OWASP ESAPI – A Retrospective: The Good, the Bad, & the Ugly
summary
OWASP ESAPI originates around 2007 as interface-first security library with bundled reference implementations that lead to monolithic dependencies. The encoder dominates usage (about 22 encoder/decoder methods) while HTTP utilities balloon to ~60 methods; a singleton encrypter design forces global cipher choices causing threading and migration pain. A 2.0-era CVE traces to keeping broken 1.x crypto interfaces for compatibility, NSA review misses that flaw, migration to Git/Maven and hundreds of simultaneous changes create release and testing gaps.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:27Objectives of this talk
- 4:19Process perspective: Overview
- 15:22People perspective: The Good
- 31:46Technical: The Bad: Uncontrolled property grov...
- 42:40Technical: The Ugly: Finding ESAPI.propertie • One of the most frequently asked question on Stack Overflow.
related talks
24mOWASP ESAPI – A Retrospective: The Good, the Bad, & the Ugly
09mESAPI Crypto Changes
51mKeynote: 20:20 The History and Future of OWASP
31mOWASP API Security Project
40mEvolution of AppSec: Perspectives from a Decade of Building OWASP ZAP
01h 29mAPI Vulnerabilities and What to Do About Them
01h 02mApisecure, 14 & 15 March 2023 - Inon Shkedy, Co-Author of OWASP API Security Top 10.
45mLeveraging OWASP in Open Source Projects