5

This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?

I have a little JavaEE project, and I have to secure it with the OWASP ESAPI

I integrated the ESAPI like this in Maven:

<!-- ESAPI Version 2.0.1 -->
<dependency>
    <groupId>org.owasp.esapi</groupId>
    <artifactId>esapi</artifactId>
    <version>2.0.1</version>
</dependency>

So after this I can use the ESAPI classes for programming.

I also included the .esapi folder in the server start:

 -Dorg.owasp.esapi.resources=/home/joergi/.esapi/ 

I also copied the ESAPI.properties and the validation.properties into

src/main/resources

(I'm not sure if it works, but I get no error while starting the server)

I looked at the ESAPI install guide (pdf) (really poorly documented) and copied the example

"To test if ESAPI has been successfully integrated and configured, create a file called EsapiIntegrationTest.java and paste in:"

 import org.owasp.esapi.ESAPI;
 public class EsapiTest {
     public static void main(String[] args){
         System.out.println("ESAPI.accessController found: " 
                                + ESAPI.accessController());
     }
 }

"If you can run this file and see the println output, then ESAPI has been successfully installed and configured! You can now begin using ESAPI functionality to secure your web applications!"

I "translated" it for my example:

@ManagedBean(name="testController")
@RequestScoped
public class TestController  {  

    public String esapiTest(){

    System.out.println("ESAPI.accessController found: " 
                               + ESAPI.accessController());

    return "ESAPI.accessController found: " + ESAPI.accessController();
    }
}

and I have a file test.xhtml:

<?xml version="1.0" encoding="UTF-8"?>
<ui:composition xmlns="http://www.w3.org/1999/xhtml"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
template="/WEB-INF/templates/default.xhtml">
<ui:define name="content">

    <h2>esapi test</h2>

        <h:outputText value="#{testController.esapiTest()}" />  

</ui:define>
</ui:composition>

When entering the test.xhtml I get this really long error (for a nicer view you can see it also in pastebin.com/6an0awMc)

<>

I know the ESAPI Swingset Demo - and this is running in my configuration

I have 2 questions:
Is my maven and my server start configuration right?
because the error looks like the ESAPI can't find the ESAPI Logger functions....

And
Is it even possible to use the simple test code-snippet in my setup at all?

(p.s. also tried to it without maven and just with including the downloaded jar - but its not working)

I miss something like:
(this is from the swingset demo example, NOT from my own project)

Seeking ESAPI.properties
  Not found in 'org.owasp.esapi.resources' directory or file not readable: /home/joergi/dev/projects/esapi_demo_1punkt0/ESAPI.properties
  Not found in SystemResource Directory/resourceDirectory: .esapi/ESAPI.properties
  Not found in SystemResource Directory/.esapi: .esapi/ESAPI.properties
  Not found in SystemResource Directory: ESAPI.properties
  Found in 'user.home' directory: /home/joergi/.esapi/ESAPI.properties
Loaded 'ESAPI.properties' properties file
Seeking validation.properties
  Not found in 'org.owasp.esapi.resources' directory or file not readable: /home/joergi/dev/projects/esapi_demo_1punkt0/validation.properties
  Not found in SystemResource Directory/resourceDirectory: .esapi/validation.properties
  Not found in SystemResource Directory/.esapi: .esapi/validation.properties
  Not found in SystemResource Directory: validation.properties
  Found in 'user.home' directory: /home/joergi/.esapi/validation.properties
Loaded 'validation.properties' properties file
Seeking ESAPI_logging_file
  Not found in 'org.owasp.esapi.resources' directory or file not readable: /home/joergi/dev/projects/esapi_demo_1punkt0/ESAPI_logging_file
  Not found in SystemResource Directory/resourceDirectory: .esapi/ESAPI_logging_file
  Not found in SystemResource Directory/.esapi: .esapi/ESAPI_logging_file
  Not found in SystemResource Directory: ESAPI_logging_file
  Found in 'user.home' directory: /home/joergi/.esapi/ESAPI_logging_file

Hopefully somebody can help!

3
  • The link to the [pastebin.com/6an0awMc Pastebin] and the link to [code.google.com/p/owasp-esapi-swingset-interactive/downloads/… ESAPI SWINGSET DEMO]
    – Joergi
    Mar 5, 2012 at 22:16
  • 1
    Joerg, welcome to Information Security. Please do not cross-post your questions to multiple SE sites - if it should be migrated, you can flag it there for a moderator's attention. However, this question does belong on SO, not here, since it is completely a coding question (even though it relates to a security product), but is not a security question about code.
    – AviD
    Mar 6, 2012 at 5:58
  • okay, sorry for cross-posting... the nerves are on the edge at the moment...
    – Joergi
    Mar 6, 2012 at 6:18

0

Browse other questions tagged .