Difference between revisions of "Chapters Assigned"
From OWASP
(→Language specific best practice) |
(→Design review) |
||
Line 8: | Line 8: | ||
#Designing for security | #Designing for security | ||
## - M Roxberry(.NET) | ## - M Roxberry(.NET) | ||
− | ## - (Java) | + | ## - P Perego (Java) |
## - PHP | ## - PHP | ||
− | ## - C | + | ## - P Perego (C) |
+ | ## - C++ | ||
## - MySQL | ## - MySQL | ||
Revision as of 16:02, 16 January 2007
Contents
Methodology
- Code Review Introduction
- Steps and Roles
- Code Review Processes
Design review
- Designing for security
- - M Roxberry(.NET)
- - P Perego (Java)
- - PHP
- - P Perego (C)
- - C++
- - MySQL
Examples by Vulnerability
- Reviewing Code for Buffer Overruns and Overflows - 70%
- Reviewing Code for OS Injection - 70%
- Reviewing Code for SQL Injection - 70%
- Reviewing Code for Data Validation - 70%
- Reviewing Code for Error Handling - 70%
- Reviewing Code for Logging Issues - 70%
- Reviewing The Secure Code Environment - E Keary
- Transaction Analysis - E Keary
- Authorization (Currently linked to "The Development Guide")
- Authentication (Code review)
- Session Integrity
- Cross Site Request Forgery
- Cryptography (Currently linked to "The Development Guide")
- Dangerous HTTP Methods
- Race Conditions
Language specific best practice
Java
- Inner classes
- Class comparison
- Cloneable classes
- Serializable classes
- Package scope and encapsulation
- Mutable objects
- Private methods & circumvention
.NET
PHP
MySQL
Stored Procs
C
C++
Automating Code Reviews
- Preface
- Reasons for using automated tools
- Education and cultural change
- Tool Deployment Model