This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Chapters Assigned"
From OWASP
(→Design review) |
(→Examples by Vulnerability) |
||
| Line 14: | Line 14: | ||
==Examples by Vulnerability== | ==Examples by Vulnerability== | ||
| − | #Reviewing Code for Buffer Overruns and Overflows | + | #Reviewing Code for Buffer Overruns and Overflows - 70% |
| − | #Reviewing Code for OS Injection | + | #Reviewing Code for OS Injection - 70% |
| − | #Reviewing Code for SQL Injection | + | #Reviewing Code for SQL Injection - 70% |
| − | #Reviewing Code for Data Validation | + | #Reviewing Code for Data Validation - 70% |
| − | #Reviewing Code for Error Handling | + | #Reviewing Code for Error Handling - 70% |
| − | #Reviewing Code for Logging Issues | + | #Reviewing Code for Logging Issues - 70% |
| − | #Reviewing The Secure Code Environment | + | #Reviewing The Secure Code Environment - E Keary |
| − | #Transaction Analysis | + | #Transaction Analysis - E Keary |
| − | #Authorization | + | #Authorization (Currently linked to "The Development Guide") |
#Authentication (Code review) | #Authentication (Code review) | ||
#Session Integrity | #Session Integrity | ||
#Cross Site Request Forgery | #Cross Site Request Forgery | ||
| − | #Cryptography | + | #Cryptography (Currently linked to "The Development Guide") |
#Dangerous HTTP Methods | #Dangerous HTTP Methods | ||
#Race Conditions | #Race Conditions | ||
Revision as of 15:32, 11 January 2007
Methodology
- Code Review Introduction
- Steps and Roles
- Code Review Processes
Design review
- Designing for security
- - M Roxberry(.NET)
- - (Java)
- - PHP
- - C/C++
- - MySQL
Examples by Vulnerability
- Reviewing Code for Buffer Overruns and Overflows - 70%
- Reviewing Code for OS Injection - 70%
- Reviewing Code for SQL Injection - 70%
- Reviewing Code for Data Validation - 70%
- Reviewing Code for Error Handling - 70%
- Reviewing Code for Logging Issues - 70%
- Reviewing The Secure Code Environment - E Keary
- Transaction Analysis - E Keary
- Authorization (Currently linked to "The Development Guide")
- Authentication (Code review)
- Session Integrity
- Cross Site Request Forgery
- Cryptography (Currently linked to "The Development Guide")
- Dangerous HTTP Methods
- Race Conditions
Language specific best practice
Java
- Inner classes
- Class comparison
- Cloneable classes
- Serializable classes
- Package scope and encapsulation
- Mutable objects
- Private methods & circumvention
.NET
PHP
Automating Code Reviews
- Preface
- Reasons for using automated tools
- Education and cultural change
- Tool Deployment Model
