Skip to content

Commit a1efbb7

Browse files
authored
#277: updated security guide to recent OWASP top 10 (#282)
1 parent 4daf996 commit a1efbb7

2 files changed

Lines changed: 46 additions & 31 deletions

File tree

documentation/guide-security.asciidoc

Lines changed: 39 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -15,60 +15,72 @@ We address these common threats individually in _security_ sections of our techn
1515
[options="header"]
1616
|=======================
1717
|*Threat*|*Protection*|*Link to details*
18-
|https://www.owasp.org/index.php/Top_10_2013-A1-Injection[A1 Injection]
18+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A1-Injection.html[A1 Injection]
1919
|validate input, escape output, use proper frameworks
2020
|link:guide-jpa.asciidoc#security[SQL Injection]
2121

22-
|https://www.owasp.org/index.php/Top_10_2013-A2-Broken_Authentication_and_Session_Management[A2 Broken Authentication and Session Management]
22+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A2-Broken_Authentication.html[A2 Broken Authentication]
2323
|encrypt all channels, use a central identity management with strong password-policy
2424
|link:guide-access-control.asciidoc#authentication[Authentication]
2525

26-
|https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS)[A3 XSS]
27-
|prevent injection (see A1) for HTML, JavaScript and CSS and understand same-origin-policy
28-
|link:guide-client-layer.asciidoc#security[client-layer]
29-
30-
|https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References[A4 Insecure Direct Object References]
31-
|Using direct object references (IDs) only with appropriate authorization
32-
|link:guide-logic-layer.asciidoc#direct-object-references[logic-layer]
33-
34-
|https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration[A5 Security Misconfiguration]
35-
|Use devonfw application template and guides to avoid
36-
|https://github.com/devonfw/devon4j/blob/develop/documentation/tutorial-newapp.asciidoc[tutorial-newapp] and link:guide-configuration.asciidoc#security[sensitive configuration]
37-
38-
|https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure[A6 Sensitive Data Exposure]
26+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A3-Sensitive_Data_Exposure.html[A3 Sensitive Data Exposure]
3927
|Use secured exception facade, design your data model accordingly
4028
|link:guide-service-layer.asciidoc#rest-exception-handling[REST exception handling]
4129

42-
|https://www.owasp.org/index.php/Top_10_2013-A7-Missing_Function_Level_Access_Control[A7 Missing Function Level Access Control]
30+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A4-XML_External_Entities_(XXE).html[A4 XML External Entities]
31+
|Prefer JSON over XML, ensure https://docs.oracle.com/en/java/javase/11/security/java-api-xml-processing-jaxp-security-guide.html[FSP] when parsing (external) XML
32+
|link:guide-xml.asciidoc[XML guide]
33+
34+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A5-Broken_Access_Control.html[A5 Broken Access Control]
4335
|Ensure proper authorization for all use-cases, use `@DenyAll` as default to enforce
44-
|link:guide-access-control.asciidoc#configuration-on-java-method-level[Method authorization]
36+
|link:guide-access-control.asciidoc[Access-control guide] especially link:guide-access-control.asciidoc#configuration-on-java-method-level[method authorization]
4537

46-
|https://www.owasp.org/index.php/Top_10_2013-A8-Cross-Site_Request_Forgery_(CSRF)[A8 CSRF]
47-
|secure mutable service operations with an explicit CSRF security token sent in HTTP header and verified on the server
48-
|link:guide-service-layer.asciidoc#csrf[service-layer security]
38+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A6-Security_Misconfiguration.html[A6 Security Misconfiguration]
39+
|Use devon4j application template and guides to avoid
40+
|link:tutorial-newapp.asciidoc[tutorial-newapp] and link:guide-configuration.asciidoc#security[sensitive configuration]
41+
42+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A7-Cross-Site_Scripting_(XSS).html[A7 Cross-Site Scripting]
43+
|prevent injection (see A1) for HTML, JavaScript and CSS and understand same-origin-policy
44+
|link:guide-client-layer.asciidoc#security[client-layer]
4945

50-
|https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities[A9 Using Components with Known Vulnerabilities]
46+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A8-Insecure_Deserialization.html[A8 Insecure Deserialization]
47+
|Use simple and established serialization formats such as JSON, prevent generic deserialization (for polymorphic types)
48+
|link:guide-json.asciidoc[JSON guide] especially link:guide-json.asciidoc#json-and-inheritance[inheritence], link:guide-xml.asciidoc[XML guide]
49+
50+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities.html[A9 Using Components with Known Vulnerabilities]
5151
|subscribe to security newsletters, recheck products and their versions continuously, use devonfw dependency management
5252
|https://cve.mitre.org/news/newsletter.html[CVE newsletter] and xref:dependency-check[dependency check]
5353

54-
|https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards[A10 Unvalidated Redirects and Forwards]
55-
|Avoid using redirects and forwards, in case you need them do a security audit on the solution.
56-
|devonfw proposes to use rich-clients (SPA/RIA). We only use redirects for login in a safe way.
54+
|https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A10-Insufficient_Logging%252526Monitoring.html[A10 Insufficient_Logging & Monitoring]
55+
|Ensure to log all security related events (login, logout, errors), establish effective monitoring
56+
|link:guide-logging.asciidoc[Logging guide] and link:guide-monitoring.asciidoc[monitoring guide]
57+
58+
|https://owasp.org/www-chapter-ghana/assets/slides/IDOR.pdf[Insecure Direct Object References]
59+
|Using direct object references (IDs) only with appropriate authorization
60+
|link:guide-logic-layer.asciidoc#direct-object-references[logic-layer]
61+
62+
|https://owasp.org/www-community/attacks/csrf[Cross-Site Request Forgery (CSRF)]
63+
|secure mutable service operations with an explicit CSRF security token sent in HTTP header and verified on the server
64+
|link:guide-service-layer.asciidoc#csrf[service-layer security]
5765

5866
|https://www.owasp.org/index.php/Log_Forging[Log-Forging]
5967
|Escape newlines in log messages
6068
|link:guide-logging.asciidoc#security[logging security]
69+
70+
|https://owasp.org/www-pdf-archive//OWASP_LA_New_OWASP_Top_10_David_Caissy_2017_07.pdf[Unvalidated Redirects and Forwards]
71+
|Avoid using redirects and forwards, in case you need them do a security audit on the solution.
72+
|devonfw proposes to use rich-clients (SPA/RIA). We only use redirects for login in a safe way.
6173
|=======================
6274

6375
== Tools
6476
=== Dependency Check
65-
To address https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities[A9 Using Components with Known Vulnerabilities] we integrated https://www.owasp.org/index.php/OWASP_Dependency_Check[OWASP dependency check] into the devonfw maven build. If you build an devonfw application (sample or any app created from our link:tutorial-newapp.asciidoc[app-template]) you can activate dependency check with the `security` profile:
77+
To address the thread `Using Components with Known Vulnerabilities` we integrated https://www.owasp.org/index.php/OWASP_Dependency_Check[OWASP dependency check] into the devon4j maven build. If you build an devon4j application (sample or any app created from our link:tutorial-newapp.asciidoc[app-template]) you can activate dependency check with the `security` profile:
6678
[source,bash]
6779
----
6880
mvn clean install -P security
6981
----
70-
This does not run by default as it causes a huge overhead for the build performance. However , consider to build this in your CI at least nightly.
71-
After the dependency check is performed , you will find the results in `target/dependency-check-report.html` of each module. The report will also always be generated when the site is build (`mvn site`).
82+
This does not run by default as it causes a huge overhead for the build performance. However, consider to build this in your CI at least nightly.
83+
After the dependency check is performed, you will find the results in `target/dependency-check-report.html` of each module. The report will also be generated when the site is build (`mvn site`) even without the profile.
7284

7385
=== Penetration Testing
7486
For penetration testing (testing for vulnerabilities) of your web application, we recommend the following tools:

documentation/guide-xml.asciidoc

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,13 @@ In Java there are many different APIs and frameworks for accessing, producing an
1111
We use http://en.wikipedia.org/wiki/Java_Architecture_for_XML_Binding[JAXB] to serialize Java objects to XML or vice-versa.
1212

1313
=== JAXB and Inheritance
14-
TODO +@XmlSeeAlso+
15-
http://stackoverflow.com/questions/7499735/jaxb-how-to-create-xml-from-polymorphic-classes
14+
Use `@XmlSeeAlso` annotation to provide sub-classes.
15+
See section "Collective Polymorphism" described https://dzone.com/articles/java-and-xml-part-3-jaxb[here].
1616

1717
=== JAXB Custom Mapping
18-
In order to map custom link:guide-datatype.asciidoc[datatypes] or other types that do not follow the Java bean conventions, you need to define a custom mapping. If you create dedicated objects dedicated for the XML mapping you can easily avoid such situations. When this is not suitable follow these instructions to define the mapping: TODO
18+
In order to map custom link:guide-datatype.asciidoc[datatypes] or other types that do not follow the Java bean conventions, you need to define a custom mapping. If you create dedicated objects for the XML mapping you can easily avoid such situations. When this is not suitable use `@XmlJavaTypeAdapter` and provide an `XmlAdapter` implementation that handles the mapping.
19+
For details see https://www.eclipse.org/eclipselink/documentation/2.6/moxy/advanced_concepts006.htm[here].
1920

20-
https://weblogs.java.net/blog/kohsuke/archive/2005/09/using_jaxb_20s.html
21+
== Security
22+
23+
To prevent XML External Entity attacks, follow https://docs.oracle.com/en/java/javase/11/security/java-api-xml-processing-jaxp-security-guide.html[JAXP Security Guide] and enable https://docs.oracle.com/en/java/javase/11/security/java-api-xml-processing-jaxp-security-guide.html#GUID-88B04BE2-35EF-4F61-B4FA-57A0E9102342[FSP].

0 commit comments

Comments
 (0)