This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Code Review Guide Table of Contents"
From OWASP
(Turned two titles from "X" into "Reviewing X") |
m (Updated major part titles to title case) |
||
| Line 30: | Line 30: | ||
* [[Code Reviews and Compliance]] | * [[Code Reviews and Compliance]] | ||
| − | ==Examples by | + | ==Examples by Technical Control== |
* [[Codereview-Authentication|Authentication]] | * [[Codereview-Authentication|Authentication]] | ||
* [[Codereview-Authorization|Authorization]] | * [[Codereview-Authorization|Authorization]] | ||
| Line 39: | Line 39: | ||
* [[Codereview-Cryptographic_Controls|Cryptographic Controls]] | * [[Codereview-Cryptographic_Controls|Cryptographic Controls]] | ||
| − | ==Examples by | + | ==Examples by Vulnerability== |
* [[Reviewing Code for Buffer Overruns and Overflows]] | * [[Reviewing Code for Buffer Overruns and Overflows]] | ||
* [[Reviewing Code for OS Injection]] | * [[Reviewing Code for OS Injection]] | ||
| Line 50: | Line 50: | ||
* [[Reviewing Code for Race Conditions]] | * [[Reviewing Code for Race Conditions]] | ||
| − | == Language | + | == Language Specific Best Practice == |
===Java=== | ===Java=== | ||
Revision as of 12:44, 8 September 2010
Foreword by OWASP Chair
Frontispiece
Guide History
Methodology
- Introduction
- Preparation
- Security Code Review in the SDLC
- Security Code Review Coverage
- Application Threat Modeling
- Code Review Metrics
Crawling Code
- Crawling Code
- Searching for Code in J2EE/Java
- Searching for Code in Classic ASP
- JavaScript/Web 2.0 Keywords and Pointers
Code Reviews and PCI DSS
Examples by Technical Control
- Authentication
- Authorization
- Session Management
- Input Validation
- Error Handling
- Secure Deployment
- Cryptographic Controls
Examples by Vulnerability
- Reviewing Code for Buffer Overruns and Overflows
- Reviewing Code for OS Injection
- Reviewing Code for SQL Injection
- Reviewing Code for Data Validation
- Reviewing Code for Cross-Site Scripting
- Reviewing Code for Cross-Site Request Forgery
- Reviewing Code for Logging Issues
- Reviewing Code for Session Integrity
- Reviewing Code for Race Conditions
