This is the presentation from the ColdFusion Unconference session at Adobe MAX 2011 in Los Angeles. This covers a brief look at implementing the ESAPI project into your ColdFusion applications and what methods it has available to help secure your sites.

1. Matt Gifford (@coldfumonkeh)
www.mattgifford.co.uk
ColdFusion Unconference, Adobe MAX 2011

2. MAKE STUFF
SECURE!
Matt Gifford (@coldfumonkeh)
www.mattgifford.co.uk
ColdFusion Unconference, Adobe MAX 2011

3. KEEP IT TIGHT AND
OUT OF SIGHT
Matt Gifford (@coldfumonkeh)
www.mattgifford.co.uk
ColdFusion Unconference, Adobe MAX 2011

4. HOW TO SLAY
DRAGONS USING A
JET PACK & A
TOOTHBRUSH
Matt Gifford (@coldfumonkeh)
www.mattgifford.co.uk
ColdFusion Unconference, Adobe MAX 2011

5. THE OWASP ENTERPRISE
SECURITY API &
AVAILABLE METHODS TO
HELP LOCK DOWN A
COLDFUSION APPLICATION
Matt Gifford (@coldfumonkeh)
www.mattgifford.co.uk
ColdFusion Unconference, Adobe MAX 2011

6. WHO I AM NOT...
• Security expert of the highest order
• Sales man trying to pitch an idea for your $$
6

7. WHO I AM...
• Lead RIA Developer
• Author
• Inquisitive
• Open to new ideas and methods
7

8. INITIAL REACTIONS

9. DEVELOPERS - A BROAD
GENERALISATION
123
9

10. SECURING YOUR APPLICATIONS

11. WHO IS OWASP?

12. WHAT IS ESAPI?
Enterprise Security API
Open-source project that aims to fill gaps in
specs and server technology implementations
Uses current best practices to mitigate the
vulnerabilities mentioned in the
OWASP Top 10
12

13. WHAT IS ESAPI?
Enterprise Security API
A set of interfaces that provide functions for
most of the common security needs of
enterprise developers
13

14. WHAT IS ESAPI?
Enterprise Security API
“ ESAPI is designed to make it easy to retrofit
security into existing applications as well as
providing a solid foundation for new
”
development
14

15. WHAT IS ESAPI?
Enterprise Security API
Supported in multiple languages:
Java Python
.NET JavaScript
Classic ASP & ColdFusion
PHP
15

17. WHY USE ESAPI?
It’s aim is to make secure application
development easier
17

18. OWASP TOP 10
A1 Injection
A6 Security Misconfiguration
A2 Cross-Site Scripting
A7 Insecure Storage (crypto)
A3 Authentication & Sessions
A8 URL Access Restrictions
A4 Insecure Direct Object References
A9 Poor Transport Layer Protection
A5 Cross-Site Request Forgery
A10 Unvalidated Redirects
And this is just the top 10...
18

20. YOU MAY ALREADY HAVE IT
• ColdFusion 8 hotfix shipped with the ESAPI library under the
hood
• ColdFusion 9 included an updated version
20

21. COMING IN ZEUS!
• ESAPI integration will be included at a greater level in
ColdFusion X (Zeus)
• encodeForXXX functions to help you protect your
applications against XSS attacks
• You can use those now!
21

22. ENCODER
<cfoutput>
<p>Hey, #URL.name#!</p>
<p>Hey, #encodeForHTML(URL.name)#!</p>
</cfoutput>

24. SECURITY CONFIGURATION

25. SECURITY CONFIGURATION
Includes (but not restricted to)
the following:
• Master encryption
passwords (for salt and
hashing)
• Validation whitelists
• Logging levels and details
• Intrusion detection
• and more...

26. SECURITY CONFIGURATION
• You can select the path for a specific resource directory
• Ideal for handling multiple security levels / validations for
subsystems and micro-applications
ESAPI().securityConfiguration().setResourceDirectory("/path/to/.esapi/");

27. SECURITY CONFIGURATION
#===========================================
# ESAPI Authenticator
#
Authenticator.AllowedLoginAttempts=3
Authenticator.MaxOldPasswordHashes=13
Authenticator.UsernameParameterName=username
Authenticator.PasswordParameterName=password
# RememberTokenDuration (in days)
Authenticator.RememberTokenDuration=14
# Session Timeouts (in minutes)
Authenticator.IdleTimeoutDuration=20
Authenticator.AbsoluteTimeoutDuration=120

28. AUTHENTICATION

29. AUTHENTICATION
<cfquery name="qLogin" datasource="blah">
SELECT * FROM tbl_Users
WHERE username = <cfqueryparam cfsqltype="cf_sql_varchar" value="#form.username#" />
AND password = <cfqueryparam cfsqltype="cf_sql_varchar" value="#form.password#" />
</cfquery>
<!--- Check to see we have a user returned --->
<cfif qLogin.recordcount>
<!--- Set user into SESSION --->
<cfset session.userID
= qLogin.userID />
<cfset session.isLoggedIn = true />
<!--- DO LOGGED-IN STUFF --->
<cfelse>
<!--- Invalid credentials or no match found --->
<p>Sorry, we could not find a match.</p>
</cfif>

31. AUTHENTICATION

32. AUTHENTICATION
ESAPI().authenticator().login();
• Username & password combination (invisibly)
• Reading a “Remember me” cookie
• Currently logged in user based upon the session-id value
32

33. AUTHENTICATION
Key methods:
• createUser()
• generateStrongPassword()
• getcurrentUser()
• logout()
• verifyAccountnameStrength()
• verifyPasswordStrength
33

34. THE USER

35. THE USER
ESAPI().authenticator().createUser(”random01”,”657fhg",” 657fhg");
objUser = ESAPI ().authenticator().login(request, response);
objUser = ESAPI ().authenticator().getCurrentUser();
objUser = ESAPI ().authenticator().getUser(” random01”);
Token creation:
objUser.resetCSRFToken();
Accessing the token:
objUser.getCSRFToken();
35

36. THE USER
Key methods:
• changePassword() • isInRole()
• disable() • isEnabled()
• enable() • isExpired()
• getAccountName() • isLocked()
• getCSRFToken() • resetCSRFToken()
• getLastFailedLoginTime() • resetPassword()
• getLastLoginTime() • isSessionTimeout()
• getRoles() • isSessionAbsoluteTimeout()

37. HTTP UTILITIES
Provides a safe version of the
request and response object

38. HTTP UTILITIES
Key methods:
• addCSRFToken() • encryptStateInCookie()
• verifyCSRFToken() • decryptStateFromCookie()
• assertSecureRequest() • getSafeFileUploads()
• changeSessionIdentifier() • safeSendForward()
• encryptHiddenField() • safeSetContentType()
• decryptHiddenField() • setNoCacheHeaders()
• encryptQueryString() • setRememberToken()
• decryptQueryString()

39. ACCESS CONTROLLER
The gatekeeper for your ESAPI
application implementation
<cfscript>
if ((role == 'admin')
&& (coffeeIntake != 'small'))
{
// Take them to the Admin Console
location('/admin/hiddenPages.cfm');
}
else
{
// Direct user elsewhere
location('/standardPage.cfm');
}
</cfscript>

40. ACCESS CONTROLLER
• isAuthorizedForData()
• isAuthorizedForFile()
• isAuthorizedForURL()
• assertAuthorizedForData()
• assertAuthorizedForFile()
• assertAuthorizedForURL()

41. ENCRYPTOR
• decrypt()
• encrypt()
• hash()
• seal()
• sign(String data)
• unseal()
• verifySeal()
• verifySignature()

42. VALIDATOR
• White-list based filters
• Data canonicalization prior to
being passed to filters
• Detects double-encoding and
throws an exception

43. VALIDATOR CONFIGURATION
#================================================
# ESAPI Validation
Validator.ConfigurationFile=validation.properties
# Validators used by ESAPI
Validator.RoleName=^[a-z]{1,20}$
# Global HTTP Validation Rules
Validator.HTTPScheme=^(http|https)$
Validator.HTTPParameterName=^[a-zA-Z0-9_]{1,32}$
Validator.HTTPParameterValue=^[a-zA-Z0-9.-/

44. VALIDATOR CONFIGURATION
Validator.SafeString=^[.p{Alnum}p{Space}]{0,1024}$
Validator.Email=^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+.[a-zA-Z]{2,4}$
Validator.IPAddress=^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$
Validator.URL=^(ht|f)tp(s?)://[0-9a-zA-Z]([-.w]*[0-9a-zA-
Z])*(:(0-9)*)*(/?)([a-zA-Z0-9-.?,:'/+=&amp;
%$#_]*)?$
Validator.CreditCard=^(d{4}[- ]?){3}d{4}$
Validator.SSN=^(?!000)([0-6]d{2}|7([0-6]d|7[012]))([ -]?)(?!
00)dd3(?!0000)d{4}$

45. VALIDATOR CONFIGURATION
Custom white-list values can be added into the ESAPI.properties file:
Declaring:
Example User ID - MatGif0075
White-list entry: Validator.UserId= ^[A-Z]{6}[0-9]{4}$
Validating:
isValidInput(“User ID”, “MatGif0075”, “UserId", 10, false);

47. THE PROS
• Designed by security experts
• Multiple language support
• Highly extensible
• Works invisibly in many ways (voodoo magic)
• It’s open-source!!
47

48. THE CONS
• Paradigm shift (a new way of thinking)
• Worth the time retrofitting?
• Documentation levels (with clear working examples)
• It’s only an API - it’s not the miracle cure
48

50. MORE INFO
• OWASP ESAPI Official Page
http://bit.ly/owasp_esapi
• ESAPI Javadocs
http://bit.ly/esapi-javadocs
• CFESAPI on github
http://bit.ly/cfesapi
50

51. NOW GRAB YOUR
TOOTHBRUSH AND
GO SLAY SOME
DRAGONS
Matt Gifford (@coldfumonkeh)
www.mattgifford.co.uk
ColdFusion Unconference, Adobe MAX 2011