[OWASP-ESAPI] Can ConfigurationException be moved to a different ESAPI package?

Kevin W. Wall kevin.w.wall at gmail.com
Sun Aug 9 20:36:11 EDT 2009

Anyone have any objections if, for OWASP ESAPI 2.0, I were to move


to the		org.owasp.esapi.errors		package where
most of the other exception classes reside? I have a few contexts
in some new code I am adding where this exception would be
useful beyond its use just for WAF and I'd hate to have a second

How many have code that doing this might break? If there's a lot,
I'm considering adding a new exception class called


and then changing

	org.owasp.esapi.waf.ConfigurationException to extend

org.owasp.esapi.errors.ConfigurationException rather than java.lang.Exception
and then mark the WAF ConfigurationException class as deprecated in order
to keep what backward compatibility that I can.

But if there's no one that's using it and it's only use is by ESAPI
itself, I probably won't bother with the whole backward compatibility
issue as it just causes code bloat and possible confusion.

But thought I should query the ESAPI community on this one as I have no
idea how prevalent ESAPI is being used let along how frequently developers
are using org.owasp.esapi.waf.ConfigurationException in their code.


Kevin W. Wall
"The most likely way for the world to be destroyed, most experts agree,
is by accident. That's where we come in; we're computer professionals.
We cause accidents."        -- Nathaniel Borenstein, co-creator of MIME

More information about the OWASP-ESAPI mailing list