ESAPI Project Users - Google Groups

Groups

1–30 of 80

Google group for discussion of those using ESAPI.

0 selected

Jeffrey Walton, Kevin W. Wall3

Jul 2

ESAPI Validator and email addresses

Jeff, You're not wrong. The simple answer is if you want this changed, changed it in your own

unread,

ESAPI Validator and email addresses

Jeff, You're not wrong. The simple answer is if you want this changed, changed it in your own

Jul 2

Jeffrey Walton, Kevin W. Wall6

Jul 1

ESAPI.properties and SafeString

Thanks Jeff. I will try to get it updated in the 'develop' branch soon. It will take a while

unread,

ESAPI.properties and SafeString

Thanks Jeff. I will try to get it updated in the 'develop' branch soon. It will take a while

Jul 1

Jeffrey Walton, … xeno...@gmail.com3

Jun 30

Use of google-java-format before check-ins?

I have tended to do exactly as you have pointed out here. I try to obey the file, only really mucking

unread,

Use of google-java-format before check-ins?

I have tended to do exactly as you have pointed out here. I try to obey the file, only really mucking

Jun 30

6/27/25

ESAPI 2.7.0.0 released; addresses CVE-2025-5878 and others in vulnerable dependencies

See the announcement in GitHub Discussion #889 and be sure to read the referenced Security Bulletin #

unread,

ESAPI 2.7.0.0 released; addresses CVE-2025-5878 and others in vulnerable dependencies

See the announcement in GitHub Discussion #889 and be sure to read the referenced Security Bulletin #

6/27/25

Sarthak Mehta, Kevin W. Wall2

2/12/25

Very old package bsh being used in org.owasp.esapi:esapi

Hi Sarthak, I did a little research. There actually is a newer version of bsh jar from Dec 2, 2022.

unread,

Very old package bsh being used in org.owasp.esapi:esapi

Hi Sarthak, I did a little research. There actually is a newer version of bsh jar from Dec 2, 2022.

2/12/25

Jeffrey Walton, … Kevin W. Wall4

2/9/25

Path traversal gear

On Wed, Feb 5, 2025 at 6:17 PM <xeno...@gmail.com> wrote: Let me qualify that abit: ESAPI is

unread,

Path traversal gear

On Wed, Feb 5, 2025 at 6:17 PM <xeno...@gmail.com> wrote: Let me qualify that abit: ESAPI is

2/9/25

11/25/24

ESAPI 2.6.0.0 release now available - Deprecated Validator.isValidSafeHTML methods now removed

All, The latest ESAPI release, 2.6.0.0, is now available from GitHub and Maven Central Repository. (

unread,

ESAPI 2.6.0.0 release now available - Deprecated Validator.isValidSafeHTML methods now removed

All, The latest ESAPI release, 2.6.0.0, is now available from GitHub and Maven Central Repository. (

11/25/24

10/8/24

Next ESAPI release to remove Validator.isValidSafeHTML and property name fields in DefaultSecurityConfiguration

As noted in the GHAS Security Advisory, https://github.com/ESAPI/esapi-java-legacy/security/

unread,

Next ESAPI release to remove Validator.isValidSafeHTML and property name fields in DefaultSecurityConfiguration

As noted in the GHAS Security Advisory, https://github.com/ESAPI/esapi-java-legacy/security/

10/8/24

10/8/24

New ESAPI release - 2.5.5.0

The ESAPI 2.5.5.0 release is now official. You may note that some dates related to Maven reflect

unread,

New ESAPI release - 2.5.5.0

The ESAPI 2.5.5.0 release is now official. You may note that some dates related to Maven reflect

10/8/24

5/29/24

There is another (ESAPI) system

I was aware of the "Enhanced Small Arms Protective Insert", but the "Enhanced System

unread,

There is another (ESAPI) system

I was aware of the "Enhanced Small Arms Protective Insert", but the "Enhanced System

5/29/24

Kevin W. Wall, Jeffrey Walton2

5/29/24

ESAPI 2.5.4.0 released

On Wed, May 29, 2024 at 10:56 PM Kevin W. Wall <kevin....@gmail.com> wrote: > > See

unread,

ESAPI 2.5.4.0 released

On Wed, May 29, 2024 at 10:56 PM Kevin W. Wall <kevin....@gmail.com> wrote: > > See

5/29/24

2/5/24

Before you panic - New AntiSamy release available

Release 1.7.5 of AntiSamy was released last Friday, 2/2/2024. It addresses CVE-2024-23635 which you

unread,

Before you panic - New AntiSamy release available

Release 1.7.5 of AntiSamy was released last Friday, 2/2/2024. It addresses CVE-2024-23635 which you

2/5/24

12/1/23

New ESAPI minor point / patch release issued - ESAPI 2.5.3.1

It's been less than a week, but Dave Wichers suggested logging the deprecated DefaultValidator.

unread,

New ESAPI minor point / patch release issued - ESAPI 2.5.3.1

It's been less than a week, but Dave Wichers suggested logging the deprecated DefaultValidator.

12/1/23

Kevin W. Wall, … David Karr6

11/29/23

ESAPI 2.5.3.0 released

Ah. The eclipse transformer plugin. Time to read some docs. On Wed, Nov 29, 2023, 13:30 Kevin W. Wall

unread,

ESAPI 2.5.3.0 released

Ah. The eclipse transformer plugin. Time to read some docs. On Wed, Nov 29, 2023, 13:30 Kevin W. Wall

11/29/23

11/23/23

ESAPI 2.5.3.0 status update - stuck on failing Dependency Check

Looks like lots of others are getting the same error: https://github.com/jeremylong/DependencyCheck/

unread,

ESAPI 2.5.3.0 status update - stuck on failing Dependency Check

Looks like lots of others are getting the same error: https://github.com/jeremylong/DependencyCheck/

11/23/23

11/10/23

Update on status of work on new ESAPI release to update to new AntiSamy 1.7.4 release

Should anyone care to look at the AntiSamy related tests that are now failing in ESAPI, I have

unread,

Update on status of work on new ESAPI release to update to new AntiSamy 1.7.4 release

Should anyone care to look at the AntiSamy related tests that are now failing in ESAPI, I have

11/10/23

Kevin W. Wall, Jeffrey Walton4

10/18/23

Working on new ESAPI release to update to new AntiSamy 1.7.4 release

An update: Good news: That one test bizarrely just started working when I re-cloned and then copied

unread,

Working on new ESAPI release to update to new AntiSamy 1.7.4 release

An update: Good news: That one test bizarrely just started working when I re-cloned and then copied

10/18/23

Jeffrey Walton, Kevin W. Wall2

8/2/23

ESAPI and spring framework?

I think that avgvstvs' advice in the SO link you referenced is good advice. The only thing that I

unread,

ESAPI and spring framework?

I think that avgvstvs' advice in the SO link you referenced is good advice. The only thing that I

8/2/23

Jeffrey Walton, … Kevin W. Wall6

8/2/23

ESAPI on a <textarea> displaying XML

On Saturday, July 29, 2023 at 11:18:30 AM UTC-4 Jeffrey Walton wrote: Hi Everyone, I'm having a

unread,

ESAPI on a <textarea> displaying XML

On Saturday, July 29, 2023 at 11:18:30 AM UTC-4 Jeffrey Walton wrote: Hi Everyone, I'm having a

8/2/23

Jeffrey Walton, Kevin W. Wall4

7/9/23

ESAPI.properties not readable?

If you want the "Dark and Silent" approach, add: -Dorg.owasp.esapi.logSpecial.discard=true

unread,

ESAPI.properties not readable?

If you want the "Dark and Silent" approach, add: -Dorg.owasp.esapi.logSpecial.discard=true

7/9/23

Jeffrey Walton, Kevin W. Wall7

7/7/23

Using ESAPI jar without a framework filesystem layouts, maven or IDEs

Also, compiling it (at least for this particular example) is the easy part. Collecting all the jars

unread,

Using ESAPI jar without a framework filesystem layouts, maven or IDEs

Also, compiling it (at least for this particular example) is the easy part. Collecting all the jars

7/7/23

Jeffrey Walton, … Matt Seil5

6/20/23

Special note regarding Spring Boot 3 ... in README

It's worth noting that invoking sed/awk/bash would remove the current ability to perform cross-

unread,

Special note regarding Spring Boot 3 ... in README

It's worth noting that invoking sed/awk/bash would remove the current ability to perform cross-

6/20/23

Jeffrey Walton, Kevin W. Wall3

5/31/23

ESAPI Javadocs and latest URL

On Wed, May 31, 2023 at 12:06 PM Kevin W. Wall <kevin....@gmail.com> wrote: > > I

unread,

ESAPI Javadocs and latest URL

On Wed, May 31, 2023 at 12:06 PM Kevin W. Wall <kevin....@gmail.com> wrote: > > I

5/31/23

Jeffrey Walton, … Matt Seil3

5/27/23

Using the encoder to avoid false positive

There's confusion here. You canonicalize to make a string safe for comparisons and encode when

unread,

Using the encoder to avoid false positive

There's confusion here. You canonicalize to make a string safe for comparisons and encode when

5/27/23

4/13/23

New ESAPI release 2.5.2.0 addresses 2 CVEs in transitive dependencies

See https://github.com/ESAPI/esapi-java-legacy/discussions/785 and feel free to continue the

unread,

New ESAPI release 2.5.2.0 addresses 2 CVEs in transitive dependencies

See https://github.com/ESAPI/esapi-java-legacy/discussions/785 and feel free to continue the

4/13/23

4/5/23

CVE-2023-24998 and why the ESAPI 2.5.2.0 release is momentarily delayed

Please read https://github.com/ESAPI/esapi-java-legacy/discussions/782 If you have questions, it is

unread,

CVE-2023-24998 and why the ESAPI 2.5.2.0 release is momentarily delayed

Please read https://github.com/ESAPI/esapi-java-legacy/discussions/782 If you have questions, it is

4/5/23

3/27/23

New ESAPI release this weekend looking much less likely

Well, got past the power outage situation (although there were several "outages" caused by

unread,

New ESAPI release this weekend looking much less likely

Well, got past the power outage situation (although there were several "outages" caused by

3/27/23

tech burgher, … Kevin W. Wall4

3/25/23

org.opensaml.ESAPISecurityConfig.getBooleanProp exception?

Okay, thanks for that update. I guess the OpenSAML folks are not ones who care about all the

unread,

org.opensaml.ESAPISecurityConfig.getBooleanProp exception?

Okay, thanks for that update. I guess the OpenSAML folks are not ones who care about all the

3/25/23

Eyal Kalimi, Kevin W. Wall2

3/22/23

esapi next release?

On Wed, Mar 22, 2023 at 11:15 AM Eyal Kalimi <naz...@gmail.com> wrote: Hi, We are using esapi

unread,

esapi next release?

On Wed, Mar 22, 2023 at 11:15 AM Eyal Kalimi <naz...@gmail.com> wrote: Hi, We are using esapi

3/22/23

1/12/23

Discussion about ESAPI supporting jakarta.servlet-api

You might be interested in joining the discussion at https://github.com/ESAPI/esapi-java-legacy/

unread,

Discussion about ESAPI supporting jakarta.servlet-api

You might be interested in joining the discussion at https://github.com/ESAPI/esapi-java-legacy/

1/12/23

Search

Clear search

Close search

Google apps

Main menu