This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Code Review Guide Table of Contents"

From OWASP
Jump to: navigation, search
m (Added in a section for Code Reviews and PCI as per discussion with EK.)
m (Switched a link from article to navigation shell)
 
(80 intermediate revisions by 4 users not shown)
Line 1: Line 1:
 +
{{LinkBar
 +
  | useprev=PrevLink | prev= | lblprev=
 +
  | usemain=MainLink | main=OWASP Code Review Guide Table of Contents | lblmain=Table of Contents
 +
  | usenext=NextLink | next=Code Review Guide Foreword | lblnext=Foreword by OWASP Chair
 +
}}
 
__NOTOC__
 
__NOTOC__
  
−
==[[Summer Of Code 2008 Index of Tasks Assigned]]==
 
  
 
==[[Code Review Guide Foreword|Foreword by OWASP Chair]]==
 
==[[Code Review Guide Foreword|Foreword by OWASP Chair]]==
  
−
==[[Code Review Guide Frontispiece |1. Frontispiece]]==
+
==Frontispiece==
−
 
 
−
'''[[Code Review Guide Frontispiece|1.1 About the OWASP Code Review Project]]'''
 
−
 
 
−
 
 
−
'''[[About The Open Web Application Security Project|1.2 About The Open Web Application Security Project]]'''
 
  
 +
* [[Code Review Guide Frontispiece|About the OWASP Code Review Project]]
 +
* [[OCRG1.1:About The Open Web Application Security Project|About The Open Web Application Security Project]]
  
 
==Guide History==
 
==Guide History==
−
[[Long long ago...]]
+
* [[Code Review Guide History]]
  
 
==Methodology==
 
==Methodology==
  
−
#[[Code Review Introduction|Introduction]]
+
*[[Code Review Introduction|Introduction]]
−
#[[Steps and Roles]]
+
*[[Code Review Preparation|Preparation]]
−
#[[Code Review Processes]]
+
*[[Security Code Review in the SDLC]]
−
#[[Transaction Analysis|Transactional Analysis]]
+
*[[Security Code Review Coverage]]
−
#[[How to write an application_security finding]]
+
*[[OCRG1.1:Application Threat Modeling|Application Threat Modeling]]
−
#[[Applicaiton Threat Modeling]]
+
*[[Code Review Metrics]]
−
#[[The Round Trip Code Review]]
 
−
#[[Code review Metrics]]
 
  
 
==Crawling Code==
 
==Crawling Code==
−
#[[Introduction]]
+
* [[Crawling Code]]
−
#[[First sweep of the code base]]
+
* [[Searching for Code in J2EE/Java]]
−
 
+
* [[Searching for Code in Classic ASP]]
−
==Code Reviews and the PCI DSS==
+
* [[JavaScript/Web 2.0 Keywords and Pointers]]
−
#[[Code Reviews and compliance]]
 
−
 
 
−
==Examples by technical control==
 
−
#[[Codereview-Authentication|Authentication]]
 
−
#[[Codereview-Authorisation|Authorisation]]
 
−
#[[Codereview-Session-Management|Session Management]]
 
−
#[[Codereview-Data-Validation|Data Validation]]
 
−
#[[Codereview-Error-Handling|Error Handling]]
 
  
 +
==Code Reviews and PCI DSS==
 +
* [[Code Reviews and Compliance]]
  
 +
==Examples by Technical Control==
 +
* [[Codereview-Authentication|Authentication]]
 +
* [[Codereview-Authorization|Authorization]]
 +
* [[Codereview-Session-Management|Session Management]]
 +
* [[Codereview-Input Validation|Input Validation]]
 +
* [[Codereview-Error-Handling|Error Handling]]
 +
* [[Codereview-Deployment|Secure Deployment]]
 +
* [[Codereview-Cryptographic_Controls|Cryptographic Controls]]
  
 
==Examples by Vulnerability==
 
==Examples by Vulnerability==
−
#[[Reviewing Code for Buffer Overruns and Overflows]]
+
* [[Reviewing Code for Buffer Overruns and Overflows]]
−
#[[Reviewing Code for OS Injection]]
+
* [[Reviewing Code for OS Injection]]
−
#[[Reviewing Code for SQL Injection]]
+
* [[Reviewing Code for SQL Injection]]
−
#[[Reviewing Code for Data Validation]]
+
* [[Reviewing Code for Data Validation]]
−
#[[Reviewing code for XSS issues]]
+
* [[Reviewing Code for Cross-Site Scripting]]
−
#[[Reviewing code for Cross-Site Request Forgery issues]]
+
* [[Reviewing Code for Cross-Site Request Forgery]]
−
#[[Reviewing Code for Error Handling]]
+
* [[Reviewing Code for Logging Issues]]
−
#[[Reviewing Code for Logging Issues]]
+
* [[Reviewing Code for Session Integrity]]
−
#[[Reviewing The Secure Code Environment]]
+
* [[Reviewing Code for Race Conditions]]
−
#[[Reviewing Code for Authorization Issues]]
 
−
#[[Reviewing Code for Authentication]]
 
−
#[[Reviewing Code for Session Integrity issues]]
 
−
#[[Reviewing Cryptographic Code]]
 
−
#[[Reviewing Code for Race Conditions]]
 
  
−
== Language specific best practice ==
+
== Language Specific Best Practice ==
  
 
===Java===
 
===Java===
−
#[[Java gotchas]]
+
*[[Java Gotchas]]
−
#[[Java leading security practice]]
+
*[[Leading Java Security Practice]]
  
 
===Classic ASP===
 
===Classic ASP===
−
#[[Classic_ASP_Design_Mistakes]]
+
*[[Classic ASP Design Mistakes]]
  
 
===PHP===
 
===PHP===
−
#[[PHP Security Leading Practice]]
+
*[[Leading PHP Security Practice]]
  
 
===C/C++===
 
===C/C++===
−
#[[Strings and Integers]]
+
*[[Strings and Integers]]
  
 
===MySQL===
 
===MySQL===
−
#[[Reviewing MySQL Security]]
+
*[[Reviewing MySQL Security]]
  
 
===Rich Internet Applications===
 
===Rich Internet Applications===
−
#[[Flash Applications]]
+
*[[Reviewing Flash Applications]]
−
#[[AJAX Applications]]
+
*[[Reviewing AJAX Applications]]
−
#[[Web Services]]
+
*[[Reviewing Web Services]]
  
−
== Example reports ==
+
== Example Reports ==
−
#[[How to write]]
+
* [[How to Write an Application Code Review Finding]]
−
#[[How to determine the risk level of a finding]]
 
−
#[[Sample form]]
 
  
−
==[[Automating Code Reviews]]==
+
==Automating Code Reviews==
−
#[[Preface ]]
+
* [[Automated Code Review]]
−
#[[Reasons for using automated tools]]
+
* [[Tool Deployment Model]]
−
#[[Education and cultural change]]
+
* [[Code Auditor Workbench Tool]]
−
#[[Tool Deployment Model]]
+
* [[The Owasp Orizon Framework]]
−
#[[Code Auditor Workbench Tool]]
 
−
#[[The Owasp Orizon Framework]]
 
  
−
==[[Ways to achieve secure code on a budget]]==
+
==[[The Owasp Code Review Top 9]]==
−
#[[The OWASP Enterprise Security API ( ESAPI)]]
 
−
#[[Resource & Budget]]
 
−
 
 
−
==[[The Owasp Code Review Top 10 flaw categories]]==
 
−
#[[Preface ]]
 
  
 
==[[The Owasp Code Review Scoring System]]==
 
==[[The Owasp Code Review Scoring System]]==
−
#[[Preface ]]
 
  
 
==[[References]]==
 
==[[References]]==
 +
 +
{{LinkBar
 +
  | useprev=PrevLink | prev= | lblprev=
 +
  | usemain=MainLink | main=OWASP Code Review Guide Table of Contents | lblmain=Table of Contents
 +
  | usenext=NextLink | next=Code Review Guide Foreword | lblnext=Foreword by OWASP Chair
 +
}}
  
 
[[Category:OWASP Code Review Project]]
 
[[Category:OWASP Code Review Project]]

Latest revision as of 15:27, 9 September 2010

[This is the first page] Principal
(Table of Contents)

»»Foreword by OWASP Chair»»


Foreword by OWASP Chair

Frontispiece

Guide History

Methodology

Crawling Code

Code Reviews and PCI DSS

Examples by Technical Control

Examples by Vulnerability

Language Specific Best Practice

Java

Classic ASP

PHP

C/C++

MySQL

Rich Internet Applications

Example Reports

Automating Code Reviews

The Owasp Code Review Top 9

The Owasp Code Review Scoring System

References

[This is the first page] Principal
(Table of Contents)

»»Foreword by OWASP Chair»»
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Code_Review_Guide_Table_of_Contents&oldid=88957"