Thursday, May 7, 2009

Struts 2 Security Addons Code Repository

I have created a code repository for the struts 2 security modules listed in the appendix section of paper "A Gap Analysis of Application Security in Struts2" by Arshan Dabirsiaghi and the OWASP ISWG.

The code repository can be found below, and it allows anyone to download the code and use it within their own project.

http://code.google.com/p/struts2securityaddons/

Additionally, you can see discussion of these modules in my earlier blog posts:
Posted by at 3 comments:
Labels: ,

Monday, May 4, 2009

Light-weight Code Review as You Program (Not After You're Done)

I have been working on a project lately to perform (some) code review as code is written, rather than waiting until it is checked in to cvs/svn/etc. My solution was to create an IDE plug-in that leverages built in features to highlight insecure method calls and suggest alternate code.

When the IDE starts up, it gets an updated list of insecure methods and hints from a web service. Right now I am in the very early stages, so It isn't real pretty or refined yet. For now, I am calling the project Just-in-Time (JIT) Secure Code.

The video below demonstrates the concept in NetBeans.


Posted by at 2 comments:
Labels: ,

OWASP ISWG: Struts 2/WebWork Gap Analysis

Arshan Dabirsiaghi recently published "A Gap Analysis of Application Security in Struts2/WebWork" for the OWASP Intrinsic Security Working Group. The paper evaluates the security controls/features that are either built into Struts 2 or can be added by extending the framework.

I had the opportunity to contribute research and code to this paper. The appendix section contains several code examples showing how one might:
  • Create an authentication interceptor
  • Create a roles interceptor (Enforced page-level access controls based on a user's privilege level)
  • Create a caching headers interceptor
  • Prevent CSRF vulnerabilities using the built in tokenSession Interceptor
  • Implement a custom error handler
  • Create an interceptor that enforces SSL
  • Regenerate session IDs when users cross an authentication boundary
The paper can be found here:
http://www.owasp.org/index.php/Image:A_Gap_Analysis_of_Application_Security_in_Struts2.pdf

The code repository containing updated struts 2 modules can be found below:

http://code.google.com/p/struts2securityaddons/

Additionally, you can see discussion of these modules in my earlier blog posts:
Posted by at 2 comments:
Labels: ,
Subscribe to: Posts (Atom)