This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Category:OWASP Code Review Project
|
This project has produced a book that can be downloaded or purchased. Feel free to browse the full catalog of available OWASP books. |
| PROJECT IDENTIFICATION | |||||||
|---|---|---|---|---|---|---|---|
| Project Name | OWASP Code Review Guide V1.1 | ||||||
| Short Project Description | The code review guide is currently at release version 1.1 and the second best selling OWASP book in 2008. Many positive comments have been feedback regarding this initial version and believe it’s a key enabler for the OWASP fight against software insecurity. It has even inspired individuals to build tools based on its information. The combination of a book on secure code review and tools to support such an activity is very powerful as it gives the developer community a place to start regarding secure application development.
Going forward I hope to further integrate with the ASVS and other guides such as the testing and ASDR guides shall be perfromed for version 2.0 | ||||||
| Project key Information | Project Leader Eoin Keary |
Project Contributors See here |
Mailing List Subscribe here Use here |
License Creative Commons Attribution Share Alike 3.0 |
Project Type Documentation |
Sponsor OWASP SoC 08 | |
| Release Status | Main Links | Related Projects |
|---|---|---|
|
OWASP Code Review Guide V1.1 - Word & PDF Files - NEW RELEASE!!! |
OWASP Testing Guide Project V 3.0 |
Contents
OWASP Code Review Guide Table of Contents
Summer of Code 2008
The Code review guide is proudly sponsored by the OWASP Summer of Code (SoC) 2008. For more information please see OWASP Summer of Code 2008.
Code Review Guide V1.1 Completed
The code review guide has been completed and is available here http://www.lulu.com/content/5678680 as a bound book.
Code review tool
The following link is for the new version of Code Crawler, code review tool which examines code for keywords discussed in the section "Crawling Code"
It has a new look and feel and also uses MS SQL Server express.
you can find it here:
http://www.cyphersec.com/software_archive/CodeCrawler.rar It's a lightweight tool and undergoing constant development.
Source code can be found here: http://www.cyphersec.com/software_archive/OWASP_Code_Crawler.zip
Owasp Orizon Code review engine
The Owasp Orizon Project is born in 2006 to provide a set of APIs to provide an opensource engine to provide static analysis services to developers that wants to build a code review tool.
The Owasp Orizon will evolve accordingly in order to implement security checks described in the Code Review Guide. With the framework a UI is also provided in order to give people a standalone tool to realize code review for the security flaws listed in the "The Owasp Code Review Top 9"
The Owasp Orizon main page is available here: Category:OWASP_Orizon_Project
Source code is hosted at Sourceforge.net site: http://orizon.sourceforge.net
Spring Of Code 2007
The Code review guide is proudly sponsored by the OWASP Spring of Code (SpOC) 2007. For more information please see Spring of Code 2007
Project Contributors
The OWASP Code Review project was conceived by Eoin Keary, the OWASP Ireland Founder and Chapter Lead. We are actively seeking individuals to add new sections as new web technologies emerge. If you are interested in volunteering for the project, or have a comment, question, or suggestion, please drop me a line mailto:[email protected]
Join the Code Review Team
All of the OWASP Guides are living documents that will continue to change as the threat and security landscape changes.
We welcome everyone to join the Code Review Guide Project and help us make this document great. The best way to get started is to subscribe to the mailing list by following the link below. Please introduce yourself and ask to see if there is anything you can help with. We are always looking for new contributions. If there is a topic that you’d like to research and contribute, please let us know!
http://lists.owasp.org/mailman/listinfo/owasp-codereview
Roadmap
View the OWASP Code Review Project Roadmap
Pages in category "OWASP Code Review Project"
The following 69 pages are in this category, out of 69 total.
C
- Classic ASP Design Mistakes
- Code Review Guide Foreword
- Code Review Guide Frontispiece
- Code Review Introduction
- Code Review Metrics
- Code Review Preparation
- Code Reviews and Compliance
- Codereview-Authentication
- Codereview-Authorization
- Codereview-Cryptography
- Codereview-Deployment
- Codereview-Error-Handling
- Codereview-Input Validation
- Codereview-Session-Management
- Crawling Code
- CRV2 ErrorHandlingMessages
- CRV2 MetricsCodeRev
- CRV2 PrepContext
- CRV2 SQLInjPHP
O
R
- Reasons for using automated tools
- References
- Reviewing Code for Authentication
- Reviewing Code for Authorization Issues
- Reviewing Code for Buffer Overruns and Overflows
- Reviewing code for Cross-Site Request Forgery issues
- Reviewing Code for Cross-site scripting
- Reviewing Code for Data Validation
- Reviewing Code for Error Handling
- Reviewing Code for Logging Issues
- Reviewing Code for OS Injection
- Reviewing Code for Race Conditions
- Reviewing Code for Session Integrity issues
- Reviewing Code for SQL Injection
- Reviewing Flash Applications
- Reviewing MySQL Security
- Reviewing The Secure Code Environment
- Reviewing Web Services
