org.owasp.esapi:esapi
Advanced tools
The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.
| OWASP® ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI for Java library is designed to make it easier for programmers to retrofit security into existing applications. ESAPI for Java also serves as a solid foundation for new development. |
IMPORTANT: ESAPI has supported the Jakarta Servlet API (i.e., jakarta.servlet.api) since release 2.5.3.0. (Unfortunately, this information was previously missing in this README file.)
Therefore, for release 2.5.3.0 and later versions of ESAPI, ESAPI ought to be able to support Spring Boot 3, Spring 6, Tomcat 10, and other applications or libraries requiring Jarkata EE. (If you find a case where it does not, please file a GitHub issue for it.)
The ESAPI jar file supporting Jakarta will be named esapi-version-jakarta.jar. To use that specific Jakarta version of ESAPI, in Maven, you would specify your ESAPI dependency in your pom.xml as:
<dependency>
<groupId>org.owasp.esapi</groupId>
<artifactId>esapi</artifactId>
<version>2.5.5.0</version> <!-- Preferably the latest version, but > 2.5.3.0 -->
<classifier>jakarta</classifier>
</dependency>
(or any other version later than 2.5.3.0). Thanks to Jonathon Putney for creating a PR to fix this. There is a long discussion in GitHub Discussion #768 where this was first announced, for those of you have insomnia or really long attention spans and are interested in the approaches that were tried.
Of course, ESAPI also still continues to support the older Java EE Servlet API (i.e., javax.servlet namespace) as well. In fact, without the
<classifier>jakarta</classifier>
that's the version that will be used by default.
A summary of all the vulnerabilities that we have written about in either the ESAPI Security Bulletins or in the GitHub Security Advisories may be found in this Vulnerability Summary. It is too lengthy, and if you are using the latest available ESAPI version--generally not relevant--to place in this README file.
You can find the official OWASP ESAPI Project wiki pages at https://owasp.org/www-project-enterprise-security-api/. The ESAPI legacy GitHub repo also has several useful wiki pages.
This is the legacy branch of ESAPI which means it is an actively maintained branch of the project, however significant new feature development for this branch will not be done. Features that have already been scheduled for the 2.x branch will move forward. Development for the "next generation" of ESAPI (starting with ESAPI 3.0), will be done at the GitHub repository at https://github.com/ESAPI/esapi-java.
IMPORTANT NOTES:
As mentioned above, you can find it at https://github.com/ESAPI/esapi-java.
Note however that work on ESAPI 3 has not yet begun in earnest and is only in its earliest planning stages. Even the code that is presently there will likely change.
The ESAPI release notes may be found in ESAPI's "documentation" directory. They are generally named "esapi4java-core-2.#.#.#-release-notes.txt", where "2.#.#.#" refers to the ESAPI release number (which uses semantic versioning).
See the GitHub Releases information for a list of releases which generally link to the specific release notes.
ConfigurationException, thereby
preventing your application from starting. For important additional details, please see
the ESAPI GitHub Discussion https://github.com/ESAPI/esapi-java-legacy/discussions/841.The latest ESAPI release is 2.5.4.0. All the regular ESAPI jars, with the exception of the ESAPI configuration jar (i.e., esapi-2.#.#.#-configuration.jar) and its associated detached GPG signature, are available from Maven Central. The ESAPI configuration jars are linked under the 'Assets' section to each of the specific ESAPI releases under the GitHub Releases page.
However, before you start a new project using ESAPI, but sure to read "Should I use ESAPI?".
Unless we unintentionally screw-up, our intent is to keep classes, methods, and/or fields which have been annotated as "@deprecated" for a minimum of two (2) years or until the next major release number (e.g., 3.x as of now), which ever comes first, before we remove them. Note that this policy does not apply to classes under the org.owasp.esapi.reference package. You generally are not expected to be using such classes directly in your code. At the ESAPI team's discretion, it will also not apply for any known exploitable vulnerabilities for which no available workaround exists.
We will make some exceptions to the normal 2 year period. In particular, in the cases were we believe that keeping a specific deprecated class or method around can introduce security issues (generally because many of you have a habit of completely ignoring deprecation warnings), we sometimes will shorten that 2 year period. When we decide to do that, we will announce that as part of the deprecation message.
IMPORTANT NOTES: As of ESAPI 2.5.0.0, all the Log4J 1.x related code has been removed from the ESAPI code base (with the exception of some references in documentation). If you must, you still should be able to use Log4J 1.x logging via ESAPI SLF4J support. See the ESAPI 2.5.0.0 release notes for further details.
See https://mvnrepository.com/artifact/org.owasp.esapi/esapi/latest, the tab for whatever build tool you are using. If you need the Jakarta version, make sure to add
<classifier>jakarta</classifier>
and include whatever jakara.servlet:jakarta.servlet-api version you are using with
<scope>provided</scope>
Fork and submit a pull request! Easy as pi! (How's that for an irrational statement, you math nerds? :) We generally only accept bug fixes, not new features because as a legacy project, we don't intend on adding new features that we will have to maintain long term (although we may make exceptions; see the 'New Features' section in this README). If you are interesting in doing bug fixes though, the best place to start is the CONTRIBUTING-TO-ESAPI.txt
If you are new to ESAPI, a good place to start is to look for GitHub issues labled as 'good first issue'. (E.g., to find all open issues with that label, use https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22.)
Again, please find additional important details in the file 'CONTRIBUTING-TO-ESAPI.txt', which will also describe the tool requirements.
If you have found a bug, then create an issue on the esapi-legacy-java repo at https://github.com/ESAPI/esapi-java-legacy/issues As of May 11, 2022, we switched back to using (GitHub) issue templates. (We previously used issue templates when our source code repository was still on Google Code.) You can read more about our issue templates in this brief announcement.
NOTE: Please do NOT use GitHub issues to ask questions about ESAPI. If you wish to ask questions, instead, post to either of the 2 mailing lists (now on Google Groups) found the References section at the bottom of this page. If we find questions posted as GitHub issues, we simply will close them and direct you to do this anyhow. Alternately you may use the new Q&A section of our GitHub Discussions page to ask questions.
When reporting an issue or just asking a question, please be clear and try to ensure that the ESAPI development team has sufficient information to be able to reproduce your results or to understand your question. If you have not already done so, this might be a good time to read Eric S. Raymond's classic "How to Ask Questions the Smart Way" before posting your issue.
If believe you have found a vulnerability in ESAPI legacy, for the sake of the ESAPI community, please practice Responsible Disclosure. (Note: We will be sure you get credit and will work with you to create a GitHub Security Advisory, and if you so choose, to pursue filing a CVE via the GitHub CNA.)
You are of course encouraged to first search our GitHub issues list (see above) to see if it has already been reported. If it has not, then please contact both Kevin W. Wall (kevin.w.wall at gmail.com) and Matt Seil (matt.seil at owasp.org) directly. Please do not report vulnerabilities via GitHub issues or via the ESAPI mailing lists as we wish to keep our users secure while a patch is implemented and deployed. If you wish to be acknowledged for finding the vulnerability, then please follow this process. Also, when you post the email describing the vulnerability, please do so from an email address that you usually monitor.
More detail is available in the file 'SECURITY.md'. https://raw.githubusercontent.com/ESAPI/esapi-java-legacy/blob/develop/SECURITY.md)'.
If you wish to propose a new feature, the best place to discuss it is via new 'Discussions' board, probably under 'Ideas', or on the ESAPI-DEV mailing list mentioned below under the References section. As mentioned previously, we generally are not considering new features for ESAPI 2.x. This is because:
That said, if you believe you have an idea for an additional simple feature that does not pull in any additional 3rd party libraries, toss it out there for discussion or even show us how it works with a PR. (Note that we vet all pull requests, including coding style of any contributions, so please use the same coding style found in the files you are already editing.)
OWASP Wiki: https://owasp.org/www-project-enterprise-security-api/
GitHub ESAPI Wiki: https://github.com/ESAPI/esapi-java-legacy/wiki
General Documentation: Under the 'documentation' folder.
OWASP Slack Channel: #owasp-esapi
GitHub Discussions: Discussions - Not a lot there yet, but we only started this on May 11, 2022.
Mailing lists:
OWASP is a registered trademark of the OWASP Foundation, Inc.
FAQs
The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.
We found that org.owasp.esapi:esapi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.