You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|Use devonfw application template and guides to avoid
36
-
|https://github.com/devonfw/devon4j/blob/develop/documentation/tutorial-newapp.asciidoc[tutorial-newapp] and link:guide-configuration.asciidoc#security[sensitive configuration]
37
-
38
-
|https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure[A6 Sensitive Data Exposure]
26
+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A3-Sensitive_Data_Exposure.html[A3 Sensitive Data Exposure]
39
27
|Use secured exception facade, design your data model accordingly
|https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control[A7 Missing Function Level Access Control]
30
+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A4-XML_External_Entities_(XXE).html[A4 XML External Entities]
31
+
|Prefer JSON over XML, ensure https://docs.oracle.com/en/java/javase/11/security/java-api-xml-processing-jaxp-security-guide.html[FSP] when parsing (external) XML
|link:guide-access-control.asciidoc[Access-control guide] especially link:guide-access-control.asciidoc#configuration-on-java-method-level[method authorization]
|Use simple and established serialization formats such as JSON, prevent generic deserialization (for polymorphic types)
48
+
|link:guide-json.asciidoc[JSON guide] especially link:guide-json.asciidoc#json-and-inheritance[inheritence], link:guide-xml.asciidoc[XML guide]
49
+
50
+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities.html[A9 Using Components with Known Vulnerabilities]
51
51
|subscribe to security newsletters, recheck products and their versions continuously, use devonfw dependency management
52
52
|https://cve.mitre.org/news/newsletter.html[CVE newsletter] and xref:dependency-check[dependency check]
53
53
54
-
|https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards[A10 Unvalidated Redirects and Forwards]
55
-
|Avoid using redirects and forwards, in case you need them do a security audit on the solution.
56
-
|devonfw proposes to use rich-clients (SPA/RIA). We only use redirects for login in a safe way.
|https://owasp.org/www-pdf-archive//OWASP_LA_New_OWASP_Top_10_David_Caissy_2017_07.pdf[Unvalidated Redirects and Forwards]
71
+
|Avoid using redirects and forwards, in case you need them do a security audit on the solution.
72
+
|devonfw proposes to use rich-clients (SPA/RIA). We only use redirects for login in a safe way.
61
73
|=======================
62
74
63
75
== Tools
64
76
=== Dependency Check
65
-
To address https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities[A9 Using Components with Known Vulnerabilities] we integrated https://www.owasp.org/index.php/OWASP_Dependency_Check[OWASP dependency check] into the devonfw maven build. If you build an devonfw application (sample or any app created from our link:tutorial-newapp.asciidoc[app-template]) you can activate dependency check with the `security` profile:
77
+
To address the thread `Using Components with Known Vulnerabilities` we integrated https://www.owasp.org/index.php/OWASP_Dependency_Check[OWASP dependency check] into the devon4j maven build. If you build an devon4j application (sample or any app created from our link:tutorial-newapp.asciidoc[app-template]) you can activate dependency check with the `security` profile:
66
78
[source,bash]
67
79
----
68
80
mvn clean install -P security
69
81
----
70
-
This does not run by default as it causes a huge overhead for the build performance. However, consider to build this in your CI at least nightly.
71
-
After the dependency check is performed, you will find the results in `target/dependency-check-report.html` of each module. The report will also always be generated when the site is build (`mvn site`).
82
+
This does not run by default as it causes a huge overhead for the build performance. However, consider to build this in your CI at least nightly.
83
+
After the dependency check is performed, you will find the results in `target/dependency-check-report.html` of each module. The report will also be generated when the site is build (`mvn site`) even without the profile.
72
84
73
85
=== Penetration Testing
74
86
For penetration testing (testing for vulnerabilities) of your web application, we recommend the following tools:
Use `@XmlSeeAlso` annotation to provide sub-classes.
15
+
See section "Collective Polymorphism" described https://dzone.com/articles/java-and-xml-part-3-jaxb[here].
16
16
17
17
=== JAXB Custom Mapping
18
-
In order to map custom link:guide-datatype.asciidoc[datatypes] or other types that do not follow the Java bean conventions, you need to define a custom mapping. If you create dedicated objects dedicated for the XML mapping you can easily avoid such situations. When this is not suitable follow these instructions to define the mapping: TODO
18
+
In order to map custom link:guide-datatype.asciidoc[datatypes] or other types that do not follow the Java bean conventions, you need to define a custom mapping. If you create dedicated objects for the XML mapping you can easily avoid such situations. When this is not suitable use `@XmlJavaTypeAdapter` and provide an `XmlAdapter` implementation that handles the mapping.
19
+
For details see https://www.eclipse.org/eclipselink/documentation/2.6/moxy/advanced_concepts006.htm[here].
To prevent XML External Entity attacks, follow https://docs.oracle.com/en/java/javase/11/security/java-api-xml-processing-jaxp-security-guide.html[JAXP Security Guide] and enable https://docs.oracle.com/en/java/javase/11/security/java-api-xml-processing-jaxp-security-guide.html#GUID-88B04BE2-35EF-4F61-B4FA-57A0E9102342[FSP].
0 commit comments