This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Code Review V2 Table of Contents"

From OWASP
Jump to: navigation, search
m (Can review drafts.)
Line 14: Line 14:
 
=== What is source code review and Static Analysis ===
 
=== What is source code review and Static Analysis ===
 
=== What is Code Review ===
 
=== What is Code Review ===
−
# Author - Zyad Mghazli
+
# Author - Zyad Mghazli, Eoin Keary
 
# New Section
 
# New Section
 
''' [[CRV2_WhatIsCodeReview|Content here]]'''
 
''' [[CRV2_WhatIsCodeReview|Content here]]'''
  
 
=== Manual Review - Pros and Cons ===
 
=== Manual Review - Pros and Cons ===
−
# Author - Ashish Rao
+
# Author - Zyad Mghazli, Eoin Keary,Gary David Robinson
 
# New Section
 
# New Section
 
# Suggestion: Benchmark of different Stataic Analysis Tools  Zyad Mghazli
 
# Suggestion: Benchmark of different Stataic Analysis Tools  Zyad Mghazli
Line 35: Line 35:
  
 
=== We can't hack ourselves secure ===
 
=== We can't hack ourselves secure ===
−
# Author - Prathamesh Mhatre
+
# Author - Eoin Keary
 
# New Section
 
# New Section
 
# [[CRV2_CantHackSecure|Put content here]]
 
# [[CRV2_CantHackSecure|Put content here]]
  
 
=== 360 Review: Coupling source code review and Testing / Hybrid Reviews===
 
=== 360 Review: Coupling source code review and Testing / Hybrid Reviews===
−
# Author - Ashish Rao
+
# Author - Open
 
# New Section
 
# New Section
 
# [[CRV2_360Review|Put content here]]
 
# [[CRV2_360Review|Put content here]]
Line 51: Line 51:
 
=Methodology=
 
=Methodology=
 
===The code review approach===
 
===The code review approach===
−
#Author -  Prathamesh Mhatre
+
#Author -  Open
 
# [[CRV2_CodeReviewApproach|Put content here]]
 
# [[CRV2_CodeReviewApproach|Put content here]]
  
Line 60: Line 60:
  
 
====Application Threat Modeling====
 
====Application Threat Modeling====
−
#Author - Andy, Renchie Joan
+
#Author - Open
 
# Previous version to be updated: [[https://www.owasp.org/OCRG1.1:Application_Threat_Modeling]]
 
# Previous version to be updated: [[https://www.owasp.org/OCRG1.1:Application_Threat_Modeling]]
 
# [[CRV2_AppThreatModeling|Put content here]]
 
# [[CRV2_AppThreatModeling|Put content here]]
  
 
====Understanding Code layout/Design/Architecture====
 
====Understanding Code layout/Design/Architecture====
−
#Author - Ashish Rao
+
#Author - Open
 
# [[CRV2_CodeLayoutDesignArch|Put content here]]
 
# [[CRV2_CodeLayoutDesignArch|Put content here]]
  
 
===SDLC Integration===
 
===SDLC Integration===
−
#Author - Andy, Ashish Rao
+
#Author - Open
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Security_Code_Review_in_the_SDLC]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Security_Code_Review_in_the_SDLC]]
 
# [[CRV2_SDLCInt|Put content here]]
 
# [[CRV2_SDLCInt|Put content here]]
Line 75: Line 75:
 
====Deployment Models====
 
====Deployment Models====
 
=====Secure deployment configurations=====
 
=====Secure deployment configurations=====
−
#Author - Ashish Rao
+
#Author - Open
 
# [[CRV2_SecDepConfig|Put content here]]
 
# [[CRV2_SecDepConfig|Put content here]]
  
 
# New Section
 
# New Section
 
=====Metrics and code review=====
 
=====Metrics and code review=====
−
#Author - Andy
+
#Author - Open
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Review_Metrics]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Review_Metrics]]
 
# [[CRV2_MetricsCodeRev|Put content here]]
 
# [[CRV2_MetricsCodeRev|Put content here]]
  
 
=====Source and sink reviews=====
 
=====Source and sink reviews=====
−
#Author - Ashish Rao
+
#Author - Open
 
# New Section
 
# New Section
 
# [[CRV2_SourceSinkRev|Put content here]]
 
# [[CRV2_SourceSinkRev|Put content here]]
Line 103: Line 103:
  
 
=====A Risk based approach to code review=====
 
=====A Risk based approach to code review=====
−
#Author - Renchie Joan
+
#Author - Open
 
#New Section
 
#New Section
 
*"Doing things right or doing the right things..."
 
*"Doing things right or doing the right things..."
Line 110: Line 110:
  
 
====Crawling code====
 
====Crawling code====
−
#Author - Abbas Naderi
+
#Author - Open
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Crawling_Code]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Crawling_Code]]
 
*API of Interest:
 
*API of Interest:
Line 129: Line 129:
  
 
====Code reviews and Compliance====
 
====Code reviews and Compliance====
−
#Author -Manual Harti
+
#Author -Open
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Reviews_and_Compliance]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Reviews_and_Compliance]]
 
# [[CRV2_CodeRevCompliance|Put content here]]
 
# [[CRV2_CodeRevCompliance|Put content here]]
Line 135: Line 135:
 
=Reviewing by Technical Control=
 
=Reviewing by Technical Control=
 
===Reviewing code for Authentication controls===
 
===Reviewing code for Authentication controls===
−
#Author - Anand Prakash, Joan Renchie
+
#Author - Open
 
# [[CRV2_AuthControls|Put content here]]
 
# [[CRV2_AuthControls|Put content here]]
  
Line 143: Line 143:
  
 
====Authentication====
 
====Authentication====
−
#Author - Anand Prakash, Joan Renchie
+
#Author - Open
 
# [[CRV2_Authentication|Put content here]]
 
# [[CRV2_Authentication|Put content here]]
  
Line 156: Line 156:
  
 
===Reviewing code Authorization weakness===
 
===Reviewing code Authorization weakness===
−
#Author Ashish Rao (Eoin Keary .NET MVC added)
+
#Author Eoin Keary .NET MVC added
 
# [[CRV2_AuthorizationWeaknesses|Put content here]]
 
# [[CRV2_AuthorizationWeaknesses|Put content here]]
  
 
====Checking authz upon every request====
 
====Checking authz upon every request====
−
#Author - Abbas Naderi, Joan Renchie
+
#Author - Abbas Naderi
 
# [[CRV2_CheckAuthzEachRequest|Put content here]]
 
# [[CRV2_CheckAuthzEachRequest|Put content here]]
  
 
====Reducing the attack surface====
 
====Reducing the attack surface====
−
#Author Chris Berberich
+
#Author Open
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Authorization]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Authorization]]
 
# [[CRV2_ReducingAttSurf|Put content here]]
 
# [[CRV2_ReducingAttSurf|Put content here]]
Line 173: Line 173:
  
 
====Reviewing code for Session handling====
 
====Reviewing code for Session handling====
−
#Author - Palak Gohil, Abbas Naderi
+
#Author - Abbas Naderi
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Session-Management]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Session-Management]]
 
# [[CRV2_SessionHandling|Put content here]]
 
# [[CRV2_SessionHandling|Put content here]]
Line 198: Line 198:
  
 
=====HTML 5?=====
 
=====HTML 5?=====
−
#Author - Sebastien Gioria
+
#Author - Open
 
# [[CRV2_ClientSideCodeHTML5|Put content here]]
 
# [[CRV2_ClientSideCodeHTML5|Put content here]]
  
Line 212: Line 212:
  
 
=====Regex Gotchas=====
 
=====Regex Gotchas=====
−
#Author - Abbas Naderi
+
#Author - Open
 
#New Section
 
#New Section
 
# [[CRV2_InputValRegexGotchas|Put content here]]
 
# [[CRV2_InputValRegexGotchas|Put content here]]
  
 
=====ESAPI=====
 
=====ESAPI=====
−
#Author - Abbas Naderi
+
#Author - Open
 
#New Section
 
#New Section
 
# Internal Link: [[https://www.owasp.org/index.php/Codereview-Input_Validation]]
 
# Internal Link: [[https://www.owasp.org/index.php/Codereview-Input_Validation]]
Line 233: Line 233:
  
 
=====Javascript Parameters=====
 
=====Javascript Parameters=====
−
#Author - Open
+
#Author - Eoin Keary
 
# [[CRV2_ContextEncJscriptParams|Put content here]]
 
# [[CRV2_ContextEncJscriptParams|Put content here]]
  
 
=====JQuery=====
 
=====JQuery=====
−
#Author - Abbas Naderi
+
#Author - Open
 
# [[CRV2_ContextEncJQuery|Put content here]]
 
# [[CRV2_ContextEncJQuery|Put content here]]
  
Line 245: Line 245:
  
 
====Resource Exhaustion - error handling====
 
====Resource Exhaustion - error handling====
−
#Author - Abbas Naderi
+
#Author - Open
 
# [[CRV2_ResourceExhaustionErrHandling|Put content here]]
 
# [[CRV2_ResourceExhaustionErrHandling|Put content here]]
  
 
=====native calls=====
 
=====native calls=====
−
#Author Abbas Naderi
+
#Author Open
 
# [[CRV2_ResourceExhaustionNativeCalls|Put content here]]
 
# [[CRV2_ResourceExhaustionNativeCalls|Put content here]]
  
 
====Reviewing Logging code - Detective Security====
 
====Reviewing Logging code - Detective Security====
−
#Author - Palak Gohil
+
#Author - Open
 
* Where to Log
 
* Where to Log
 
* What to log
 
* What to log
Line 275: Line 275:
  
 
====Reviewing Secure Storage====
 
====Reviewing Secure Storage====
−
#Author - Azzeddine Ramrami
+
#Author - Open source
 
# New Section
 
# New Section
 
# [[CRV2_SecureStorage|Put content here]]
 
# [[CRV2_SecureStorage|Put content here]]
Line 289: Line 289:
 
=Reviewing by Vulnerability=
 
=Reviewing by Vulnerability=
 
===Review Code for XSS===
 
===Review Code for XSS===
−
#Author Palak Gohil, Anand Prakash (Examples added by Eoin Keary)
+
#Author Examples added by Eoin Keary
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_Cross-Site_Scripting]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_Cross-Site_Scripting]]
 
# In reviewing code for XSS - we can give more patterns on "source to sink" patterns for ASP.NET wrf to difference versions and mechanisms to display data in a page - Ashish Rao
 
# In reviewing code for XSS - we can give more patterns on "source to sink" patterns for ASP.NET wrf to difference versions and mechanisms to display data in a page - Ashish Rao
Line 295: Line 295:
  
 
===Persistent - The Anti pattern===
 
===Persistent - The Anti pattern===
−
#Author Abbas Naderi
+
#Author  
 
# [[CRV2_RevCodePersistentAntiPatternIntro|Put content here]]
 
# [[CRV2_RevCodePersistentAntiPatternIntro|Put content here]]
  
 
====.NET====
 
====.NET====
−
#Author Johanna Curiel, Renchie Joan, Larry Conklin
+
#Author Johanna Curiel, Eoin Keary
 
# [[CRV2_RevCodePersistentAntiPatterndotNet|Put content here]]
 
# [[CRV2_RevCodePersistentAntiPatterndotNet|Put content here]]
  
 
====.Java====
 
====.Java====
−
#Author Palak Gohil, Johanna Curiel
+
#Author Johanna Curiel
 
# [[CRV2_RevCodePersistentAntiPatternJava|Put content here]]
 
# [[CRV2_RevCodePersistentAntiPatternJava|Put content here]]
  
 
====PHP====
 
====PHP====
−
#Author Mohammed Damavandi, Abbas Naderi
+
#Author Abbas Naderi
 
# [[CRV2_RevCodePersistentAntiPatternPHP|Put content here]]
 
# [[CRV2_RevCodePersistentAntiPatternPHP|Put content here]]
  
 
====Ruby====
 
====Ruby====
−
#Author Chris Berberich
+
#Author OPen
 
# [[CRV2_RevCodePersistentAntiPatternRuby|Put content here]]
 
# [[CRV2_RevCodePersistentAntiPatternRuby|Put content here]]
  
Line 318: Line 318:
  
 
====.NET====
 
====.NET====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_RevCodeReflectedAntiPatterndotNet|Put content here]]
 
# [[CRV2_RevCodeReflectedAntiPatterndotNet|Put content here]]
  
 
====.Java====
 
====.Java====
−
#Author Palak Gohil, Johanna Curiel
+
#Author Johanna Curiel
 
# [[CRV2_RevCodeReflectedAntiPatternJava|Put content here]]
 
# [[CRV2_RevCodeReflectedAntiPatternJava|Put content here]]
  
 
====PHP====
 
====PHP====
−
#Author Mohammed Damavandi, Abbas Naderi
+
#Author Abbas Naderi
 
# [[CRV2_RevCodeReflectedAntiPatternPHP|Put content here]]
 
# [[CRV2_RevCodeReflectedAntiPatternPHP|Put content here]]
  
Line 338: Line 338:
  
 
====.NET====
 
====.NET====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_RevCodeStoredAntiPatterndotNET|Put content here]]
 
# [[CRV2_RevCodeStoredAntiPatterndotNET|Put content here]]
  
 
====.Java====
 
====.Java====
−
#Author Palak Gohil, Johanna Curiel
+
#Author Johanna Curiel
 
# [[CRV2_RevCodeStoredAntiPatternJava|Put content here]]
 
# [[CRV2_RevCodeStoredAntiPatternJava|Put content here]]
  
 
====PHP====
 
====PHP====
−
#Author Mohammed Damavandi, Abbas Naderi
+
#Author Abbas Naderi
 
# [[CRV2_RevCodeStoredAntiPatternPHP|Put content here]]
 
# [[CRV2_RevCodeStoredAntiPatternPHP|Put content here]]
  
Line 358: Line 358:
  
 
===JQuery mistakes===
 
===JQuery mistakes===
−
#Author Shenal Silva
+
#Author  
 
# [[CRV2_JQueryMistakes|Put content here]]
 
# [[CRV2_JQueryMistakes|Put content here]]
  
 
===Reviewing code for SQL Injection===
 
===Reviewing code for SQL Injection===
−
#Author Palak Gohil, Renchie Joan
+
#Author Open
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_SQL_Injection]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_SQL_Injection]]
 
# [[CRV2_RevCodeSQLInjection|Put content here]]
 
# [[CRV2_RevCodeSQLInjection|Put content here]]
Line 375: Line 375:
  
 
====.NET====
 
====.NET====
−
#Author - Mennouchi Islam Azeddine
+
#Author - Open
 
# [[CRV2_SQLInjdotNET|Put content here]]
 
# [[CRV2_SQLInjdotNET|Put content here]]
  
Line 387: Line 387:
 
https://www.owasp.org/index.php/CRV2_AntiPattern
 
https://www.owasp.org/index.php/CRV2_AntiPattern
 
====PHP====
 
====PHP====
−
#Author - Mohammad Damavandi, Abbas Naderi
+
#Author -  
 
# [[CRV2_AntiPatternPHP|Put content here]]
 
# [[CRV2_AntiPatternPHP|Put content here]]
  
 
====Java====
 
====Java====
−
#Author - Palak Gohil
+
#Author -  
 
#=> Searching for traditional SQL,JPA,JPSQL,Criteria,...
 
#=> Searching for traditional SQL,JPA,JPSQL,Criteria,...
 
# [[CRV2_AntiPatternJava|Put content here]]
 
# [[CRV2_AntiPatternJava|Put content here]]
  
 
====.NET====
 
====.NET====
−
#Author Johanna Curiel, Renchie Joan,Larry Conklin
+
#Author Open
 
# [[CRV2_AntiPatterndotNet|Put content here]]
 
# [[CRV2_AntiPatterndotNet|Put content here]]
  
Line 408: Line 408:
  
 
===Reviewing code for CSRF Issues===
 
===Reviewing code for CSRF Issues===
−
#Author Palak Gohil,Anand Prakash, Abbas Naderi
+
#Author Abbas Naderi
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_Cross-Site_Request_Forgery]]
 
# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_Cross-Site_Request_Forgery]]
 
# [[CRV2_CSRFIssues|Put content here]]
 
# [[CRV2_CSRFIssues|Put content here]]
Line 417: Line 417:
  
 
===Reviewing code for poor logic /Business logic/Complex authorization===
 
===Reviewing code for poor logic /Business logic/Complex authorization===
−
#Author - Sam Denard
+
#Author - Open
 
# [[CRV2_PoorLogic|Put content here]]
 
# [[CRV2_PoorLogic|Put content here]]
  
Line 430: Line 430:
  
 
====HTTP Headers====
 
====HTTP Headers====
−
#Author Gregory Disney, Abbas Naderi
+
#Author Open
 
# [[CRV2_SecCommsHTTPHdrs|Put content here]]
 
# [[CRV2_SecCommsHTTPHdrs|Put content here]]
  
 
=====CSP=====
 
=====CSP=====
−
#Author Gregory Disney
+
#Author Open
 
# [[CRV2_SecCommsHTTPHdrsCSP|Put content here]]
 
# [[CRV2_SecCommsHTTPHdrsCSP|Put content here]]
  
 
=====HSTS=====
 
=====HSTS=====
−
#Author Abbas Naderi
+
#Author Open
 
# [[CRV2_SecCommsHTTPHSTS|Put content here]]
 
# [[CRV2_SecCommsHTTPHSTS|Put content here]]
  
 
===Tech-Stack pitfalls===
 
===Tech-Stack pitfalls===
−
#Author Gregory Disney
+
#Author Open
 
# [[CRV2_TechStackPitfalls|Put content here]]
 
# [[CRV2_TechStackPitfalls|Put content here]]
  
Line 455: Line 455:
  
 
====Drupal====
 
====Drupal====
−
#Author Gregory Disney
+
#Author Open
 
# [[CRV2_FrameworkSpecIssuesDurpal|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesDurpal|Put content here]]
  
Line 463: Line 463:
  
 
====Django====
 
====Django====
−
#Author Gregory Disney
+
#Author Open
 
# [[CRV2_FrameworkSpecIssuesDjango|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesDjango|Put content here]]
  
 
====.NET Security / MVC====
 
====.NET Security / MVC====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel, Eoin Keary
 
# [[CRV2_FrameworkSpecIssuesdotNetMVC|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesdotNetMVC|Put content here]]
  
 
====Security in ASP.NET applications====
 
====Security in ASP.NET applications====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_FrameworkSpecIssuesASPNet|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesASPNet|Put content here]]
  
 
=====Strongly Named Assemblies=====
 
=====Strongly Named Assemblies=====
−
#Author Johanna Curiel, Renchie Joan, Larry Conklin
+
#Author Johanna Curiel, Larry Conklin
 
# [[CRV2_FrameworkSpecIssuesASPNetStrongAssembiles|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesASPNetStrongAssembiles|Put content here]]
  
Line 484: Line 484:
 
======How to prevent Round tripping======
 
======How to prevent Round tripping======
 
# Author - Open
 
# Author - Open
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_FrameworkSpecIssuesASPNetRTPrevention|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesASPNetRTPrevention|Put content here]]
  
 
=====Setting the right Configurations=====
 
=====Setting the right Configurations=====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_FrameworkSpecIssuesASPNetConfigs|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesASPNetConfigs|Put content here]]
  
 
=====Authentication Options=====
 
=====Authentication Options=====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_FrameworkSpecIssuesASPNetAuth|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesASPNetAuth|Put content here]]
  
 
=====Code Review for Managed Code - .Net 1.0 and up=====
 
=====Code Review for Managed Code - .Net 1.0 and up=====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_FrameworkSpecIssuesASPNetManagedCode|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesASPNetManagedCode|Put content here]]
  
 
=====Using OWASP Top 10 as your guideline=====
 
=====Using OWASP Top 10 as your guideline=====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_FrameworkSpecIssuesASPTop10|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesASPTop10|Put content here]]
  
 
=====Code review for Unsafe Code (C#)=====
 
=====Code review for Unsafe Code (C#)=====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Johanna Curiel
 
# [[CRV2_FrameworkSpecIssuesASPNetUnsafeCode|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesASPNetUnsafeCode|Put content here]]
  
 
====PHP Specific Issues====
 
====PHP Specific Issues====
−
#Author Mohammad Damavandi, Abbas Naderi
+
#Author Open
 
# [[CRV2_FrameworkSpecIssuesPHP|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesPHP|Put content here]]
  
Line 516: Line 516:
  
 
====C#====
 
====C#====
−
#Author Johanna Curiel, Renchie Joan
+
#Author Open
 
# [[CRV2_FrameworkSpecIssuesCsharp|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesCsharp|Put content here]]
  
 
====C/C++====
 
====C/C++====
−
#Author Gary David Robinson
+
#Author Open
 
# [[CRV2_FrameworkSpecIssuesCplusplus|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesCplusplus|Put content here]]
  
Line 528: Line 528:
  
 
====Java====
 
====Java====
−
#Author Palak Gohil
+
#Author Open
 
# [[CRV2_FrameworkSpecIssuesJava|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesJava|Put content here]]
  
Line 541: Line 541:
 
====CodeIgniter====
 
====CodeIgniter====
  
−
# Author [[User:Zakiakhmad]]
+
# Author Open
 
# [[CRV2_FrameworkSpecIssuesCodeIgniter|Put content here]]
 
# [[CRV2_FrameworkSpecIssuesCodeIgniter|Put content here]]
  
Line 550: Line 550:
 
=Code Review Tools=
 
=Code Review Tools=
 
https://www.owasp.org/index.php/CRV2_CodeReviewTools
 
https://www.owasp.org/index.php/CRV2_CodeReviewTools
−
 
−
 
−
=Willing to review drafts=
 
−
#Terry Nerpester
 
−
#Larry Conklin
 
−
#Gary David Robinson
 
−
#Simon Whittaker
 
−
#Jason Johnson
 
−
#Carlos Pantelides
 
−
#Damien Moran
 

Revision as of 16:33, 20 November 2013

 [hide] 

OWASP Code Review Guide v2.0:

Forward

  1. Author - Eoin Keary
  2. Previous version to be updated:[[1]]

Content here

Code Review Guide Introduction

  1. Author - Eoin Keary
  2. Previous version to be updated:[[2]]

Content here

What is source code review and Static Analysis

What is Code Review

  1. Author - Zyad Mghazli, Eoin Keary
  2. New Section

Content here

Manual Review - Pros and Cons

  1. Author - Zyad Mghazli, Eoin Keary,Gary David Robinson
  2. New Section
  3. Suggestion: Benchmark of different Stataic Analysis Tools Zyad Mghazli
  4. Put content here

Advantages of Code Review to Development Practices

  1. Author - Gary David Robinson
  2. New Section
  3. Put content here

Why code review

Scope and Objective of secure code review

  1. Author - Ashish Rao
  2. Put content here

We can't hack ourselves secure

  1. Author - Eoin Keary
  2. New Section
  3. Put content here

360 Review: Coupling source code review and Testing / Hybrid Reviews

  1. Author - Open
  2. New Section
  3. Put content here

Can static code analyzers do it all?

  1. Author - Ashish Rao
  2. New Section
  3. Put content here

Methodology

The code review approach

  1. Author - Open
  2. Put content here

Preparation and context

  1. Author - Gary David Robinson
  2. Previous version to be updated: [[3]]
  3. Put content here

Application Threat Modeling

  1. Author - Open
  2. Previous version to be updated: [[4]]
  3. Put content here

Understanding Code layout/Design/Architecture

  1. Author - Open
  2. Put content here

SDLC Integration

  1. Author - Open
  2. Previous version to be updated: [[5]]
  3. Put content here

Deployment Models

Secure deployment configurations
  1. Author - Open
  2. Put content here
  1. New Section
Metrics and code review
  1. Author - Open
  2. Previous version to be updated: [[6]]
  3. Put content here
Source and sink reviews
  1. Author - Open
  2. New Section
  3. Put content here
Code review Coverage
  1. Author - Open
  2. Previous version to be updated: [[7]]
  3. Put content here
Design Reviews
  1. Author - Ashish Rao
  • Why to review design?
    • Building security in design - secure by design principle
    • Design Areas to be reviewed
    • Common Design Flaws
  1. Put content here
A Risk based approach to code review
  1. Author - Open
  2. New Section
  • "Doing things right or doing the right things..."
    • "Not all bugs are equal
  1. Put content here

Crawling code

  1. Author - Open
  2. Previous version to be updated: [[8]]
  • API of Interest:
    • Java
    • .NET
    • PHP
    • RUBY
  • Frameworks:
    • Spring
    • .NET MVC
    • Structs
    • Zend
  1. New Section
  • Searching for code in C/C++
  1. Author - Gary David Robinson
  1. Put content here

Code reviews and Compliance

  1. Author -Open
  2. Previous version to be updated: [[9]]
  3. Put content here

Reviewing by Technical Control

Reviewing code for Authentication controls

  1. Author - Open
  2. Put content here

Forgot password

  1. Author Abbas Naderi, Larry Conklin
  2. Put content here

Authentication

  1. Author - Open
  2. Put content here

CAPTCHA

  1. Author Larry Conklin, Joan Renchie

Content here

Out of Band considerations

  1. Author - Open
  2. Previous version to be updated: [[10]]
  3. Put content here

Reviewing code Authorization weakness

  1. Author Eoin Keary .NET MVC added
  2. Put content here

Checking authz upon every request

  1. Author - Abbas Naderi
  2. Put content here

Reducing the attack surface

  1. Author Open
  2. Previous version to be updated: [[11]]
  3. Put content here

SSL/TLS Implementations

  1. Author - Eoin Keary
  2. Put content here

Reviewing code for Session handling

  1. Author - Abbas Naderi
  2. Previous version to be updated: [[12]]
  3. Put content here

Reviewing client side code

  1. New Section
  2. Put content here
Javascript
  1. Author - Abbas Naderi
  2. Put content here
JSON
  1. Author - Open
  2. Put content here
Content Security Policy
  1. Author - Open
  2. Put content here
"Jacking"/Framing
  1. Author - Eoin Keary
  2. Put content here
HTML 5?
  1. Author - Open
  2. Put content here
Browser Defenses policy
  1. Author - Open
  2. Put content here
etc...

Review code for input validation

  1. Author - Open
  2. Put content here
Regex Gotchas
  1. Author - Open
  2. New Section
  3. Put content here
ESAPI
  1. Author - Open
  2. New Section
  3. Internal Link: [[13]]
  4. Put content here

Reviewing code for contextual encoding

Overall approach to content encoding and anti XSS

HTML Attribute
  1. Author - Eoin Keary
  2. Put content here
HTML Entity
  1. Author - Eoin Keary
  2. Put content here
Javascript Parameters
  1. Author - Eoin Keary
  2. Put content here
JQuery
  1. Author - Open
  2. Put content here

Reviewing file and resource handling code

  1. Author - Open
  2. Put content here

Resource Exhaustion - error handling

  1. Author - Open
  2. Put content here
native calls
  1. Author Open
  2. Put content here

Reviewing Logging code - Detective Security

  1. Author - Open
  • Where to Log
  • What to log
  • What not to log
  • How to log
  1. Internal link: [[14]]
  2. Put content here

Reviewing Error handling and Error messages

  1. Author - Gary David Robinson
  2. Previous version to be updated: [[15]]
  3. Put content here

Reviewing Security alerts

  1. Author - Open
  2. Put content here

Review for active defense

  1. Author - Colin Watson
  2. Put content here

Reviewing Secure Storage

  1. Author - Open source
  2. New Section
  3. Put content here

Hashing & Salting - When, How and Where

Encrpyption
.NET
  1. Author Larry Conklin, Joan Renchie
  2. Previous version to be updated: [[16]]
  • Can we talk about key storage as well i.e. key management for encryption techniques used in the application? - Ashish Rao

Content here

Reviewing by Vulnerability

Review Code for XSS

  1. Author Examples added by Eoin Keary
  2. Previous version to be updated: [[17]]
  3. In reviewing code for XSS - we can give more patterns on "source to sink" patterns for ASP.NET wrf to difference versions and mechanisms to display data in a page - Ashish Rao
  4. Put content here

Persistent - The Anti pattern

  1. Author
  2. Put content here

.NET

  1. Author Johanna Curiel, Eoin Keary
  2. Put content here

.Java

  1. Author Johanna Curiel
  2. Put content here

PHP

  1. Author Abbas Naderi
  2. Put content here

Ruby

  1. Author OPen
  2. Put content here

Reflected - The Anti pattern

  1. Put content here

.NET

  1. Author Johanna Curiel
  2. Put content here

.Java

  1. Author Johanna Curiel
  2. Put content here

PHP

  1. Author Abbas Naderi
  2. Put content here

Ruby

  1. Author - Open
  2. Put content here

Stored - The Anti pattern

  1. Author - Open
  2. Put content here

.NET

  1. Author Johanna Curiel
  2. Put content here

.Java

  1. Author Johanna Curiel
  2. Put content here

PHP

  1. Author Abbas Naderi
  2. Put content here

Ruby

  1. Author - Open
  2. Put content here

DOM XSS

  1. Author Larry Conklin
  2. Put content here

JQuery mistakes

  1. Author
  2. Put content here

Reviewing code for SQL Injection

  1. Author Open
  2. Previous version to be updated: [[18]]
  3. Put content here

PHP

  1. Author - Mennouchi Islam Azeddine
  2. Put content here

Java

  1. Author - Johanna Curiel
  2. Put content here

.NET

  1. Author - Open
  2. Put content here

HQL

  1. Author - Open
  2. Put content here

The Anti pattern

  1. Author Larry Conklin
  2. Content here

https://www.owasp.org/index.php/CRV2_AntiPattern

PHP

  1. Author -
  2. Put content here

Java

  1. Author -
  2. => Searching for traditional SQL,JPA,JPSQL,Criteria,...
  3. Put content here

.NET

  1. Author Open
  2. Put content here

Ruby

  1. Author - Open
  2. Put content here

Cold Fusion

  1. Author - Open
  2. Put content here

Reviewing code for CSRF Issues

  1. Author Abbas Naderi
  2. Previous version to be updated: [[19]]
  3. Put content here

Transactional logic / Non idempotent functions / State Changing Functions

  1. Author Abbas Naderi
  2. Put content here

Reviewing code for poor logic /Business logic/Complex authorization

  1. Author - Open
  2. Put content here

Reviewing Secure Communications

.NET Config

  1. Author Johanna Curiel, Renchie Joan
  2. Put content here

Spring Config

  1. Author - Open
  2. Put content here

HTTP Headers

  1. Author Open
  2. Put content here
CSP
  1. Author Open
  2. Put content here
HSTS
  1. Author Open
  2. Put content here

Tech-Stack pitfalls

  1. Author Open
  2. Put content here

Framework specific Issues

Spring

  1. Author - Open
  2. Put content here

Structs

  1. Author - Open
  2. Put content here

Drupal

  1. Author Open
  2. Put content here

Ruby on Rails

  1. Author - Open
  2. Put content here

Django

  1. Author Open
  2. Put content here

.NET Security / MVC

  1. Author Johanna Curiel, Eoin Keary
  2. Put content here

Security in ASP.NET applications

  1. Author Johanna Curiel
  2. Put content here
Strongly Named Assemblies
  1. Author Johanna Curiel, Larry Conklin
  2. Put content here
Round Tripping
  1. Author - Open
  2. Put content here
How to prevent Round tripping
  1. Author - Open
  2. Author Johanna Curiel
  3. Put content here
Setting the right Configurations
  1. Author Johanna Curiel
  2. Put content here
Authentication Options
  1. Author Johanna Curiel
  2. Put content here
Code Review for Managed Code - .Net 1.0 and up
  1. Author Johanna Curiel
  2. Put content here
Using OWASP Top 10 as your guideline
  1. Author Johanna Curiel
  2. Put content here
Code review for Unsafe Code (C#)
  1. Author Johanna Curiel
  2. Put content here

PHP Specific Issues

  1. Author Open
  2. Put content here

Classic ASP

  1. Author Johanna Curiel
  2. Put content here

C#

  1. Author Open
  2. Put content here

C/C++

  1. Author Open
  2. Put content here

Objective C

  1. Author Open
  2. Put content here

Java

  1. Author Open
  2. Put content here

Android

  1. Author Open
  2. Put content here

Coldfusion

  1. Author Open
  2. Put content here

CodeIgniter

  1. Author Open
  2. Put content here

Security code review for Agile development

  1. Author Carlos Pantelides
  2. Put content here

Code Review Tools

https://www.owasp.org/index.php/CRV2_CodeReviewTools

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Code_Review_V2_Table_of_Contents&oldid=163641"