BT

HDIV 2.0: Security framework now integrates with Spring MVC and JSTL

by Ryan Slobojan on Sep 14, 2007 |

HDIV, an open-source web application security framework, recently released version 2.0. InfoQ spoke with HDIV project lead Roberto Velasco Sarasola to learn more about this release.

Sarasola described HDIV as a Java web application security framework which aims to prevent most of the common types of web application vulnerabilities, such as SQL injection, cross-site scripting, and parameter tampering. HDIV assumes that any remote HTTP client request can be an attack vector, and sets about validating that the request is not an attack of some sort - it is meant to address the gaps which exist in the validation strategies of existing frameworks:

Current web frameworks offer some validation functionalities but many times they are not enough to cover common validation needs. For example, if you have a link in your web application such as http://www.myhost.com/action1.do?account=56 to read information about the account number 56, how can you guarantee that a client doesn't update this value to be able to check someone else's account, for example account=40?

With standard security validators (more suitable for editable data validation), it's not possible to check that and you need to create custom validations. For example, including an account id at HttpSession or using user identity in the SQL executed in the database. This security problem, known as instance level security, it's very hard to solve because within a web application there are thousands of similar request that need to be validated.

Sarasola described the capabilities that HDIV provides to combat these sorts of vulnerabilities:

  • Data Integrity - HDIV guarantees that any server-generated, read-only data (e.g. hidden fields) are not edited on the client to avoid parameter tampering attacks
  • Editable Data Validation - HDIV analyzes all editable fields to remove cross-site scripting and SQL injection attacks
  • Data Confidentiality - HDIV makes non-editable data confidential by obfuscating parameter names and values, thus preventing internal data like column names or web directories from being exposed to the client
  • Detailed Attack Logging - HDIV logs information abut every attack it detects, providing information such as URL, username, IP address, and attack type

HDIV is integrated into a Java web application through the use of custom JSP tags which are substituted for the normal link and form tags. An HDIV web filter is then inserted into the application's web.xml, and validation is then automatically performed on all requests. In previous versions HDIV supported Struts 1.x and Struts 2.x, however this release now also supports Spring MVC 2.0 and JSTL. Support for these new frameworks was added by extending the Spring and JSTL tags themselves to add in the HDIV functionality - neither the core HDIV libraries nor the web filter required any changes to support them. Also, since Spring and Struts are both action-based frameworks, from HDIV's perspective they are very similar - Sarasola said the biggest challenge has been extending the framework tags themselves because extension points are poorly defined or nonexistent on the tags. He also expressed hope that framework developers would add well-defined extension points to tags to enable other framework developers to integrate with them more easily.

Sarasola was also asked what the future held for HDIV, and he described a plan for webflow integration:

Currently HDIV supports three state management strategies. On the memory and hash strategies HDIV stores an object (state) at the server side for each possible request processed within a JSP (one of each link or form). From a scalability point of view it's interesting to limit the size of the server side cache. In the current release it's possible to define a maximum cache size but many times it's difficult to define an appropriate number because it depends on the application.

We thought about Webflow to solve this problem, because it provides a way to logically divide clients navigation. Thus, HDIV will use webflow listeners capabilities to decide when to delete objects from the cache.

Another interesting feature it's to add automatically the webflow execution key to each link or form using HDIV's custom tags. Now within Struts, Struts 2 and Spring MVC applications we have to add this id manually and we would like to automatize this task.

He also indicated that support for WebWork, Stripes and JSF are planned.

Hello stranger!

You need to Register an InfoQ account or or login to post comments. But there's so much more behind being registered.

Get the most out of the InfoQ experience.

Tell us what you think

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread
Community comments

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Discuss

Educational Content

General Feedback
Bugs
Advertising
Editorial
InfoQ.com and all content copyright © 2006-2014 C4Media Inc. InfoQ.com hosted at Contegix, the best ISP we've ever worked with.
Privacy policy
BT