Stack Overflow
Stack Overflow

Questions tagged [esapi]

The Enterprise Security API (ESAPI) is a library developed by the Open Web Application Security Project (OWASP). It is available for numerous languages with the aim of providing web security related features missing in those languages (and its internal APIs) itself.

Part of the Open Web Application Security Project. Details are available on the ESAPI homepage. Currently the API is available for:

  • Java
  • .Net
  • Classic ASP
  • PHP
  • ColdFusion and CFML
  • Python
  • JavaScript
257 questions
20
votes
10 answers

Trying to Use ESAPI But getting Error

I am trying to use ESAPI.jar for providing security to my web application.Basically I have just started using ESAPI.jar. But problem is I am not able to run even a simple program using ESAPI. The small code snippet is: String clean =…
AngelsandDemons
  • 2,693
  • 12
  • 42
  • 70
14
votes
3 answers

OWASP ESAPI simpleTest in a Maven Java EE project

i have a litte JavaEE project, and i have to secure it with the OWASP ESAPI i integrated the ESAPI like this in Maven: org.owasp.esapi esapi …
Joergi
  • 1,593
  • 2
  • 36
  • 74
13
votes
5 answers

How to fix Veracode CWE 117 (Improper Output Neutralization for Logs)

There is an Spring global @ExceptionHandler(Exception.class) method which logs exception like that: @ExceptionHandler(Exception.class) void handleException(Exception ex) { logger.error("Simple error message", ex); ... Veracode scan says that…
Vitaliy Borisok
  • 626
  • 2
  • 9
  • 20
13
votes
3 answers

Where can I find ESAPI.properties?

Am trying to use OWASP ESAPI library in my web app to escape request parameters in JSPs as below ESAPI.encoder().encodeForHTML(request.getParameter()). I have added esapi-2.1.0.jar under WEB-INF/lib but I get the below…
Pro
  • 492
  • 2
  • 7
  • 19
10
votes
1 answer

Howto sanitize inputs

I am willing to use "OWASP ESAPI for Java" to sanitize users inputs when they submits forms in a Tomcat Webapp. I used to use org.apache.commons.lang.StringEscapeUtils like this: public static String myEscapeHtml(String s) { String…
Léa Massiot
  • 1,694
  • 6
  • 21
  • 37
9
votes
3 answers

Java Security vs. ESAPI

I'm a Java developer heading down the road that leads to App Security, and I've stumbled across the OWASP organization and its companion Java API, ESAPI. In another question I asked on this site months ago, it was pointed out to me that ESAPI is a…
IAmYourFaja
  • 50,141
  • 159
  • 435
  • 728
9
votes
4 answers

ESAPI - Getting NoClassDefFoundError (LoggerFactory) with banned dependency

I am using espaiESAPI to encode string value to resolve cross site scripting issue as shown below (code snippet). String encodedString = ESAPI.encoder().encodeForHTML(value); Exception Trace org.owasp.esapi.errors.ConfigurationException:…
Dinesh M
  • 584
  • 2
  • 5
  • 17
9
votes
2 answers

encodeForHtml() vs htmlEditFormat()

encodeForHtml() (new in CF10) vs htmlEditFormat(), how are they different?
Henry
  • 31,972
  • 19
  • 112
  • 214
7
votes
3 answers

Correct location for ESAPI.properties under web project

I added a OWASP ESAPI library to my project. And currently I'm stuck with a problem where to locate ESAPI.properties file. This project later should be deployed on few servers to which I don't have an access. So in my opinion there is no way to…
Petr Shypila
  • 1,261
  • 9
  • 23
  • 43
6
votes
0 answers

Extra line feeds in textareas / issue with Microsoft Edge or encodeForHTML (ColdFusion)

This is a strange one that only started within the past few months I would say. Textareas in Microsoft Edge only are displaying extra line breaks when using ColdFusion's encodeForHTML(). How to reproduce...
gfrobenius
  • 3,689
  • 6
  • 29
  • 60
6
votes
4 answers

ClasscastException - org.apache.log4j.Logger cannot be cast to org.owasp.esapi.Logger - log4j to log4j2

I am working on upgrading log4j to log4j2. In that process I am getting a Logger Class cast exception. Below is the error. Caused by: java.lang.ClassCastException: org.apache.log4j.Logger cannot be cast to org.owasp.esapi.Logger at…
ATK
  • 95
  • 3
  • 12
6
votes
1 answer

"ESAPI.properties could not be loaded by any means. fail." causing "Could not initialize class coldfusion.security.ESAPIUtils"

I have two servers - one production and one development - running ColdFusion 9.0.1 on IIS 7.5 on Windows Server 2008 R2. The two are configured identically. We have a transient issue where, after weeks to months of uneventful uptime, some parts of…
Rob
  • 63
  • 6
6
votes
2 answers

OWASP-ESAPI logger help needed

In my current project I am using Maven and Spring. I am currently using SLF4J logger for logging services. In place of that I want to use OWASP-ESAPI logger. I don't want to use OWASP-ESAPI security, just the log services. Can anybody please guide…
Amit
  • 132
  • 1
  • 2
  • 12
5
votes
1 answer

Java bean validation alternatives to OWASP ESAPI

With OWASP demoting Java ESAPI from a flagship project and all of the discussion and uncertainty revolving around the library, I'd like to see what alternatives are available. I currently utilize ESAPI for input validation, HTML/JS/etc encoding and…
LetsBeFrank
  • 754
  • 9
  • 30
5
votes
2 answers

Difference between HDIV and ESAPI

I am planing to develop a web application using Spring MVC and trying to figure out which is the best library to use to over come Top 10 OWASP issue. I came to see two HDIV and ESAPI, can any one please help me to understand the difference between…
Kumar
  • 1,028
  • 3
  • 13
  • 29
1
2 3
…
17 18