owasp-input-api-developers

Re: [Owasp-input-api-developers] Status?

[<Chr...@ey...>]

Nathan,

No problem.  Have there been off-line discussions?  I noticed some files 
have been put into CVS, but they're all zero length, and I wasn't sure 
what that meant.  Basically, I have some ideas I'd like to share with the 
group, but I wanted to know to what extent anything had been "decided" 
already.

Sincerest Regards,
Chris Todd
Ernst & Young LLP
Security and Technology Solutions (STS)
chr...@ey...





vertigo <ve...@pa...>
Sent by: owa...@li...
04/02/2002 08:43 AM

 
        To:     Christopher Todd <ch...@ch...>
        cc:     owa...@li...
        Subject:        Re: [Owasp-input-api-developers] Status?


You're our first post.  I apologize for the delay.  Not all of the
developers have subscribed yet so there hasn't been much traffic.

Nathan



On Thu, 28 Mar 2002, Christopher Todd wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hello everyone,
>
> Just wanted to find out the about current status of the input filters
> project.  I'm interested in contributing, though I need to confirm
> with my employer first that they don't have a problem with that
> (confidentiality agreement stuff).
>
> Regards,
> Chris
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com>
>
> iQA/AwUBPKPS1g1yj8e2/NpyEQILsACeJ4M6WImSS4RYSdB0QP6G0o4PgZUAoLpX
> dDRqI9MDjeg88Q1JbTIaeJfa
> =VTvS
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> Owasp-input-api-developers mailing list
> Owa...@li...
> https://lists.sourceforge.net/lists/listinfo/owasp-input-api-developers
>


_______________________________________________
Owasp-input-api-developers mailing list
Owa...@li...
https://lists.sourceforge.net/lists/listinfo/owasp-input-api-developers


The information contained in this message may be privileged and confidential and protected from disclosure.  If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer.  Thank you.  Ernst & Young LLP

RE: [Owasp-input-api-developers] Status?

[Christopher T. <ch...@ch...>]

Has there been any discussion of writing an Apache module (for the webserver
plugin approach)?  That would cover a lot of web app engine ground,
including PHP, PERL, ChiliASP, and even Java (with JServ/Tomcat apache
plugins).

Regards,
Chris

-----Original Message-----
From: owa...@li...
[mailto:owa...@li...]On Behalf
Of Steven J. Sobol
Sent: Tuesday, April 02, 2002 12:01 PM
To: Nik Cubrilovic
Cc: owa...@li...
Subject: Re: [Owasp-input-api-developers] Status?


On Wed, 3 Apr 2002, Nik Cubrilovic wrote:

>
> ditto.
>
> anybody else here looking at PHP/ASP specific implementations of this
> project?

PHP is the reason I signed on. I can also do ASP. But ASP programming
is just something that pays the bills for me. PHP programming is my
passion. :) (And it pays some of the bills too.)

I was also considering doing server-side extensions. That'd mean
a Zend/PHP module for PHP4, and probably an ActiveX control for ASP (at
least on Wintendo; I imagine ChiliASP on Linux and Solaris have no way
to use ActiveX.)

--
Steve Sobol, CTO (Server Guru, Network Janitor and Head Geek)
JustThe.net LLC, Mentor On The Lake, OH  888.480.4NET   http://JustThe.net
Need a programmer? Resume going up at
http://sourceforge.net/users/webdude216



_______________________________________________
Owasp-input-api-developers mailing list
Owa...@li...
https://lists.sourceforge.net/lists/listinfo/owasp-input-api-developers

RE: [Owasp-input-api-developers] Status?

[Steven J. S. <sj...@Ju...>]

On Tue, 2 Apr 2002, Christopher Todd wrote:

> Has there been any discussion of writing an Apache module (for the webserver
> plugin approach)?  That would cover a lot of web app engine ground,
> including PHP, PERL, ChiliASP, and even Java (with JServ/Tomcat apache
> plugins).

I'm not sure how we'd manage that. With a $LANGUAGE plugin or module you
can use $LANGUAGE-specific functions to manipulate data. With an Apache
API/NSAPI/ISAPI server module you'd have to do everything before the
scripting engine - whether it be PHP, JSP, ASP or anything else - would
have a chance to touch the data, and it would allow MUCH less flexibility.
My vision for this project is that we want to empower people to write more
secure web applications. I don't think a server module is the best way to
do that. I know it'll be more work, but my opinion is that the best thing
to do is to create modules for the most popular scripting platforms.

Just my $0.02...

-- 
Steve Sobol, CTO (Server Guru, Network Janitor and Head Geek)
JustThe.net LLC, Mentor On The Lake, OH  888.480.4NET   http://JustThe.net
Need a programmer? Resume going up at http://sourceforge.net/users/webdude216