This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Code Review Guide Table of Contents"
From OWASP
(→Examples by Vulnerability) |
(→Examples by Vulnerability) |
||
Line 11: | Line 11: | ||
==Examples by Vulnerability== | ==Examples by Vulnerability== | ||
#[[Reviewing Code for Buffer Overruns and Overflows|Reviewing Code for Buffer Overruns and Overflows]] | #[[Reviewing Code for Buffer Overruns and Overflows|Reviewing Code for Buffer Overruns and Overflows]] | ||
− | |||
#[[Reviewing Code for OS Injection]] | #[[Reviewing Code for OS Injection]] | ||
#[[OS Injection]] | #[[OS Injection]] |
Revision as of 10:43, 11 January 2007
Methodology
Design review
Examples by Vulnerability
- Reviewing Code for Buffer Overruns and Overflows
- Reviewing Code for OS Injection
- OS Injection
- SQL Injection
- Data Validation
- Reviewing Code for Data Validation
- Error Handling
- Reviewing Code for Error Handling
- Logging issues
- Reviewing Code for Logging Issues
- The Secure Code Environment
- Reviewing The Secure Code Environment
- Transaction Analysis
- Authorization
- Authentication
- Session Integrity
- Cross Site Request Forgery
- Cryptography
- Dangerous HTTP Methods
- Race Conditions
Language specific best practice
Java
- Inner classes
- Class comparison
- Cloneable classes
- Serializable classes
- Package scope and encapsulation
- Mutable objects
- Private methods & circumvention