Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been looking for open source runtime enforcement tools that I can use my own policies to prevent input validation vulnerabilities, in web applications.

The web applications that I want to prevent input validation vulnerabilities are Servlet projects.

The reason that I am looking for runtime enforcement tools is to provide a server-side protection for my web applications.

Thanks in advance.

share|improve this question
3  
Can you clarify what you mean by runtime enforcement tool? –  Terry Chia Aug 13 '13 at 10:07
    
Well we can consider it as web application firewall. I want to check the incoming requests if it contains any improper inputs. Therefore, I can block (or direct it to an error message page) the incoming request before it reaches the server. This tool should be between the user and the server. The filtering process should be in runtime, so I can have a more robust web application. –  Ekin Aug 13 '13 at 11:48
    
Are you using Java or something else? –  ott-- Sep 12 '13 at 13:40
add comment

2 Answers 2

You can use OWSAP ESAPI Web Application Firewall (WAF) which is a standard J2EE servlet filter. Ideally the filter can be configured to catch all requests (/*) in web.xml.The ESAPI Project basically provides security interfaces and Exception classes model that can provides security to enterprise web applications. The security controls are provided through several security filters that are deployed in front of your application.

share|improve this answer
    
Thanks for the response. I just checked ESAPI WAF, it might be very useful, however, the documentation is really insufficient. Do you have any idea if it can also provide the "body" part of a request. –  Ekin Aug 13 '13 at 11:41
    
You can its javadoc for documentation and for its basic understanding you can review grepcode.com/file/repo1.maven.org/maven2/org.owasp.esapi/esapi/… –  Ali Ahmad Aug 13 '13 at 12:34
add comment

What you describe will not "prevent input validation vulnerabilities"; that is nearly impossible (you need to look at penetration testing, static code analysers and code development policies to prevent) but there are tools which will prevent or mitigate such vulnerabilities being exploited.

Ali has already mentioned servlet filters. Other things you might want to have a look at are mod_security and fail2ban.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.