You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Major changes were:
* Reorganizing and renaming sections.
* Removing the old kruft we never used (e.g., irc,freenode.net).
* Moving other old stuff to 'Ancient History' section.
* Generalizing the vulnerabilities summary section.
* Calling out some important things in various release notes that are source of frequent questions.
* Misc cleanup, such as fixing typos (although new ones probably accidentally introduced).
* New section on Locating ESAPI Jar files.
* Breaking longer lines into much shorter ones.
The ESAPI legacy GitHub repo also has several useful [wiki pages](https://github.com/ESAPI/esapi-java-legacy/wiki).
28
28
@@ -31,16 +31,16 @@ This is the legacy branch of ESAPI which means it is an actively maintained bran
31
31
Development for the "next generation" of ESAPI (starting with ESAPI 3.0), will be done at the
32
32
GitHub repository at [https://github.com/ESAPI/esapi-java](https://github.com/ESAPI/esapi-java).
33
33
34
-
<b>IMPORTANT NOTES:</b>
35
-
The default branch for ESAPI legacy is the 'develop' branch (rather than the 'main' (formerly 'master') branch), where future development, bug fixes, etc. will now be done. The 'main' branch is now marked as "protected"; it reflects the latest stable ESAPI release (2.1.0.1 as of this date). Note that this change of making the 'develop' branch the default may affect any pull requests that you were intending to make.
36
-
37
-
Also, the <i>minimal</i> baseline Java version to use ESAPI is Java 8. (This was changed from Java 7 during the 2.4.0.0 release.)
34
+
**IMPORTANT NOTES:**
35
+
* The default branch for ESAPI legacy is the 'develop' branch (rather than the 'main' (formerly 'master') branch), where future development, bug fixes, etc. are now being done. The 'main' branch is now marked as "protected"; it reflects the latest stable ESAPI release (2.4.0.0 as of this date). Note that this change of making the 'develop' branch the default may affect any pull requests that you were intending to make.
36
+
* Also, the *minimal* baseline Java version to use ESAPI is now Java 8. (This was changed from Java 7 during the 2.4.0.0 release.)
38
37
39
38
# Where can I find ESAPI 3.x?
40
39
As mentioned above, you can find it at [https://github.com/ESAPI/esapi-java](https://github.com/ESAPI/esapi-java).
41
40
42
-
Note however that work on ESAPI 3 has not yet become in earnest and is only in its earliest planning stages.
43
-
Even the code that is presently there will likely change.
41
+
Note however that work on ESAPI 3 has not yet begun in earnest and is only
42
+
in its earliest planning stages. Even the code that is presently there
43
+
will likely change.
44
44
45
45
# ESAPI Release Notes
46
46
The ESAPI release notes may be found in ESAPI's "documentation" directory. They are generally named "esapi4java-core-*2.#.#.#*-release-notes.txt", where "*2.#.#.#*" refers to the ESAPI release number (which uses semantic versioning).
@@ -51,70 +51,115 @@ link to the specific release notes.
51
51
### Really IMPORTANT information in release notes
52
52
* Starting with ESAPI 2.2.1.0, important details changed reading the ESAPI
53
53
Logger. If you have are getting things like ClassNotFoundException, you
54
-
probably have not read it. Please be sure to read this section of the release
However, before you start a *new* project using ESAPI, but sure to read "[Should I use ESAPI?](https://owasp.org/www-project-enterprise-security-api/#div-shouldiuseesapi)".
75
+
However, **before** you start a *new* project using ESAPI, but sure to read "[Should I use ESAPI?](https://owasp.org/www-project-enterprise-security-api/#div-shouldiuseesapi)".
72
76
73
77
# ESAPI Deprecation Policy
74
-
Unless we unintentionally screw-up, our intent is to keep classes, methods, and/or fields whihc have been annotated as "@deprecated" for a minimum of two (2) years or until the next major release number (e.g., 3.x as of now), which ever comes first, before we remove them.
75
-
Note that this policy does not apply to classes under the **org.owasp.esapi.reference** package. You are not expected to be using such classes directly in your code.
78
+
Unless we unintentionally screw-up, our intent is to keep classes, methods,
79
+
and/or fields which have been annotated as "@deprecated" for a
80
+
minimum of two (2) years or until the next major release number (e.g.,
81
+
3.x as of now), which ever comes first, before we remove them. Note
82
+
that this policy does not apply to classes under
83
+
the **org.owasp.esapi.reference** package. You generally are not expected
84
+
to be using such classes directly in your code. At the ESAPI team's discretion,
85
+
it will also not apply for any known exploitable vulnerabilities for which
86
+
no available workaround exists.
87
+
88
+
**IMPORTANT NOTES:** The next planned removal of deprecated code is for us to
89
+
remove all the Log4J 1.x related ESAPI Logger code. The Log4J 1 ESAPI Logger
90
+
was first marked deprecated in ESAPI 2.2.1.0, which was released July 13, 2022.
91
+
This means that on or shortly after, you can expect a new ESAPI release that
92
+
will no longer have a dependency on Log4J 1. **YOU HAVE BEEN WARNED!!!**
76
93
77
94
# Contributing to ESAPI legacy
78
95
### How can I contribute or help with fix bugs?
79
-
Fork and submit a pull request! Simple as pi! (How's that for an irrational statement? :)
80
-
We generally only accept bug fixes, not new features because as a legacy project, we don't intend on adding new
81
-
features, although we may make exceptions. If you are interesting in doing bug fixes though, the best place to start is
82
-
the [CONTRIBUTING-TO-ESAPI.txt](https://github.com/ESAPI/esapi-java-legacy/blob/develop/CONTRIBUTING-TO-ESAPI.txt)
96
+
Fork and submit a pull request! Easy as pi! (How's that for an irrational
97
+
statement, you math nerds? :) We generally only accept bug fixes, not
98
+
new features because as a legacy project, we don't intend on adding new
99
+
features that we will have to maintain long term (although we may make
100
+
exceptions; see the 'New Features' section in this **README**). If
101
+
you are interesting in doing bug fixes though, the best place to start is the
If you are new to ESAPI, a good place to start is to look for GitHub issues labled as 'good first issue'. (E.g., to find all open issues with that label, use [https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22](https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22).)
85
105
86
-
Again, please can find additional specific details in the file
If you have found a bug, then create an issue on the esapi-legacy-java repo: [https://github.com/ESAPI/esapi-java-legacy/issues](https://github.com/ESAPI/esapi-java-legacy/issues)
91
-
92
-
NOTE: Please do **NOT** use GitHub issues to ask questions about ESAPI. If you wish to do this, post to either of
93
-
the 2 mailing lists (now on Google Groups) found at the bottom of this page. If we find questions as GitHub issues,
94
-
we simply will close them and direct you to do this anyhow. Alternately you may use the new
111
+
If you have found a bug, then create an issue on the esapi-legacy-java repo at [https://github.com/ESAPI/esapi-java-legacy/issues](https://github.com/ESAPI/esapi-java-legacy/issues)
112
+
As of May 11, 2022, we switched back to using (GitHub) issue templates. (We previously used issue templates when our source code repository was still on Google Code.) You can read more about our issue templates in this brief
NOTE: Please do **NOT** use GitHub issues to ask questions about ESAPI.
116
+
If you wish to ask questions, instead, post to either of the 2 mailing
117
+
lists (now on Google Groups) found the References section at the bottom
118
+
of this page. If we find questions posted as GitHub issues, we simply will
119
+
close them and direct you to do this anyhow. Alternately you may use the new
95
120
[Q&A](https://github.com/ESAPI/esapi-java-legacy/discussions/categories/q-a) section of our GitHub
96
121
[Discussions](https://github.com/ESAPI/esapi-java-legacy/discussions) page to ask questions.
97
122
98
-
When reporting an issue or just asking a question, please be clear and try to ensure that the ESAPI
99
-
development team has sufficient information to be able to reproduce your results or to understand
100
-
your question. If you have not already done so, this might be a good time to read Eric S. Raymond's classic
101
-
"[How to Ask Questions the Smart Way](http://www.catb.org/esr/faqs/smart-questions.html)" before posting your issue.
123
+
When reporting an issue or just asking a question, please be clear and try
124
+
to ensure that the ESAPI development team has sufficient information to be
125
+
able to reproduce your results or to understand your question. If you have
126
+
not already done so, this might be a good time to read Eric S. Raymond's classic
127
+
"[How to Ask Questions the Smart Way](http://www.catb.org/esr/faqs/smart-questions.html)"
128
+
before posting your issue.
102
129
103
130
#### Find a Vulnerability?
104
-
If you have found a vulnerability in ESAPI legacy, first search the issues list (see above) to see if it has already been reported. If it has not, then please contact both Kevin W. Wall (kevin.w.wall at gmail.com) and Matt Seil (matt.seil at owasp.org) directly. Please do not report vulnerabilities via GitHub issues or via the ESAPI mailing lists as we wish to keep our users secure while a patch is implemented and deployed. If you wish to be acknowledged for finding the vulnerability, then please follow this process. (Eventually, we would like to have BugCrowd handle this, but that's still a ways off.) Also, when you post the email describing the vulnerability, please do so from an email address that you usually monitor.
105
-
106
-
More detail is available in the file '[SECURITY.md](https://raw.githubusercontent.com/ESAPI/esapi-java-legacy/develop/SECURITY.md)'.
131
+
If believe you have found a vulnerability in ESAPI legacy, for the sake of the
132
+
ESAPI community, please practice Responsible Disclosure. (Note: We will be sure
133
+
you get credit and will work with you to create a GitHub Security Advisory, and
134
+
if you so choose, to persue filing a CVE via the GitHub CNA.)
135
+
136
+
You are of course encouraged to first search our GitHub issues list (see above)
137
+
to see if it has already been reported. If it has not, then please contact
138
+
both Kevin W. Wall (kevin.w.wall at gmail.com) and
139
+
Matt Seil (matt.seil at owasp.org) directly. Please do not report
140
+
vulnerabilities via GitHub issues or via the ESAPI mailing lists as
141
+
we wish to keep our users secure while a patch is implemented and
142
+
deployed. If you wish to be acknowledged for finding the vulnerability,
143
+
then please follow this process. Also, when you post the email describing
144
+
the vulnerability, please do so from an email address that you usually
0 commit comments