|
1 | | -# OWASP Enterprise Security API (ESAPI) |
| 1 | +# DEPRECATED - OWASP Enterprise Security API for JavaScript (ESAPI-JS) |
2 | 2 |
|
3 | | -[](https://travis-ci.org/ESAPI/owasp-esapi-js) |
| 3 | +[](http://unmaintained.tech/) |
4 | 4 |
|
5 | 5 | This file is part of the Open Web Application Security Project (OWASP) |
6 | 6 | Enterprise Security API (ESAPI) project. For details, please see |
7 | | -http://www.owasp.org/index.php/ESAPI. |
| 7 | +[https://owasp.org/www-project-enterprise-security-api/](https://owasp.org/www-project-enterprise-security-api/). |
8 | 8 |
|
9 | 9 | Copyright (c) 2008 - The OWASP Foundation |
10 | 10 |
|
11 | 11 | The ESAPI is published by OWASP under the BSD license. You should read and accept the |
12 | 12 | LICENSE before you use, modify, and/or redistribute this software. |
13 | 13 |
|
14 | | -ESAPI |
15 | 14 |
|
16 | | -## Installation |
| 15 | +## WARNING: This project is deprecated and unmaintainted. Use at your own risk. |
| 16 | +This project is no longer supported. It is known to be potentially affected by a |
| 17 | +vulnerability in 'bower' (specifically, CVE-2019-5484). This vulnerability could |
| 18 | +be addressed by upgrading ESAPI-JS to use bower 1.8.8 or later, however this has |
| 19 | +been tried and resulted in deployment problems when using NPM. See the ensuing |
| 20 | +discussion for [PR#29](https://github.com/ESAPI/owasp-esapi-js/pull/29) for |
| 21 | +details. |
| 22 | + |
| 23 | +### Potential Alternatives to ESAPI-JS (aka, ESAPI4JS) |
| 24 | +* [node-esapi](https://github.com/ESAPI/node-esapi/) - a minimal port of ESAPI-JS' output encoder |
| 25 | + that does not depend on bower and as of this writing (2021-03-30), has no |
| 26 | + known vulnerabilities. It does not include the validator or other portions of ESAPI-JS. |
| 27 | +* [DOMPurify](https://github.com/cure53/DOMPurify/) - a DOM-only, XSS sanitizer for HTML, MathML, and SVG. |
| 28 | +* Lots of additional alternatives if your project is not pure JavaScript. |
| 29 | + |
| 30 | +### Looking for Maintainers |
| 31 | +If you would like to support project, please contact one or both of the ESAPI project |
| 32 | +leaders listed on the [OWASP ESAPI wiki page](https://owasp.org/www-project-enterprise-security-api/). |
| 33 | +They can unarchive it for you. |
| 34 | + |
| 35 | +## Installation Instructions |
17 | 36 |
|
18 | 37 | ``` |
19 | 38 | $ npm install --save-dev ESAPI-JS |
20 | 39 | ``` |
21 | 40 |
|
22 | | -Installation: |
| 41 | +### Installation: |
23 | 42 | 1. Download the distribution zip from http://owasp-esapi-js.googlecode.com |
24 | 43 | 2. Unzip the distribution zip |
25 | 44 | 3. Create a directory on your server, under the web root called esapi4js |
|
0 commit comments