Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?

I have a little JavaEE project, and I have to secure it with the OWASP ESAPI

I integrated the ESAPI like this in Maven:

<!-- ESAPI Version 2.0.1 -->
<dependency>
    <groupId>org.owasp.esapi</groupId>
    <artifactId>esapi</artifactId>
    <version>2.0.1</version>
</dependency>

So after this I can use the ESAPI classes for programming.

I also included the .esapi folder in the server start:

 -Dorg.owasp.esapi.resources=/home/joergi/.esapi/ 

I also copied the ESAPI.properties and the validation.properties into

src/main/resources

(I'm not sure if it works, but I get no error while starting the server)

I looked at the ESAPI install guide (pdf) (really poorly documented) and copied the example

"To test if ESAPI has been successfully integrated and configured, create a file called EsapiIntegrationTest.java and paste in:"

 import org.owasp.esapi.ESAPI;
 public class EsapiTest {
     public static void main(String[] args){
         System.out.println("ESAPI.accessController found: " 
                                + ESAPI.accessController());
     }
 }

"If you can run this file and see the println output, then ESAPI has been successfully installed and configured! You can now begin using ESAPI functionality to secure your web applications!"

I "translated" it for my example:

@ManagedBean(name="testController")
@RequestScoped
public class TestController  {  

    public String esapiTest(){

    System.out.println("ESAPI.accessController found: " 
                               + ESAPI.accessController());

    return "ESAPI.accessController found: " + ESAPI.accessController();
    }
}

and I have a file test.xhtml:

<?xml version="1.0" encoding="UTF-8"?>
<ui:composition xmlns="http://www.w3.org/1999/xhtml"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
template="/WEB-INF/templates/default.xhtml">
<ui:define name="content">

    <h2>esapi test</h2>

        <h:outputText value="#{testController.esapiTest()}" />  

</ui:define>
</ui:composition>

When entering the test.xhtml I get this really long error (for a nicer view you can see it also in pastebin.com/6an0awMc)

<>

I know the ESAPI Swingset Demo - and this is running in my configuration

I have 2 questions:
Is my maven and my server start configuration right?
because the error looks like the ESAPI can't find the ESAPI Logger functions....

And
Is it even possible to use the simple test code-snippet in my setup at all?

(p.s. also tried to it without maven and just with including the downloaded jar - but its not working)

I miss something like:
(this is from the swingset demo example, NOT from my own project)

Seeking ESAPI.properties
  Not found in 'org.owasp.esapi.resources' directory or file not readable: /home/joergi/dev/projects/esapi_demo_1punkt0/ESAPI.properties
  Not found in SystemResource Directory/resourceDirectory: .esapi/ESAPI.properties
  Not found in SystemResource Directory/.esapi: .esapi/ESAPI.properties
  Not found in SystemResource Directory: ESAPI.properties
  Found in 'user.home' directory: /home/joergi/.esapi/ESAPI.properties
Loaded 'ESAPI.properties' properties file
Seeking validation.properties
  Not found in 'org.owasp.esapi.resources' directory or file not readable: /home/joergi/dev/projects/esapi_demo_1punkt0/validation.properties
  Not found in SystemResource Directory/resourceDirectory: .esapi/validation.properties
  Not found in SystemResource Directory/.esapi: .esapi/validation.properties
  Not found in SystemResource Directory: validation.properties
  Found in 'user.home' directory: /home/joergi/.esapi/validation.properties
Loaded 'validation.properties' properties file
Seeking ESAPI_logging_file
  Not found in 'org.owasp.esapi.resources' directory or file not readable: /home/joergi/dev/projects/esapi_demo_1punkt0/ESAPI_logging_file
  Not found in SystemResource Directory/resourceDirectory: .esapi/ESAPI_logging_file
  Not found in SystemResource Directory/.esapi: .esapi/ESAPI_logging_file
  Not found in SystemResource Directory: ESAPI_logging_file
  Found in 'user.home' directory: /home/joergi/.esapi/ESAPI_logging_file

Hopefully somebody can help!

share|improve this question

closed as off topic by AviD Mar 6 '12 at 5:56

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
The link to the [pastebin.com/6an0awMc Pastebin] and the link to [code.google.com/p/owasp-esapi-swingset-interactive/downloads/… ESAPI SWINGSET DEMO] –  Joerg Mar 5 '12 at 22:16
    
Joerg, welcome to Information Security. Please do not cross-post your questions to multiple SE sites - if it should be migrated, you can flag it there for a moderator's attention. However, this question does belong on SO, not here, since it is completely a coding question (even though it relates to a security product), but is not a security question about code. –  AviD Mar 6 '12 at 5:58
    
okay, sorry for cross-posting... the nerves are on the edge at the moment... –  Joerg Mar 6 '12 at 6:18

Browse other questions tagged or ask your own question.