SpoC 007 - Code review Project - Revision history

EoinKeary at 20:53, 6 November 2007

2007-11-06T20:53:50Z

EoinKeary at 09:07, 17 October 2007

2007-10-17T09:07:39Z

EoinKeary: /* Objectives and Deliverables */

2007-10-17T09:07:04Z

‎Objectives and Deliverables

Pauloc at 17:48, 6 August 2007

2007-08-06T17:48:35Z

Pauloc at 11:21, 13 July 2007

2007-07-13T11:21:03Z

Pauloc at 11:20, 13 July 2007

2007-07-13T11:20:05Z

EoinKeary at 15:17, 12 July 2007

2007-07-12T15:17:42Z

EoinKeary: New page: ===Progress== 12/7/2007 (Dublin Ireland) Getting there. Not many volunteers as we had for the testing guide. The more practical stuff is being covered at the moment such as how to actually...

2007-07-12T15:16:59Z

New page: ===Progress== 12/7/2007 (Dublin Ireland) Getting there. Not many volunteers as we had for the testing guide. The more practical stuff is being covered at the moment such as how to actually...

New page

===Progress==
12/7/2007 (Dublin Ireland)
Getting there. Not many volunteers as we had for the testing guide.
The more practical stuff is being covered at the moment such as how to actually do a code review. Keywords to look for when getting familiar with the code and identifying inputs and outputs.
The Java comon mistakes section is going alright also.
Hope to finish this by end of the summer but may be September/October.

@@ Line 6: / Line 6: @@
 '''Project coordinator''': Dinis Cruz
-'''Project Progress''': 80% Complete, [[SpoC 007 - Code Review Project - Progress Page|Progress Page]]
+'''Project Progress''': 99.9% Complete, [[SpoC 007 - Code Review Project - Progress Page|Progress Page]]
 ==  Eoin Keary - Code review Project ==

@@ Line 6: / Line 6: @@
 '''Project coordinator''': Dinis Cruz
-'''Project Progress''': 50% Complete, [[SpoC 007 - Code Review Project - Progress Page|Progress Page]]
+'''Project Progress''': 80% Complete, [[SpoC 007 - Code Review Project - Progress Page|Progress Page]]
 ==  Eoin Keary - Code review Project ==

@@ Line 37: / Line 37: @@
                  + .NET
                  + PHP
                  + C/C++
@@ Line 60: / Line 58: @@
 The areas of code are structured giving a brief explanation, the anti-pattern (vulnerable pattern to look for) and a suggested fix.
 === Why I should be sponsored for the project ===

@@ Line 6: / Line 6: @@
 '''Project coordinator''': Dinis Cruz
-'''Project Progress''': 25% Complete, [[SpoC 007 - Code Review Project - Progress Page|Progress Page]]
+'''Project Progress''': 50% Complete, [[SpoC 007 - Code Review Project - Progress Page|Progress Page]]
 ==  Eoin Keary - Code review Project ==

← Older revision		Revision as of 11:21, 13 July 2007
Line 73:		Line 73:

	'''[http://www.owasp.org/index.php/OWASP_Spring_Of_Code_2007_Selection Back to SpoC 007 Selection page]'''		'''[http://www.owasp.org/index.php/OWASP_Spring_Of_Code_2007_Selection Back to SpoC 007 Selection page]'''
−
−
−
−
−
−	~~==Progress==~~
−	~~12/7/2007 (Dublin Ireland)~~
−	~~Getting there. Not as many volunteers as we had for the testing guide.~~
−	~~The more practical stuff is being covered at the moment such as how to actually do a code review. Keywords to look for when getting familiar with the code and identifying inputs and outputs.~~
−	~~The Java comon mistakes section is going alright also.~~
−	~~Hope to finish this by end of the summer but may be September/October.~~

← Older revision		Revision as of 11:20, 13 July 2007
Line 1:		Line 1:
		+	'''[http://www.owasp.org/index.php/OWASP_Spring_Of_Code_2007_Selection Back to SpoC 007 Selection page]'''
		+
		+
		+	'''AoC Candidate''': Eoin Keary
		+
		+	'''Project coordinator''': Dinis Cruz
		+
		+	'''Project Progress''': 25% Complete, [[SpoC 007 - Code Review Project - Progress Page\|Progress Page]]
		+
		+	== Eoin Keary - Code review Project ==
		+
		+	=== Executive Summary ===
		+
		+	I am proposing that I complete the OWASP Code review guide during this period. The code review guide was started by me in 2005 and has much information on reviewing code for common vulnerabilities. It is frequently accessed (looking at the stats on the OWASP site) and therefore is useful to practitioners.
		+
		+	I believe the code review guide is an integral part of the OWASP BOK (Body of Knowledge). Ensuring secure development is key to secure applications and code review is of paramount importance in this domain.
		+
		+	There are many sections still to be added and more to be readjusted and rewritten to reflect the current state of the security world. Much needs to be written on Web 2.0 technologies and distributed B2B technologies such as Webservices.
		+
		+	The Code review process and procedure needs also to be covered. A guide to establishing a mature code review process also needs to be done. Code review methodologies also need to be discussed.
		+
		+	=== Objectives and Deliverables ===
		+
		+	Update of the code review guide:
		+	* Add additional areas relating to the code review process such as:
		+	o Benefits and pitfalls
		+	o Methodology
		+	o The code review process
		+	+ Transactional analysis
		+	+ Managing the code review process
		+	+ Assigning risk to findings
		+
		+	*
		+	o Technical guides
		+	+ Language specific best practice
		+	+ Java
		+	+ .NET
		+	+ PHP
		+	+ MySQL
		+	+ Stored Procs
		+	+ C/C++
		+
		+	*
		+	o Code review by vulnerability:
		+	+ Reviewing Code for Buffer Overruns and Overflows
		+	+ Reviewing Code for OS Injection
		+	+ Reviewing Code for SQL Injection
		+	+ Reviewing Code for Data Validation
		+	+ Reviewing code for XSS issues
		+	+ Reviewing Code for Error Handling
		+	+ Reviewing Code for Logging Issues
		+	+ Reviewing The Secure Code Environment
		+	+ Reviewing code for Authorization Issues
		+	+ Reviewing code for Authentication Issues
		+	+ Reviewing code for Session Integrity
		+	+ Reviewing code for Cross Site Request Forgery
		+	+ Reviewing code for Cryptography implementation issues
		+	+ Reviewing code Dangerous HTTP Methods (Deployment)
		+	+ Race Conditions
		+
		+	The areas of code are structured giving a brief explanation, the anti-pattern (vulnerable pattern to look for) and a suggested fix.
		+
		+
		+	=== Why I should be sponsored for the project ===
		+
		+	I used to head up the code review team as part of the application security group in fidelity investments and have 5+ years of the secure code review process. I also was the lead of the Testing guide until V2 was published via the Autumn of Code.
		+
		+	I have always delivered any work I have volunteered for on time.
		+
		+	I have been involved in OWASP projects for 2/3 years now and have always been an active contributor.
		+
		+
		+
		+	'''[http://www.owasp.org/index.php/OWASP_Spring_Of_Code_2007_Selection Back to SpoC 007 Selection page]'''
		+
		+
		+
		+
		+
	==Progress==		==Progress==
	12/7/2007 (Dublin Ireland)		12/7/2007 (Dublin Ireland)

@@ Line 1: / Line 1: @@
-===Progress==
+==Progress==
 /7/2007 (Dublin Ireland)
-Getting there. Not many volunteers as we had for the testing guide.
+Getting there. Not as many volunteers as we had for the testing guide.
 The more practical stuff is being covered at the moment such as how to actually do a code review. Keywords to look for when getting familiar with the code and identifying inputs and outputs.
 The Java comon mistakes section is going alright also.
 Hope to finish this by end of the summer but may be September/October.