Difference between revisions of "OWASP Top10:2021"

From Documentation
Line 1: Line 1:
−
= OWASP Top 10 Security Concerns 2021 =
+
= OWASP Top 10 Security Concerns In 2021 =
 +
 
 +
This page details the OWASP Top 10 security risks for 2021 as they pertain to the ZK framework. For risks that continue from the 2017 list, links are provided to the original explanations, with updates and new risks detailed directly on this page.
 +
 
 +
== A01:2021 - Injection ==
 +
See [[ZK_Developer's_Reference/Security_Tips/OWASP_Top_10_Security_Concerns_In_2017#A01-Injection|OWASP Top 10 Security Concerns In 2017#A01 - Injection]]
 +
 
 +
== A02:2021 - Broken Authentication ==
 +
See [[ZK_Developer's_Reference/Security_Tips/OWASP_Top_10_Security_Concerns_In_2017#A02-Broken_Authentication|OWASP Top 10 Security Concerns In 2017#A02 - Broken Authentication]]
 +
 
 +
== A03:2021 - Sensitive Data Exposure ==
 +
See [[ZK_Developer's_Reference/Security_Tips/OWASP_Top_10_Security_Concerns_In_2017#A03-Sensitive_Data_Exposure|OWASP Top 10 Security Concerns In 2017#A03 - Sensitive Data Exposure]]
  
 
== A04:2021 - Insecure Design ==
 
== A04:2021 - Insecure Design ==
 
ZK 10.0.0 addresses insecure design through several security enhancements, reinforcing the framework's defense against potential threats:
 
ZK 10.0.0 addresses insecure design through several security enhancements, reinforcing the framework's defense against potential threats:
−
* '''Stricter GET/POST Handling''': To prevent HTTP verb tampering attacks, ZK 10.0.0 has refined how GET and POST requests are processed. It now returns a 404 error if an Asynchronous Update (AU) request is incorrectly sent via GET, ensuring proper usage of HTTP methods.
+
* '''Stricter GET/POST Handling''': ZK 10.0.0 has refined how GET and POST requests are processed to prevent HTTP verb tampering attacks.
−
* '''Enhanced Security Framework''': ZK 10.0.0 integrates three advanced security checks into our CI/CD process:
+
* '''Enhanced Security Framework''': Includes Synk Scanning, CodeQL PR Scanning, and SonarCube to analyze and protect the codebase.
−
** '''Synk Scanning''': This tool analyzes both source code and third-party dependencies for vulnerabilities.
+
* '''Enable InaccessibleWidgetBlockService by Default''': Blocks requests from inaccessible widgets enhancing security by preventing interactions with UI components that should not be accessible.
−
** '''CodeQL PR Scanning''': It assesses pull requests for Java, JavaScript, and TypeScript to find security flaws before they are merged.
+
 
−
** '''SonarCube''': It scans the source code comprehensively to identify bugs, vulnerabilities, and security risks.
+
== A05:2021 - Security Misconfiguration ==
−
* '''Enable InaccessibleWidgetBlockService by Default''': In ZK 10.0.0, the InaccessibleWidgetBlockService, which blocks requests from inaccessible widgets, is enabled by default. This feature enhances security by preventing interactions with UI components that should not be accessible, such as disabled or hidden components.
+
See [[ZK_Developer's_Reference/Security_Tips/OWASP_Top_10_Security_Concerns_In_2017#A05-Security_Misconfiguration|OWASP Top 10 Security Concerns In 2017#A05 - Security Misconfiguration]]
 +
 
 +
== A06:2021 - Vulnerable and Outdated Components ==
 +
See [[ZK_Developer's_Reference/Security_Tips/OWASP_Top_10_Security_Concerns_In_2017#A06-Vulnerable_and_Outdated_Components|OWASP Top 10 Security Concerns In 2017#A06 - Vulnerable and Outdated Components]]
 +
 
 +
== A07:2021 - Identification and Authentication Failures ==
 +
See [[ZK_Developer's_Reference/Security_Tips/OWASP_Top_10_Security_Concerns_In_2017#A07-Identification_and_Authentication_Failures|OWASP Top 10 Security Concerns In 2017#A07 - Identification and Authentication Failures]]
  
 
== A08:2021 - Software and Data Integrity Failures ==
 
== A08:2021 - Software and Data Integrity Failures ==
−
While the ZK Framework itself does not manage software and data integrity directly, it is recommended that applications leveraging ZK implement appropriate controls. This includes the use of secure build pipelines, artifact verification, and runtime protection mechanisms to ensure data integrity throughout the application lifecycle.
+
Software and data integrity failures are not directly addressed by the ZK framework. Developers should implement secure build pipelines and runtime protections.
 +
 
 +
== A09:2021 - Security Logging and Monitoring Failures ==
 +
See [[ZK_Developer's_Reference/Security_Tips/OWASP_Top_10_Security_Concerns_In_2017#A09-Security_Logging_and_Monitoring_Failures|OWASP Top 10 Security Concerns In 2017#A09 - Security Logging and Monitoring Failures]]
  
 
== A10:2021 - Server-Side Request Forgery (SSRF) ==
 
== A10:2021 - Server-Side Request Forgery (SSRF) ==
−
While ZK Framework itself does not provide specific mechanisms for making server-side requests, it is essential for developers using ZK to be vigilant about SSRF risks. The responsibility to prevent SSRF lies with application developers who must ensure safe handling of URLs and external resources. They should employ strict input validation, use allowlisting for accessible internal systems, and be cautious with the exposure of HTTP endpoints. Ensuring that all server-side requests, particularly those calling Java APIs directly, are secure against SSRF attacks is crucial for maintaining application security.
+
While ZK Framework itself does not provide specific mechanisms for making server-side requests, developers need to ensure safe handling of URLs and external resources, employing strict input validation and allowlisting accessible internal systems.

Revision as of 05:03, 14 May 2024

OWASP Top 10 Security Concerns In 2021

This page details the OWASP Top 10 security risks for 2021 as they pertain to the ZK framework. For risks that continue from the 2017 list, links are provided to the original explanations, with updates and new risks detailed directly on this page.

A01:2021 - Injection

See OWASP Top 10 Security Concerns In 2017#A01 - Injection

A02:2021 - Broken Authentication

See OWASP Top 10 Security Concerns In 2017#A02 - Broken Authentication

A03:2021 - Sensitive Data Exposure

See OWASP Top 10 Security Concerns In 2017#A03 - Sensitive Data Exposure

A04:2021 - Insecure Design

ZK 10.0.0 addresses insecure design through several security enhancements, reinforcing the framework's defense against potential threats:

  • Stricter GET/POST Handling: ZK 10.0.0 has refined how GET and POST requests are processed to prevent HTTP verb tampering attacks.
  • Enhanced Security Framework: Includes Synk Scanning, CodeQL PR Scanning, and SonarCube to analyze and protect the codebase.
  • Enable InaccessibleWidgetBlockService by Default: Blocks requests from inaccessible widgets enhancing security by preventing interactions with UI components that should not be accessible.

A05:2021 - Security Misconfiguration

See OWASP Top 10 Security Concerns In 2017#A05 - Security Misconfiguration

A06:2021 - Vulnerable and Outdated Components

See OWASP Top 10 Security Concerns In 2017#A06 - Vulnerable and Outdated Components

A07:2021 - Identification and Authentication Failures

See OWASP Top 10 Security Concerns In 2017#A07 - Identification and Authentication Failures

A08:2021 - Software and Data Integrity Failures

Software and data integrity failures are not directly addressed by the ZK framework. Developers should implement secure build pipelines and runtime protections.

A09:2021 - Security Logging and Monitoring Failures

See OWASP Top 10 Security Concerns In 2017#A09 - Security Logging and Monitoring Failures

A10:2021 - Server-Side Request Forgery (SSRF)

While ZK Framework itself does not provide specific mechanisms for making server-side requests, developers need to ensure safe handling of URLs and external resources, employing strict input validation and allowlisting accessible internal systems.

Retrieved from "https://www.zkoss.org/_w/index.php?title=OWASP_Top10:2021&oldid=57159"