Add links for Java Encoder and Java HTML Sanitizer #184
Conversation
Added recommended secure libraries from OWASP to the documentation.
There was a problem hiding this comment.
Pull request overview
This PR adds references to two OWASP Java security libraries (Java Encoder and Java HTML Sanitizer) to the Secure Libraries documentation by creating a new "Recommended Secure Libraries (OWASP Projects)" section in the index page.
Changes:
- Added a new section header and bullet list to the secure libraries index page with direct links to the OWASP Java Encoder and Java HTML Sanitizer project pages
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - **OWASP Java Encoder** – https://owasp.org/www-project-java-encoder/ | ||
| - **OWASP Java HTML Sanitizer** – https://owasp.org/www-project-java-html-sanitizer/ |
There was a problem hiding this comment.
The documentation uses markdown reference-style links consistently throughout (see lines 23-25 for examples). Direct URLs should be converted to reference-style links following the pattern used elsewhere in the file. For example, define [java-encoder] and [java-sanitizer] at the bottom of the file and use them in the list items.
| ## Recommended Secure Libraries (OWASP Projects) | ||
|
|
||
| - **OWASP Java Encoder** – https://owasp.org/www-project-java-encoder/ | ||
| - **OWASP Java HTML Sanitizer** – https://owasp.org/www-project-java-html-sanitizer/ | ||
|
|
There was a problem hiding this comment.
This section presents libraries differently from the established pattern in this documentation. Other libraries (ESAPI, CSRFGuard, OSHP) have dedicated pages with detailed sections explaining 'What is it?', 'Why use it?', and 'How to use it?'. Consider either creating dedicated pages for these libraries following the same pattern, or removing this section since these libraries are already mentioned in the ESAPI page (line 27-28 of 01-esapi.md) as alternatives.
| ## Recommended Secure Libraries (OWASP Projects) | |
| - **OWASP Java Encoder** – https://owasp.org/www-project-java-encoder/ | |
| - **OWASP Java HTML Sanitizer** – https://owasp.org/www-project-java-html-sanitizer/ |
| within the SAMM [Security Architecture][sammdsa] security practice | ||
| which in turn is part of the [Design][sammd] business function. | ||
|
|
||
| ## Recommended Secure Libraries (OWASP Projects) |
There was a problem hiding this comment.
The section title 'Recommended Secure Libraries (OWASP Projects)' is ambiguous since all libraries in this section (ESAPI, CSRFGuard, OSHP) are OWASP projects. Consider a more specific title that clarifies this is a quick reference list, or reconsider whether a separate section is needed given that dedicated pages exist for other libraries.
| ## Recommended Secure Libraries (OWASP Projects) | |
| ## Quick Reference: OWASP Secure Libraries |
|
Please follow the contributing guidelines for the Developer Guide |
2 participants
Fixes #181
Added links to OWASP Java Encoder and OWASP Java HTML Sanitizer in the secure libraries section, as suggested by maintainers.
Summary
Adds references to two OWASP secure libraries to improve discoverability.
Description for the changelog
Add links to OWASP Java Encoder and Java HTML Sanitizer.
Declaration
Other info
N/A