. (This wasn't being used, but it was set to 1000 in case you're wondering.)
182
188
183
189
* Various properties in ESAPI.properties were changed in a way that might affect your application:
184
190
439 Tighten ESAPI defaults to disallow dubious file suffixes
@@ -235,12 +241,13 @@ Project co-leaders
235
241
Matt Seil (xeno6696)
236
242
237
243
Special shout-outs to:
238
-
Jeremiah Stacey (jeremiahjstacey)
244
+
Jeremiah Stacey (jeremiahjstacey) -- All around ESAPI support and JUnit test case developer extraordinaire
245
+
Dave Wichers (davewichers) - for Maven Central / Sonatype help
239
246
240
247
List of all PRs closed since 2.1.0.1 (2016-Feb-05) -
241
248
List includes merged AND rejected PRs
242
249
243
-
52 Closed PRs since 2.1.0.1 release
250
+
53 Closed PRs since 2.1.0.1 release
244
251
===================================
245
252
#362 by artfullyContrived was merged on Feb 9, 2016 -- Update pom.xml to use latest Maven plugins
246
253
#367 by drm2 was merged on Apr 9, 2016 -- Adding IntelliJ Tests setup documentation
@@ -296,12 +303,13 @@ List of all PRs closed since 2.1.0.1 (2016-Feb-05) -
296
303
#470 by jeremiahjstacey was merged on Jan 15, 2019 -- JavaLogFactory Thread Safety #286
297
304
#472 by jeremiahjstacey was merged on Jan 21, 2019 -- Issue #31 MySQLCodec Updates
298
305
#475 by jeremiahjstacey was merged on Jan 27, 2019 -- Issue #188 resolution proof: Test updates
306
+
#477 by jeremiajjstacey was merged on Feb 02, 2019 -- $476 DefaultValidator.getValidInput uses canonicalize method argument
299
307
300
308
List of contributors of *merged* PRs, listed (rather naively) by # or merged PRs:
301
309
# merged PRs GitHub ID
302
310
-------------------------
303
311
19 xeno6696
304
-
8 jeremiahjstacey
312
+
10 jeremiahjstacey
305
313
8 kwwall
306
314
2 artfullyContrived
307
315
2 augustd
@@ -312,8 +320,6 @@ List of contributors of *merged* PRs, listed (rather naively) by # or merged PRs
Thanks you all for your time and effort to ESAPI and making it a better project.
@@ -326,15 +332,15 @@ Many 3rd party dependencies had known vulnerabilities (e.g., CVEs reported to NI
326
332
327
333
Note that in many places, these 3rd party dependencies were not *direct* dependencies, but rather *transitive* and since we are not able to force a direct 3rd party dependency to update their dependencies, in several cases, we have used Maven's <exclusions> tag to exclude specific transitive dependencies andthen explictly included their latest patched versions that did not cause JUnit test failures.
328
334
329
-
Because the landscape of known vulnerabilities in 3rd party components is constantly changing and the OWASP ESAPI contributors do not have access to all private vulnerability databases, we may have inevitably missed some. In other cases, we have examined reported vulnerabilities and confirmed that as ESAPI uses and deploys the code in its default configuration, the claimed vulnerabilities are not exploitable. (Such is the case for CVE-2018-100643 as it related to AntiSamy 1.5.7 and earlier.)
335
+
Because the landscape of known vulnerabilities in 3rd party components is constantly changing and the OWASP ESAPI contributors do not have access to all private vulnerability databases, we may have inevitably missed some. In other cases, we have examined reported vulnerabilities and confirmed that as ESAPI uses and deploys the code in its default configuration, the claimed vulnerabilities are not exploitable.
330
336
331
337
The following lists all new and updated dependencies. If a dependency is not listed below, the version used since ESAPI release 2.1.0.1 has not changed.
332
338
333
339
New compile-time / runtime direct dependencies:
334
340
org.slf4j:slf4j-api:1.7.25 - Not actually needed in your application's classpath unless ESAPI.Logger is configured to use org.owasp.esapi.logging.slf4j.Slf4JLogFactory.
<!--This is the OWASP ESAPI mailing list for ESAPI users, regardless of programming language. For example, ESAPI users with questions about ESAPI for Java or ESAPI for PHP would both post here.-->
<!--This is the OWASP ESAPI mailing list for ESAPI for Java developers. While the list is not closed, the topics of discussion are likely to be less relevant to those only using ESAPI. Note that this is the list for ESAPI for Java. Most other language implementations, such ESAPI for PHP, have their own mailing lists.-->
0 commit comments