There are more web application frameworks in existence than any person or small team is likely to have time to evaluate. This is true even if evaluation simply means reading the documentation, let alone if it means installing and testing an instance of the framework, or doing something even more comprehensive.
You, dear reader, may already be an expert in developing with one or more web frameworks. If so, then for each such framework that is available under the GPL or under a license stated by the Free Software Foundation to be compatible with the GPL version 3 or later, please provide the following four pieces of information:
- The name of the framework, linked to the framework's website (e.g. Django).
- The language in which the framework is predominantly written (e.g. Python).
- A list comprising the subset of Pollak's criteria that the framework fails to meet (except if it meets all of them, in which case please say so).
- A list comprising the subset of the OWASP Top 10 2013 items that the framework fails to protect against (except if it protects against all of them, in which case please say so).
I will up-vote and mark as "correct" the first such truthful answer, and will up-vote subsequent such truthful answers. My reason for this approach is that I am not expecting any single answer (or answerer) to be able to answer my titular question, but rather that the set of answers should over time provide an increasingly comprehensive answer to it. This will be helpful to me and to anyone else searching for evaluations of web frameworks against Pollak's criteria.
N.B. David Pollak is the creator of the Lift framework, written in Scala. I have no experience with Lift, and do not know whether it actually meets Pollak's criteria.