This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Code Review Guide Table of Contents"
From OWASP
(→Rich Internet Applications) |
|||
Line 1: | Line 1: | ||
__NOTOC__ | __NOTOC__ | ||
− | |||
==[[Code Review Guide Foreword|Foreword by OWASP Chair]]== | ==[[Code Review Guide Foreword|Foreword by OWASP Chair]]== |
Revision as of 12:30, 21 October 2008
Foreword by OWASP Chair
1. Frontispiece
1.1 About the OWASP Code Review Project
1.2 About The Open Web Application Security Project
Guide History
Methodology
- Introduction
- Code Review Processes
- Steps and Roles
- Code Review and the SDLC
- Transactional Analysis
- Application Threat Modeling
- Code review Metrics
Crawling Code
Code Reviews and the PCI DSS
Examples by technical control
- Authentication
- Authorisation
- Session Management
- Input Validation
- Error Handling
- Secure Deployment
- Cryptographic controls
Examples by vulnerability
- Reviewing Code for Buffer Overruns and Overflows
- Reviewing Code for OS Injection
- Reviewing Code for SQL Injection
- Reviewing Code for Data Validation
- Reviewing Code for Cross-site scripting
- Reviewing code for Cross-Site Request Forgery issues
- Reviewing Code for Logging Issues
- Reviewing Code for Session Integrity issues
- Reviewing Code for Race Conditions
Language specific best practice
Java
Classic ASP
PHP
C/C++
MySQL
Rich Internet Applications
Example reports
Automating Code Reviews
- Preface
- Reasons for using automated tools
- Education and cultural change
- Tool Deployment Model
- Code Auditor Workbench Tool
- The Owasp Orizon Framework