Traditional programming libraries, while powerful, were not designed with modern security considerations. They rely on outdated assumptions:
These assumptions fail in server environments:
To bridge the gap between traditional base-level constructs and secure task-oriented constructs, OWASP-Untrust proposes a paradigm shift. This involves creating bounded, validated types that enforce security policies at the language level, ensuring safe usage patterns.
OWASP-Untrust will provide secure alternatives to commonly misused or risky programming constructs. The core idea is to replace unbounded, permissive types with restricted, secure types that validate their content at creation. Classic Type|Secure Alternative|Example Use Case Path|BoxedPath|Secure file system operations confined to a sandbox. String|BoundedString|Strings with length and content restrictions. int or Integer|BoundedInteger|Integer values bounded by a safe range. File Name (String)|Filename|Validates acceptable characters for file names. String (free text)|FreeText|Ensures safe characters for freeform text. String (user input)|UserName|Enforces length and character restrictions.
Classic Path assumes full system access, whereas BoxedPath confines operations to a sandbox.
// Classic Path
Path unrestrictedPath = Path.of("/sensitive/system/file.txt");
// Secure BoxedPath
SandboxPath sandbox = SandboxPath.boxroot("/sandbox/root");
BoxedPath securePath = sandbox.of("file.txt");
Any attempt to escape the sandbox with BoxedPath results in a SecurityException.
Classic strings allow any content, which can introduce injection vulnerabilities. FreeText restricts input to safe characters and enforces length constraints.
Example: Task Descriptions
// Classic String
String taskDescription = "Execute this task!\n";
// Secure FreeText
TaskDescription description = new TaskDescription("Execute this task!");
Attempts to include unsafe characters like
Classic filenames lack validation, leading to vulnerabilities with unsafe characters or malformed names. Filename enforces allowed characters and length constraints.
// Classic Filename
String filename = "../../../../etc/passwd";
// Secure Filename
Filename secureFilename = new Filename("user-data.txt");
If the filename contains invalid characters (e.g., /), a TypeValidationException is thrown.
Unbounded integers can lead to overflows or logical errors. Times ensures integer values remain within a valid range.
// Classic Integer
int times = -5; // Invalid value
// Secure Bounded Integer
Times validTimes = Times.from(10); // Enforces range [1, 100]
Values outside the defined range trigger a TypeValidationException.
OWASP-Untrust’s goal is to systematically replace risky constructs across all domains:
By adopting OWASP-Untrust, developers gain tools to create inherently secure applications, protecting against common classes of vulnerabilities at the core of the programming model.
Corporate Supporters
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
Quick Links
Legal & Governance
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.