1.6. Criterion-based mapping of guideline

Caution

This version is already obsolete. Please check the latest guideline.

The chapter 4 of this guideline is structured functionality wise. This section shows a mapping from a point of view other than functionality. It indicates which part of guideline contains which type of content.

1.6.1. Mapping based on security measures

Using OWASP Top 10 for 2013 as an axis, links to explanation of functionalities related to security have been given

No.	Item Name	Correcsponding Guideline
A1	Injection SQL Injection	[coming soon] Database Access (JPA) [coming soon] Database Access (MyBatis2) (Details about using bind variable at the time of placeholders for query parameters)
A1	Injection XXE(XML External Entity) Injection	[coming soon] Ajax
A2	Broken Authentication and Session Management	[coming soon] Authentication
A3	Cross-Site Scripting (XSS)	XSS Countermeasures
A4	Insecure Direct Object References	No mention in particular
A5	Security Misconfiguration	[coming soon] Logging(Mention about message contents of log) Method to display system exception code on screen(Mention about message output at the time of system exception)
A6	Sensitive Data Exposure	[coming soon] Property Management [coming soon] Password Hashing (Mention about password hash only)
A7	Missing Function Level Access Control	[coming soon] Authorization
A8	Cross-Site Request Forgery (CSRF)	[coming soon] CSRF(Cross Site Request Forgeries) Countermeasures
A9	Using Components with Known Vulnerabilities	No mention in particular
A10	Unvalidated Redirects and Forwards	[coming soon] Authentication(Mention about Open Redirect Vulnerability measures)