This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Code Review V2 Table of Contents"
From OWASP
| Line 202: | Line 202: | ||
#Author Mohammed Damavandi, Abbas Naderi | #Author Mohammed Damavandi, Abbas Naderi | ||
====Ruby==== | ====Ruby==== | ||
| + | # Author - Open | ||
===Stored - The Anti pattern=== | ===Stored - The Anti pattern=== | ||
| + | # Author - Open | ||
====.NET==== | ====.NET==== | ||
#Author Johanna Curiel, Renchie Joan | #Author Johanna Curiel, Renchie Joan | ||
| Line 275: | Line 277: | ||
#Author Johanna Curiel, Renchie Joan | #Author Johanna Curiel, Renchie Joan | ||
======Round Tripping====== | ======Round Tripping====== | ||
| + | # Author - Open | ||
======How to prevent Round tripping====== | ======How to prevent Round tripping====== | ||
| + | # Author - Open | ||
#Author Johanna Curiel, Renchie Joan | #Author Johanna Curiel, Renchie Joan | ||
=====Setting the right Configurations===== | =====Setting the right Configurations===== | ||
Revision as of 01:39, 23 April 2013
- 1 OWASP Code Review Guide v2.0:
- 2 Introduction
- 3 Methodology
- 4 Reviewing by Techincal Control
- 4.1 Reviewing code for Authentication controls
- 4.2 Reviewing code Authorization weakness
- 4.2.1 Checking authz upon every request
- 4.2.2 Reducing the attack surface
- 4.2.3 Reviewing code for Session handling
- 4.2.4 Reviewing client side code
- 4.2.5 Review code for input validation
- 4.2.6 Reviewing code for contextual encoding
- 4.2.7 Reviewing file and resource handling code
- 4.2.8 =Resource Exhaustion - error handling
- 4.2.9 Reviewing Logging code - Detective Security
- 4.2.10 Reviewing Error handling and Error messages
- 4.2.11 Reviewing Security alerts
- 4.2.12 Review for active defense
- 4.2.13 Reviewing Secure Storage
- 4.2.14 Hashing & Salting - When, How and Where
- 5 Reviewing by Vulnerability
- 5.1 Review Code for XSS
- 5.2 Persistent - The Anti pattern
- 5.3 Reflected - The Anti pattern
- 5.4 Stored - The Anti pattern
- 5.5 DOM XSS
- 5.6 JQuery mistakes
- 5.7 The Anti pattern
- 5.8 Reviewing code for CSRF Issues
- 5.9 Transactional logic / Non idempotent functions / State Changing Functions
- 5.10 Reviewing code for poor logic /Business logic/Complex authorization
- 5.11 Reviewing Secure Communications
- 5.12 Tech-Stack pitfalls
- 5.13 Framework specific Issues
- 5.13.1 Spring
- 5.13.2 Structs
- 5.13.3 Drupal
- 5.13.4 Ruby on Rails
- 5.13.5 Django
- 5.13.6 .NET Security / MVC
- 5.13.7 Security in ASP.NET applications
- 5.13.8 PHP Specific Issues
- 5.13.9 Classic ASP
- 5.13.10 C#
- 5.13.11 C/C++
- 5.13.12 Objective C
- 5.13.13 Java
- 5.13.14 Android
- 5.13.15 Coldfusion
- 6 Security code review for Agile development
- 7 Willing to review drafts
OWASP Code Review Guide v2.0:
Forward
- Author - Eoin Keary
- Previous version to be updated:[[1]]
Code Review Guide History
- Author - Eoin Keary
- Previous version to be updated:[[2]]
Introduction
- Author - Eoin Keary
What is source code review and Static Analysis
- Author - Zyad Mghazli
- New Section
Manual Review - Pros and Cons
- Author - Ashish Rao
- New Section
- Suggestion: Benchmark of different Stataic Analysis Tools Zyad Mghazli
Why code review
Scope and Objective of secure code review
- Author - Ashish Rao
We can't hack ourselves secure
- Author - Prathamesh Mhatre
- New Section
360 Review: Coupling source code review and Testing / Hybrid Reviews
- Author - Ashish Rao
- New Section
Can static code analyzers do it all?
- Author - Ashish Rao
- New Section
Methodology
The code review approach
- Author - Prathamesh Mhatre
Preparation and context
- Author - Open
- Previous version to be updated: [[3]]
Application Threat Modeling
- Author - Andy, Renchie Joan
- Previous version to be updated: [[4]]
Understanding Code layout/Design/Architecture
- Author - Ashish Rao
SDLC Integration
- Author - Andy, Ashish Rao
- Previous version to be updated: [[5]]
Deployment Models
Secure deployment configurations
- Author - Ashish Rao
- New Section
Metrics and code review
- Author - Andy
- Previous version to be updated: [[6]]
Source and sink reviews
- Author - Ashish Rao
- New Section
Code review Coverage
- Author - Open
- Previous version to be updated: [[7]]
Design Reviews
- Author - Ashish Rao
- Why to review design?
- Building security in design - secure by design principle
- Design Areas to be reviewed
- Common Design Flaws
A Risk based approach to code review
- Author - Renchie Joan
- New Section
- "Doing things right or doing the right things..."
- "Not all bugs are equal
Crawling code
- Author - Abbas Naderi
- Previous version to be updated: [[8]]
- API of Interest:
- Java
- .NET
- PHP
- RUBY
- Frameworks:
- Spring
- .NET MVC
- Structs
- Zend
- New Section
- Searching for code in C/C++
- Author - Gaz Robinson
Code reviews and Compliance
- Author -Manual Harti
- Previous version to be updated: [[9]]
Reviewing by Techincal Control
Reviewing code for Authentication controls
- Author - Anand Prakash, Joan Renchie
Forgot password
- Author Abbas Naderi
Authentication
- Author - Anand Prakash, Joan Renchie
CAPTHCA
- Author Larry Conklin, Joan Renchie
Out of Band considerations
- Author - Open
- Previous version to be updated: [[10]]
Reviewing code Authorization weakness
- Author Ashish Rao
Checking authz upon every request
- Author - Abbas Naderi, Joan Renchie
Reducing the attack surface
- Author Chris Berberich
- Previous version to be updated: [[11]]
Reviewing code for Session handling
- Author - Palak Gohil, Abbas Naderi
- Previous version to be updated: [[12]]
Reviewing client side code
- New Section
Javascript
- Author - Abbas Naderi
JSON
- Author - Open
Content Security Policy
- Author - Open
"Jacking"/Framing
- Author - Abbas Naderi
HTML 5?
- Author - Sebastien Gioria
Browser Defenses policy
- Author - Open
etc...
Review code for input validation
- Author - Open
Regex Gotchas
- Author - Abbas Naderi
- New Section
ESAPI
- Author - Abbas Naderi
- New Section
- Internal Link: [[13]]
Reviewing code for contextual encoding
HTML Attribute
- Author - Shenai Silva
HTML Entity
- Author - Shenai Silva
Javascript Parameters
- Author - Open
JQuery
- Author - Abbas Naderi
Reviewing file and resource handling code
- Author - Open
=Resource Exhaustion - error handling
- Author - Abbas Naderi
native calls
- Author Abbas Naderi
Reviewing Logging code - Detective Security
- Author - Palak Gohil
- Where to Log
- What to log
- What not to log
- How to log
- Internal link: [[14]]
Reviewing Error handling and Error messages
- Author - Open
- Previous version to be updated: [[15]]
Reviewing Security alerts
- Author - Open
Review for active defense
- Author - Colin Watson
Reviewing Secure Storage
- Author - Azzeddine Ramrami
- New Section
Hashing & Salting - When, How and Where
Encrpyption
.NET
- Author Larry Conklin, Joan Renchie
- Previous version to be updated: [[16]]
- Can we talk about key storage as well i.e. key management for encryption techniques used in the application? - Ashish Rao
Reviewing by Vulnerability
Review Code for XSS
- Author Palak Gohil, Anand Prakash
- Previous version to be updated: [[17]]
- In reviewing code for XSS - we can give more patterns on "source to sink" patterns for ASP.NET wrf to difference versions and mechanisms to display data in a page - Ashish Rao
Persistent - The Anti pattern
- Author Abbas Naderi
.NET
- Author Johanna Curiel, Renchie Joan
.Java
- Author Palak Gohil
PHP
- Author Mohammed Damavandi, Abbas Naderi
Ruby
- Author Chris Berberich
Reflected - The Anti pattern
.NET
- Author Johanna Curiel, Renchie Joan
.Java
- Author Palak Gohil
PHP
- Author Mohammed Damavandi, Abbas Naderi
Ruby
- Author - Open
Stored - The Anti pattern
- Author - Open
.NET
- Author Johanna Curiel, Renchie Joan
.Java
- Author Palak Gohil
PHP
- Author Mohammed Damavandi, Abbas Naderi
Ruby
DOM XSS
- Author Larry Conklin
JQuery mistakes
- Author Shenal Silva
===Reviewing code for SQL Injection
- Author Palak Gohil, Renchie Joan
- Previous version to be updated: [[18]]
PHP
- Author - Open
Java
- Author - Open
.NET
- Author - Open
HQL
- Author - Open
The Anti pattern
PHP
- Author - Mohammad Damavandi, Abbas Naderi
Java
- Author - Palak Gohil
- => Searching for traditional SQL,JPA,JPSQL,Criteria,...
.NET
- Author Johanna Curiel, Renchie Joan
Ruby
- Author - Open
Cold Fusion
- Author - Open
Reviewing code for CSRF Issues
- Author Palak Gohil,Anand Prakash, Abbas Naderi
- Previous version to be updated: [[19]]
Transactional logic / Non idempotent functions / State Changing Functions
- Author Abbas Naderi
Reviewing code for poor logic /Business logic/Complex authorization
- Author - Open
Reviewing Secure Communications
.NET Config
- Author Johanna Curiel, Renchie Joan
Spring Config
- Author - Open
HTTP Headers
- Author Gregory Disney, Abbas Naderi
CSP
- Author Gregory Disney
HSTS
- Author Abbas Naderi
Tech-Stack pitfalls
- Author Gregory Disney
Framework specific Issues
Spring
- Author - Open
Structs
- Author - Open
Drupal
- Author Gregory Disney
Ruby on Rails
- Author - Open
Django
- Author Gregory Disney
.NET Security / MVC
- Author Johanna Curiel, Renchie Joan
Security in ASP.NET applications
- Author Johanna Curiel, Renchie Joan
Strongly Named Assemblies
- Author Johanna Curiel, Renchie Joan
Round Tripping
- Author - Open
How to prevent Round tripping
- Author - Open
- Author Johanna Curiel, Renchie Joan
Setting the right Configurations
- Author Johanna Curiel, Renchie Joan
Authentication Options
- Author Johanna Curiel, Renchie Joan
Code Review for Managed Code - .Net 1.0 and up
- Author Johanna Curiel, Renchie Joan
Using OWASP Top 10 as your guideline
- Author Johanna Curiel, Renchie Joan
Code review for Unsafe Code (C#)
- Author Johanna Curiel, Renchie Joan
PHP Specific Issues
- Author Mohammad Damavandi, Abbas Naderi
Classic ASP
- Author Johanna Curiel
C#
- Author Johanna Curiel, Renchie Joan
C/C++
- Author Gaz Robinson
Objective C
- Author Open
Java
- Author Palak Gohil
Android
- Author Open
Coldfusion
- Author Open
Security code review for Agile development
- Author Open
Willing to review drafts
- Terry Nerpester
- Larry Conklin
