Where is the ESAPI.properties file? (Doc ID 1630555.1)

Last updated on MARCH 09, 2023

Applies to:

Goal

According to http://docs.oracle.com/cd/E29542_01/doc.1111/e29636/sites_security.htm#CDDFGEBJ

"The Sites server employs the Enterprise Security API to check for and prevent security vulnerabilities that may occur from injection of malicious web data. The validation can be customized to meet tighter control over the content of HTTP headers and incoming data. The validation expressions contained in the ESAPI.properties file can be modified; this file is included when you install the Sites server. This file resides in the Sites WEB-INF/classes folder.

Further information about ESAPI is available at the following link: https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API"


1) According to the statement above, ESAPI.properties can be customized , but where is this file ? It is not in WEB-INF/Classes folder as the documentation says.
2) Is the product bringing two APIs for the same purpose , "antysami" and ESAPI ??
 

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.