This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Code Review Guide Table of Contents"

From OWASP
Jump to: navigation, search
m (Switched a link from article to navigation shell)
 
(154 intermediate revisions by 12 users not shown)
Line 1: Line 1:
 +
{{LinkBar
 +
  | useprev=PrevLink | prev= | lblprev=
 +
  | usemain=MainLink | main=OWASP Code Review Guide Table of Contents | lblmain=Table of Contents
 +
  | usenext=NextLink | next=Code Review Guide Foreword | lblnext=Foreword by OWASP Chair
 +
}}
 +
__NOTOC__
 +
 +
 +
==[[Code Review Guide Foreword|Foreword by OWASP Chair]]==
 +
 +
==Frontispiece==
 +
 +
* [[Code Review Guide Frontispiece|About the OWASP Code Review Project]]
 +
* [[OCRG1.1:About The Open Web Application Security Project|About The Open Web Application Security Project]]
 +
 +
==Guide History==
 +
* [[Code Review Guide History]]
 +
 
==Methodology==
 
==Methodology==
  
−
#[[Code Review Introduction|Introduction]]
+
*[[Code Review Introduction|Introduction]]
−
#[[Steps and Roles]]
+
*[[Code Review Preparation|Preparation]]
−
#[[Code Review Processes]]
+
*[[Security Code Review in the SDLC]]
−
[[Category:OWASP Code Review Project]]
+
*[[Security Code Review Coverage]]
 +
*[[OCRG1.1:Application Threat Modeling|Application Threat Modeling]]
 +
*[[Code Review Metrics]]
 +
 
 +
==Crawling Code==
 +
* [[Crawling Code]]
 +
* [[Searching for Code in J2EE/Java]]
 +
* [[Searching for Code in Classic ASP]]
 +
* [[JavaScript/Web 2.0 Keywords and Pointers]]
  
−
== Design review ==
+
==Code Reviews and PCI DSS==
−
#[[Designing for security]]
+
* [[Code Reviews and Compliance]]
 +
 
 +
==Examples by Technical Control==
 +
* [[Codereview-Authentication|Authentication]]
 +
* [[Codereview-Authorization|Authorization]]
 +
* [[Codereview-Session-Management|Session Management]]
 +
* [[Codereview-Input Validation|Input Validation]]
 +
* [[Codereview-Error-Handling|Error Handling]]
 +
* [[Codereview-Deployment|Secure Deployment]]
 +
* [[Codereview-Cryptographic_Controls|Cryptographic Controls]]
  
 
==Examples by Vulnerability==
 
==Examples by Vulnerability==
−
#[[Buffer Overruns and Overflows|Buffer Overruns and Overflows]]
+
* [[Reviewing Code for Buffer Overruns and Overflows]]
−
#[[OS Injection]]
+
* [[Reviewing Code for OS Injection]]
−
#[[Reviewing Code for SQL Injection|SQL Injection]]
+
* [[Reviewing Code for SQL Injection]]
−
#[[Data Validation (Code Review)|Data Validation]]
+
* [[Reviewing Code for Data Validation]]
−
#[[Error Handling]]
+
* [[Reviewing Code for Cross-Site Scripting]]
−
#[[The Secure Code Environment]]
+
* [[Reviewing Code for Cross-Site Request Forgery]]
−
#[[Transaction Analysis]]
+
* [[Reviewing Code for Logging Issues]]
−
#[[Authorization]]
+
* [[Reviewing Code for Session Integrity]]
−
#[[Authentication (Code review)|Authentication]]
+
* [[Reviewing Code for Race Conditions]]
−
#[[Session Integrity]]
 
−
#[[Cross Site Request Forgery]]
 
−
#[[Cryptography]]
 
  
−
== Language specific best practice ==
+
== Language Specific Best Practice ==
  
 
===Java===
 
===Java===
−
#[[Inner classes]]
+
*[[Java Gotchas]]
−
#[[Class comparison]]
+
*[[Leading Java Security Practice]]
−
#[[Cloneable classes]]
 
−
#[[Serializable classes]]
 
−
#[[Package scope and encapsulation]]
 
−
#[[Mutable objects]]
 
−
#[[Private methods & circumvention]]
 
  
−
===.NET===
+
===Classic ASP===
 +
*[[Classic ASP Design Mistakes]]
  
 
===PHP===
 
===PHP===
 +
*[[Leading PHP Security Practice]]
  
−
==[[Automating Code Reviews]] ==
+
===C/C++===
−
#[[Preface ]]
+
*[[Strings and Integers]]
−
#[[Reasons for using automated tools]]
+
 
−
#[[Education and cultural change]]
+
===MySQL===
 +
*[[Reviewing MySQL Security]]
 +
 
 +
===Rich Internet Applications===
 +
*[[Reviewing Flash Applications]]
 +
*[[Reviewing AJAX Applications]]
 +
*[[Reviewing Web Services]]
 +
 
 +
== Example Reports ==
 +
* [[How to Write an Application Code Review Finding]]
 +
 
 +
==Automating Code Reviews==
 +
* [[Automated Code Review]]
 +
* [[Tool Deployment Model]]
 +
* [[Code Auditor Workbench Tool]]
 +
* [[The Owasp Orizon Framework]]
 +
 
 +
==[[The Owasp Code Review Top 9]]==
 +
 
 +
==[[The Owasp Code Review Scoring System]]==
  
 
==[[References]]==
 
==[[References]]==
 +
 +
{{LinkBar
 +
  | useprev=PrevLink | prev= | lblprev=
 +
  | usemain=MainLink | main=OWASP Code Review Guide Table of Contents | lblmain=Table of Contents
 +
  | usenext=NextLink | next=Code Review Guide Foreword | lblnext=Foreword by OWASP Chair
 +
}}
  
 
[[Category:OWASP Code Review Project]]
 
[[Category:OWASP Code Review Project]]

Latest revision as of 15:27, 9 September 2010

[This is the first page] Principal
(Table of Contents)

»»Foreword by OWASP Chair»»


Foreword by OWASP Chair

Frontispiece

Guide History

Methodology

Crawling Code

Code Reviews and PCI DSS

Examples by Technical Control

Examples by Vulnerability

Language Specific Best Practice

Java

Classic ASP

PHP

C/C++

MySQL

Rich Internet Applications

Example Reports

Automating Code Reviews

The Owasp Code Review Top 9

The Owasp Code Review Scoring System

References

[This is the first page] Principal
(Table of Contents)

»»Foreword by OWASP Chair»»
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Code_Review_Guide_Table_of_Contents&oldid=88957"