View source for Summer Of Code 2008 Index of Tasks Assigned

[[OWASP Code Review Guide Table of Contents]]__TOC__
 Methodology<br>

Code Review Introduction|Introduction<br>
Steps and Roles<br>
Code Review Processes<br>
Transaction Analysis<b> Want to update</b><br>
How to write an application_security finding<br>
Application Threat Modeling<b> NEW-Author Name:<Add Here> </b><br>
Marco Morana

The Round Trip Code Review<b> NEW-Author Name:<Add Here> </b><br>
Code review Metrics<b> NEW-Author Name:<Add Here> </b><br>
Allison Shubert

 Crawling Code<br>
Introduction<br>
First sweep of the code base<br>


 Examples by Vulnerability<br>
<b> The Following sections need to be updated. Extra examples of good and bad code needed. Diagrams and flows regarding solutions. Additional vulnerabilities to be added also</b><br>
Reviewing Code for Buffer Overruns and Overflows<br>
Reviewing Code for OS Injection<br>
Reviewing Code for SQL Injection<br>
Reviewing Code for Data Validation<br>
Reviewing code for XSS issues<br>
Reviewing code for Cross-Site Request Forgery issues<br>
Reviewing Code for Error Handling<br>
Reviewing Code for Logging Issues<br>
Reviewing The Secure Code Environment<br> 
Reviewing Code for Authorization Issues<br>
Reviewing Code for Authentication<br>
Reviewing Code for Session Integrity issues<br>
Reviewing Cryptographic Code<br>
Reviewing Code for Race Conditions<br>

 Language specific best practice <br>

Java<br>
Java gotchas<br>
Java leading security practice<br>

PHP<br>
PHP Security Leading Practice<br>

C/C++<br>
Strings and Integers<br>

MySQL<br>
Reviewing MySQL Security<br>

<b>Need to Update and add additional examples and text</b><br>
Rich Internet Applications<br>
Flash Applications<br>
AJAX Applications<br>
Web Services<br>

 Example reports <br>
How to write<b> NEW-Author Name:<Add Here> </b><br>
How to determine the risk level of a finding<b> NEW-Author Name:<Add Here> </b><br>
Sample form<b> NEW-Author Name:<Add Here> </b><br>

 Automating Code Reviews<br>
Preface <br>
Reasons for using automated tools<br>
Education and cultural change<br>
Tool Deployment Model<br>
Code Auditor Workbench Tool<br>
The Owasp Orizon Framework: <b>Paolo Perego &lt;thesp0nge@owasp.org&gt;</b><br>
 
 Owasp Code Review Guide Top 10 <b>Paolo Perego &lt;thesp0nge@owasp.org&gt;</b><br>

 Owasp Code Review Source scoring system <b>Paolo Perego &lt;thesp0nge@owasp.org&gt;</b>
(checks how to help Eoin with source code metrics evaluation in order to create a standard scoring system for sources)


 Ways to achieve secure code on a budget<br>
The OWASP Enterprise Security API ( ESAPI)<b> NEW-Author Name:<Add Here> </b><br>
Resource & Budget<b> NEW-Author Name:<Add Here> </b><br>


References<br>