Question about ESAPI for .NET

I was asked recently about 'ESAPI for .NET?' (by XXX, who is an SI customer) and here was my reply

---------

Hi, unfortunately there isn't a simple answer/solution for your question

I would definitely not recommend of using any of the ESAPI libraries, specially the .NET since that is not even in a workable state.

The best security controls out there are actually the Microsoft ones, which when used in secure ways, do provide a lot of security (for example Razor now encodes by default which does a lot to prevent XSS). On the topic of XSS, the Microsoft AntiXSS library is really good, and is now part of .NET 4.5.

View ESAPI 11 Encodings methods in real-time via an ASP.NET Web Page

In the Another step in the use of ESAPI and AppSensor Jars from .Net/C# (using Jni4Net) I posted the screenshots below, which are such a big step forward that I'm creating this separate blog post to expand the idea a little bit :)

One of the things that I always wanted to do with ESAPI , was to have programmatic access to the multiple ESAPI encodings methods, since I believe they are a great example of the type of encodings capabilities that are needed in order to safely consume data provided by (potentially malicious) users.

ESAPI provides a number of sepecific methods to encode a string (each focused on a particular use case)

1. encodeForHTML
2. encodeForHTMLAttribute
3. encodeForCSS
4. encodeForJavascript
5. encodeForVBScript
6. encodeForLDAP
7. encodeForDN
8. encodeForXPath
9. encodeForXML
10. encodeForXmlAttribute
11. encodeForURL

And given a particular string, what does each of of these look like?

Another step in the use of ESAPI and AppSensor Jars from .Net/C# (using Jni4Net)

Yesterday at the OWASP EU Tour London Chapter event meeting I presented the next step of my research on using ESAPI and AppSensor inside a .NET application like TeamMentor (using Jni4Net to allow the JVM to work side by side with the CLR).

The source code of the demo I presented is posted to the github.com:DinisCruz/TeamMentor_3_3_AppSensor repo, and this post shows a number of screenshots of what is in there.

I used TeamMentor’s TBot C# and AngularJS pages to create the prototypes (since it is very easy and fast to code in that enviroment)

First execution of ESAPI.jar Encoder methods from O2's C# REPL

Last month (when I was preparing to do the OWASP AppSensor and O2 Platform at Security B-Sides London workshop with colin), I achieved something that I have been trying to do for a while:

Use the O2 Platform's C# REPL environment to programatically access (in real time) the ESAPI jar apis and methods. (see prob described at the end of Loading OWASP ESAPI jar and its dependencies from C# (using jni4net) for my last attempt)

And I'm happy to say that 'consuming the ESAPI jar from .Net', is exactly what I was able to achieve last month :)

I was also able to consume AppSensor's jar directly from a .NET app (in that case TeamMentor) and I have a lot more blog posts to write up on that topic.

This current post,  is the one I wrote at the time of the breakthrough (last month), which got stuck in the drafts folder and remained unpublished (until now)

--------------