The Owasp Code Review Top 9 - Revision history

Jonathan Fernández: Undo revision 167442 by Jonathan Fernández (talk)

2014-02-05T17:23:10Z

Undo revision 167442 by Jonathan Fernández (talk)

Jonathan Fernández: agrega enlace a owasp top 10 project

2014-02-05T17:19:42Z

agrega enlace a owasp top 10 project

Landon Mayo at 10:42, 10 February 2012

2012-02-10T10:42:05Z

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T17:02:38Z

Added navigation to facilitate sequential reading online

KirstenS: /* Source Code Design */

2009-01-29T01:48:04Z

‎Source Code Design

KirstenS: /* Weak Session Management */

2009-01-15T22:53:03Z

‎Weak Session Management

KirstenS: /* The 9 flaw categories */

2009-01-15T22:52:48Z

‎The 9 flaw categories

KirstenS: /* Preface */

2009-01-15T22:43:03Z

‎Preface

KirstenS: The Owasp Code Review Top 10 flaw categories moved to The Owasp Code Review Top 9

2009-01-15T22:39:54Z

The Owasp Code Review Top 10 flaw categories moved to The Owasp Code Review Top 9

Rahimjina at 22:03, 26 August 2008

2008-08-26T22:03:41Z

@@ Line 12: / Line 12: @@
 In terms of source code security, source code vulnerabilities can be managed in a million ways.
-Source code vulnerabilities must reflect [[Owasp Top 10]] recommendations. Applications are made of source code , so, in some way, source code flaws can be re conducted to flaws in application.
+Source code vulnerabilities must reflect Owasp Top 10 recommendations. Applications are made of source code , so, in some way, source code flaws can be re conducted to flaws in application.
 The following family of categories are included as a default library in Owasp Orizon Project v1.0 that was released in October 2008.

@@ Line 12: / Line 12: @@
 In terms of source code security, source code vulnerabilities can be managed in a million ways.
-Source code vulnerabilities must reflect Owasp Top 10 recommendations. Applications are made of source code , so, in some way, source code flaws can be re conducted to flaws in application.
+Source code vulnerabilities must reflect [[Owasp Top 10]] recommendations. Applications are made of source code , so, in some way, source code flaws can be re conducted to flaws in application.
 The following family of categories are included as a default library in Owasp Orizon Project v1.0 that was released in October 2008.

@@ Line 47: / Line 47: @@
 === Source Code Design ===
-Security in source code starts from design, and from the choices made before starting coding using the editor you like most.
+Security in source code starts from design, and from the choices made before starting to code.
 In the source code design flaw categories, you can find security check families tied to scope and source code organization.

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
-[[Category:OWASP Code Review Project]]
+  | useprev=PrevLink | prev=The Owasp Orizon Framework | lblprev=
+  | usemain=MainLink | main=OWASP Code Review Guide Table of Contents | lblmain=Table of Contents
 == Preface ==
@@ Line 124: / Line 127: @@
 * Passing sensitive data over URL /querystring

← Older revision		Revision as of 01:48, 29 January 2009
Line 47:		Line 47:

	In the source code design flaw categories, you can find security check families tied to scope and source code organization.		In the source code design flaw categories, you can find security check families tied to scope and source code organization.
−	~~Source code design~~

	Source code design		Source code design

@@ Line 120: / Line 120: @@
 * Not issuing a new session upon successful authentication
 * Passing cookies over non SSL connections (no secure flag)
 === Using HTTP GET query strings ===

@@ Line 6: / Line 6: @@
 In this section, we will try to organize the most critical security flaws you can find during a code review in order to have a finite set of categories to evaluate the whole code review process.
-== The 9 flaw categories ==
+== The 9 Flaw Categories ==
-In term of source code security, source code vulnerabilities can be managed in million of ways.
+In terms of source code security, source code vulnerabilities can be managed in a million ways.
-Source code vulnerabilities must reflect Owasp Top 10 recommendations. Applications are made of source so, in some way source code flaws can be re conducted to flaws in application.
+Source code vulnerabilities must reflect Owasp Top 10 recommendations. Applications are made of source code , so, in some way, source code flaws can be re conducted to flaws in application.
-The following seventh family will be included as default library in Owasp Orizon Project v1.0 that will be released in October 2008.
+The following family of categories are included as a default library in Owasp Orizon Project v1.0 that was released in October 2008.
 * Input validation
 * Source code design
@@ Line 27: / Line 24: @@
 * Using HTTP GET query strings
-As you may see 3 categories out of 9 are equals to the correspondent Owasp Top 10 key point.
+As you can see 3 categories out of 9 are equivalent to the corresponding  Owasp Top 10.
-Let's go more in detail going deeper in describing the source code flaw categories.
+Let's go more in detail, going deeper in describing the source code flaw categories.
-=== Input validation ===
+=== Input Validation ===
-This flaw categories is the source code counterpart of the Owasp Top 10 A1 category.
+This flaw category is the source code counterpart of the Owasp Top 10 A1 category.
-The check's families contained in this category are all the ones tied to the missing validation of input data submitted by user and that they will reflect in a Owasp Top 10 A1 violation.
+This category contains the follow security flaw families:
-In this category the follow security flaw family are contained:
+Input validation
-* Input validation
+* Cross site scripting
-** Cross site scripting
+* SQL Injection
-** SQL Injection
+* XPATH Injection
-** XPATH Injection
+* LDAP Injection
-** LDAP Injection
+* Cross site request forgery
-** Cross site request forgery
+* Buffer overflow
-** Buffer overflow
+* Format bug
-** Format bug
-=== Source code design ===
+=== Source Code Design ===
-Security in source code starts from design and from the choices made before starting coding using the editor you like most.
+Security in source code starts from design, and from the choices made before starting coding using the editor you like most.
 In the source code design flaw categories, you can find security check families tied to scope and source code organization.
-* Source code design
+Source code design
-** Insecure field scope
+* Insecure field scope
-** Insecure method scope
+* Insecure method scope
-** Insecure class modifiers
+* Insecure class modifiers
-** Unused external references
+* Unused external references
-** Redundant code
+* Redundant code
 === Information leakage and improper error handling ===
-This category meets the correspondent Owasp Top 10 one. It will contain security check families about how source code manage errors, exception, logging and sensitive information.
+This category meets the correspondent Owasp Top 10 one. It contains security check families about how source code manage errors, exception, logging and sensitive information.
-The following families are present:
+Information leakage and improper error handling
-* Information leakage and improper error handling
+* Unhandled exception
-** Unhandled exception
+* Routine return value usage
-** Routine return value usage
+* NULL Pointer dereference
-** NULL Pointer dereference
+* Insecure logging
 === Direct object reference ===
-Also this category is the same as the one stated in the Owasp Top 10 project.
+This category is the same as the one stated in the Owasp Top 10 project. It refers to the attacker's capability to interact with application internals supplying an ad hoc crafted parameter.
 The families contained in this category are:
-* Direct object reference
-** Direct reference to database data
+Direct object reference
-** Direct reference to filesystem
+* Direct reference to database data
-** Direct reference to memory
+* Direct reference to filesystem
 === Resource usage ===
-This category is related to all the unsafe ways a source code can request operating system managed resources. Most of the vulnerability families here contained, if exploited, will result in a some kind of denial of service.
+This category is related to all the unsafe ways a source code can request operating system managed resources. Most of the vulnerability families contained here, if exploited, will result in a some kind of denial of service.
 Resources can be:
@@ Line 86: / Line 86: @@
 * network bandwidth
-Given such category, the families that can be included are:
+The families included are:
-* Resource usage
+Resource usage
-** Insecure file creation
+* Insecure file creation
-** Insecure file modifying
+* Insecure file modifying
-** Insecure file deletion
+* Insecure file deletion
-** Race condition
+* Race condition
-** Memory leak
+* Memory leak
-** Unsafe process creation
+* Unsafe process creation
 === API usage ===
-This section is about APIs provided by the system or by the framework in use that can be used in a malicious way.
+This section is about APIs provided by the system or by the framework in use that can be used in a malicious way. In this category you can find:
 * insecure database calls
 * insecure random number creation
@@ Line 105: / Line 104: @@
 === Best practices violation ===
-The last category is about all miscellaneous security violation that doesn't fit in the previous ones.
+This category is about all miscellaneous security violations that don’t fit in the previous categories. Most, but not all, of these contain warning-only source code best practices.
-Most, but not all, of these categories contain warning-only source code best practices.
+This category includes:
 * insecure memory pointer usage
-** NULL pointer dereference
+* NULL pointer dereference
-** pointer arithmetic
+* pointer arithmetic
-** variable aliasing
+* variable aliasing
 * unsafe variable initialization
 * missing comments and source code documentation
@@ Line 118: / Line 116: @@
 === Weak Session Management ===
 * Not invalidating session upon an error occurring
 * Not checking for valid sessions upon HTTP request
 === Using HTTP GET query strings ===
 * Passing sensitive data over URL /querystring

← Older revision	Revision as of 22:39, 15 January 2009
(No difference)