This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Chapters Assigned"
From OWASP
(→Examples by Vulnerability) |
|||
| (6 intermediate revisions by 2 users not shown) | |||
| Line 4: | Line 4: | ||
#Steps and Roles | #Steps and Roles | ||
#Code Review Processes | #Code Review Processes | ||
| + | #Transaction Analysis - E Keary | ||
== Design review == | == Design review == | ||
| Line 13: | Line 14: | ||
## - C++ | ## - C++ | ||
## - Andrew van der Stock (MySQL) | ## - Andrew van der Stock (MySQL) | ||
| + | ## - Mallory (AJAX) | ||
==Examples by Vulnerability== | ==Examples by Vulnerability== | ||
| − | #Reviewing Code for Buffer Overruns and Overflows - | + | #Reviewing Code for Buffer Overruns and Overflows - 100% |
| − | #Reviewing Code for OS Injection - | + | #Reviewing Code for OS Injection - 100% |
| − | #Reviewing Code for SQL Injection - | + | #Reviewing Code for SQL Injection - 100% |
| − | #Reviewing Code for Data Validation - | + | #Reviewing Code for Data Validation - - 100% |
| − | #Reviewing Code for Error Handling - | + | #Reviewing code for XSS issues - 100% |
| − | #Reviewing Code for Logging Issues - | + | #Reviewing Code for Error Handling - 100% |
| − | #Reviewing The Secure Code Environment - | + | #Reviewing Code for Logging Issues - 100% |
| − | + | #Reviewing The Secure Code Environment - 100% | |
#Authorization (Currently linked to "The Development Guide") | #Authorization (Currently linked to "The Development Guide") | ||
#Authentication (Code review) | #Authentication (Code review) | ||
| Line 28: | Line 30: | ||
#Cross Site Request Forgery | #Cross Site Request Forgery | ||
#Cryptography (Currently linked to "The Development Guide") | #Cryptography (Currently linked to "The Development Guide") | ||
| − | #Dangerous HTTP Methods | + | #Dangerous HTTP Methods ( Secure deployment) |
#Race Conditions | #Race Conditions | ||
| + | |||
== Language specific best practice == | == Language specific best practice == | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
===.NET=== | ===.NET=== | ||
| Line 52: | Line 46: | ||
Assigned to Andrew van der Stock | Assigned to Andrew van der Stock | ||
| − | + | ===C/C++=== | |
| − | |||
| − | ===C=== | ||
# Memory management (Paolo Perego) | # Memory management (Paolo Perego) | ||
# String management (Paolo Perego) | # String management (Paolo Perego) | ||
# Secure access to file system items (Paolo Perego) | # Secure access to file system items (Paolo Perego) | ||
| − | |||
| − | |||
==Automating Code Reviews== | ==Automating Code Reviews== | ||
| Line 67: | Line 57: | ||
#Education and cultural change | #Education and cultural change | ||
#Tool Deployment Model | #Tool Deployment Model | ||
| − | + | #Code Auditor Workbench Tool (100%) | |
==References== | ==References== | ||
Latest revision as of 11:17, 23 October 2007
Methodology
- Code Review Introduction
- Steps and Roles
- Code Review Processes
- Transaction Analysis - E Keary
Design review
- Designing for security
- - M Roxberry(.NET)
- - Paolo Perego (Java)
- - Andrew van der Stock (PHP)
- - Paolo Perego (C)
- - C++
- - Andrew van der Stock (MySQL)
- - Mallory (AJAX)
Examples by Vulnerability
- Reviewing Code for Buffer Overruns and Overflows - 100%
- Reviewing Code for OS Injection - 100%
- Reviewing Code for SQL Injection - 100%
- Reviewing Code for Data Validation - - 100%
- Reviewing code for XSS issues - 100%
- Reviewing Code for Error Handling - 100%
- Reviewing Code for Logging Issues - 100%
- Reviewing The Secure Code Environment - 100%
- Authorization (Currently linked to "The Development Guide")
- Authentication (Code review)
- Session Integrity
- Cross Site Request Forgery
- Cryptography (Currently linked to "The Development Guide")
- Dangerous HTTP Methods ( Secure deployment)
- Race Conditions
Language specific best practice
.NET
PHP
Assigned to Andrew van der Stock
MySQL
Assigned to Andrew van der Stock
C/C++
- Memory management (Paolo Perego)
- String management (Paolo Perego)
- Secure access to file system items (Paolo Perego)
Automating Code Reviews
- Preface
- Reasons for using automated tools
- Education and cultural change
- Tool Deployment Model
- Code Auditor Workbench Tool (100%)
