ESAPI for spring reactive

[namrta2046]

ESAPI library contains few methods like DefaultHTTPUtilities which is extending HTTPUtilities and is servlet based. Since servlet is not compatible for spring reactive, is there any plan to expose new methods for reactive stack as well?

[kwwall]

@namrta2046 - You will have to be a lot more explicit as to what methods that you would like to see exposed, and how. It is possible that one reason that we don't expose them is that we currently only require:

javax.servlet:javax.servlet-api:jar:3.1.0
javax.servlet.jsp:javax.servlet.jsp-api:jar:2.3.3

and you want something that is only in a newer version of one of these provided libraries.

If Spring Reactive (or the Spring Boot, that it uses) requires later versions of these that add some functionality that you need, we probably won't be able to provide that functionality that you are seeking. Should that be the case, your best bet is probably to extend DefaultHTTPUtilities class on your own and then change the ESAPI.HTTPUtilities property in your ESAPI.properties file to something like:

# ESAPI.HTTPUtilities=org.owasp.esapi.reference.DefaultHTTPUtilities
ESAPI.HTTPUtilities=com.yourcompany.esapi.MyAppHTTPUtilities

That will still limit you, as now you will have to use any newly added methods directly via your new class rather than through the HTTPUtilities interface, but we can't be making changes to support new Servlet API versions beyond what the minimal JDK 8 baseline supports. (Which is what we intended to support, but let us know if we got that wrong; we may have forgotten to update it when we went from Java 7 to Java 8 as the minimal baseline in ESAPI 2.4.0.0.)

Also note that depending on whether your extension of DefaultHTTPUtilities needs to access any of the private internal classes, you may or may not be able to add the functionality that you are looking for. We may consider changing the access level of those from 'private' to 'protected', but that's something that I'd want to first discuss with the core ESAPI development team.