Revision as of 01:46, 18 April 2013 (view source) Larry Conklin (talk | contribs) (Created page with " = '''OWASP Code Review Guide v2.0:''' = ==Forward== # Author Eoin Keary == Code Review Guide History == # Author - Eoin Keary == Introduction == # Author - Eoin Keary ===...")		Latest revision as of 01:27, 8 January 2016 (view source) Glenn 'devalias' Grant (talk | contribs) m (Glenn 'devalias' Grant moved page OWASP Code review V2 Table of Contents to OWASP Code Review V2 Table of Contents: Correct capitalisation as used on category page)
(89 intermediate revisions by 14 users not shown)
Line 3:		Line 3:
	==Forward==		==Forward==
−	# Author Eoin Keary
−
−	== Code Review Guide History ==
	# Author - Eoin Keary		# Author - Eoin Keary
		+	# Previous version to be updated:[[https://www.owasp.org/index.php/Code_Review_Guide_History]]
		+	'''[[CRV2_Forward|Content here]]'''
−	== Introduction ==	+	== Code Review Guide Introduction==
	# Author - Eoin Keary		# Author - Eoin Keary
		+	# Previous version to be updated:[[https://www.owasp.org/index.php/Code_Review_Introduction]]
		+	'''[[CRV2_Introduction|Content here]]'''
	=== What is source code review and Static Analysis ===		=== What is source code review and Static Analysis ===
−	# Author - Zyad Mghazli	+	=== What is Code Review ===
−	## New Section	+	# Author - Zyad Mghazli, Eoin Keary
		+	# New Section
		+	''' [[CRV2_WhatIsCodeReview|Content here]]'''
		+
		+	=== Manual Review - Pros and Cons ===
		+	# Author - Zyad Mghazli, Eoin Keary,Gary David Robinson
		+	# New Section
		+	# Suggestion: Benchmark of different Stataic Analysis Tools  Zyad Mghazli
		+	# [[CRV2_ManualReviewProsCons|Put content here]]
−	=== Manual Review - Pros and Cons	+	=== Advantages of Code Review to Development Practices ===
−	# Author - Ashish Rao	+	# Author - Gary David Robinson
−	## New Section	+	# New Section
−	### Suggestion: Benchmark of different Stataic Analysis Tools  Zyad Mghazli	+	# [[CRV2_AdvantagesToDevPractices|Put content here]]
	=== Why code review ===		=== Why code review ===
−	==== Scope and Objective of secure code review	+	==== Scope and Objective of secure code review ====
	# Author - Ashish Rao		# Author - Ashish Rao
		+	# [[CRV2_WhyCodeReview|Put content here]]
	=== We can't hack ourselves secure ===		=== We can't hack ourselves secure ===
−	# Author - Prathamesh Mhatre	+	# Author - Eoin Keary
−	## New Section	+	# New Section
		+	# [[CRV2_CantHackSecure|Put content here]]
		+
		+	=== 360 Review: Coupling source code review and Testing / Hybrid Reviews===
		+	# Author - eoin Keary
		+	# New Section
		+	# [[CRV2_360Review|Put content here]]
−	=== 360 Review: Coupling source code review and Testing / Hybrid Reviews	+	=== Can static code analyzers do it all? ===
	# Author - Ashish Rao		# Author - Ashish Rao
−	## New Section	+	# New Section
		+	# [[CRV2_CanStaticAnalyzersDoAll|Put content here]]
		+
		+	=Methodology=
		+	===The code review approach===
		+	#Author -  Johanna Curiel
		+	# [[CRV2_CodeReviewApproach|Put content here]]
		+
		+	==== Preparation and context ====
		+	# Author - Gary David Robinson
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Review_Preparation]]
		+	# [[CRV2_PrepContext|Put content here]]
		+
		+	====Application Threat Modeling====
		+	#Author - Larry Conklin
		+	# Previous version to be updated: [[https://www.owasp.org/OCRG1.1:Application_Threat_Modeling]]
		+	# [[CRV2_AppThreatModeling|Put content here]]
		+
		+	====Understanding Code layout/Design/Architecture====
		+	#Author - Open
		+	# [[CRV2_CodeLayoutDesignArch|Put content here]]
		+	====Understanding Business Logic====
		+	#[[CRV2_BusinessLogic|Put content here]]
		+
		+	===SDLC Integration===
		+	#Author - Larry Conklin
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Security_Code_Review_in_the_SDLC]]
		+	# [[CRV2_SDLCInt|Put content here]]
		+
		+	====Deployment Models====
		+	=====Secure deployment configurations=====
		+	#Author -
		+	# [[CRV2_SecDepConfig|Put content here]]
		+
		+	# New Section
		+	=====Metrics and code review=====
		+	#Author [email protected]
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Review_Metrics]]
		+	# [[CRV2_MetricsCodeRev|Put content here]]
		+
		+	=====Source and sink reviews=====
		+	#Author - Open
		+	# New Section
		+	# [[CRV2_SourceSinkRev|Put content here]]
		+
		+	=====Code review Coverage=====
		+	#Author - Open
		+	#Previous version to be updated: [[https://www.owasp.org/index.php/Code_Review_Coverage]]
		+	# [[CRV2_CodeRevCoverage|Put content here]]
		+
		+	=====Design Reviews=====
		+	#Author - Ashish Rao
		+	*Why to review design?
		+	**Building security in design - secure by design principle
		+	**Design Areas to be reviewed
		+	**Common Design Flaws
		+	# [[CRV2_DesignRev|Put content here]]
		+
		+	=====A Risk based approach to code review=====
		+	#Author - Gary David Robinson
		+	#New Section
		+	*"Doing things right or doing the right things..."
		+	**"Not all bugs are equal
		+	# [[CRV2_RiskBasedApproach|Put content here]]
		+
		+	====Crawling code====
		+	#Author - Open
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Crawling_Code]]
		+	*API of Interest:
		+	**Java
		+	**.NET
		+	**PHP
		+	**RUBY
		+	*Frameworks:
		+	**Spring
		+	**.NET MVC
		+	**Struts
		+	**Zend
		+	#New Section
		+	*Searching for code in C/C++
		+	#Author - Gary David Robinson
		+
		+	# [[CRV2_CrawlingCode|Put content here]]
		+
		+	====Code reviews and Compliance====
		+	#Author -Open
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Code_Reviews_and_Compliance]]
		+	# [[CRV2_CodeRevCompliance|Put content here]]
		+
		+	=Reviewing by Technical Control=
		+	===Reviewing code for Authentication controls===
		+	#Author - Gary Robinson
		+	# [[CRV2_AuthControls|Put content here]]
		+
		+	====Forgot password====
		+	#Author Abbas Naderi, Larry Conklin
		+	# [[CRV2_ForgotPassword|Put content here]]
		+
		+	====CAPTCHA====
		+	#Author Larry Conklin, Joan Renchie
		+	'''[[CRV2_CAPTCHA|Content here]]'''
−	=== Can static code analyzers do it all?	+	====Out of Band considerations====
−	# Author - Ashish Rao	+	#Author - Gary Robinson
−	## New Section	+	# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Authentication]]
		+	# [[CRV2_OutofBand|Put content here]]
		+
		+	===Reviewing code Authorization weakness===
		+	#Author Eoin Keary .NET MVC added
		+	# [[CRV2_AuthorizationWeaknesses|Put content here]]
		+
		+	====Checking authz upon every request====
		+	#Author - Abbas Naderi
		+	# [[CRV2_CheckAuthzEachRequest|Put content here]]
		+
		+	====Reducing the attack surface====
		+	#Author Gary Robinson
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Authorization]]
		+	# [[CRV2_ReducingAttSurf|Put content here]]
		+
		+	====SSL/TLS Implementations====
		+	#Author - Eoin Keary
		+	# [[CRV2_SSL-TLS|Put content here]]
		+
		+	====Reviewing code for Session handling====
		+	#Author - Abbas Naderi
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Session-Management]]
		+	# [[CRV2_SessionHandling|Put content here]]
		+
		+	====Reviewing client side code====
		+	#New Section
		+	# [[CRV2_ClientSideCodeIntro|Put content here]]
		+
		+	=====Javascript=====
		+	#Author - Abbas Naderi
		+	# [[CRV2_ClientSideCodeJScript|Put content here]]
		+
		+	=====JSON=====
		+	#Author - Open
		+	# [[CRV2_ClientSideCodeJSon|Put content here]]
		+
		+	=====Content Security Policy=====
		+	#Author - Open
		+	# [[CRV2_ClientSideCodeContSecPolicy|Put content here]]
		+
		+	====="Jacking"/Framing=====
		+	#Author - Eoin  Keary
		+	# [[CRV2_ClientSideCodeJackingFraming|Put content here]]
		+
		+	=====HTML 5?=====
		+	#Author - Open
		+	# [[CRV2_ClientSideCodeHTML5|Put content here]]
		+
		+	=====Browser Defenses=====
		+	#Author - Open
		+	# [[CRV2_ClientSideCodeBrowserDefPol|Put content here]]
		+
		+	=====etc...=====
		+
		+	====Review code for input validation====
		+	#Author - Open
		+	# [[CRV2_InputValIntro|Put content here]]
		+
		+	=====Regex Gotchas=====
		+	#Author - Open
		+	#New Section
		+	# [[CRV2_InputValRegexGotchas|Put content here]]
		+
		+	=====ESAPI=====
		+	#Author - Open
		+	#New Section
		+	# Internal Link: [[https://www.owasp.org/index.php/Codereview-Input_Validation]]
		+	# [[CRV2_InputValESAPI|Put content here]]
		+
		+	=====Microsoft Web Protection Library=====
		+	#Author - Michael Hidalgo
		+	#New Section
		+	# Internal Link: [[https://www.owasp.org/index.php/Codereview-Input_Validation]]
		+	# [[CRV2_InputValMicrosoftWebProtectionLibrary|Put content here]]
		+
		+	====Reviewing code for contextual encoding====
		+	[[Overall approach to content encoding and anti XSS]]
		+	=====HTML Attribute=====
		+	#Author - Eoin Keary
		+	# [[CRV2_ContextEncHTMLAttribute|Put content here]]
		+
		+	=====HTML Entity=====
		+	#Author - Eoin Keary
		+	# [[CRV2_ContextEncHTMLEntity|Put content here]]
		+
		+	=====Javascript Parameters=====
		+	#Author - Eoin Keary
		+	# [[CRV2_ContextEncJscriptParams|Put content here]]
		+
		+	=====JQuery=====
		+	#Author - Open
		+	# [[CRV2_ContextEncJQuery|Put content here]]
		+
		+	====Reviewing file and resource handling code====
		+	#Author - Open
		+	# [[CRV2_FileResourceHandling|Put content here]]
		+
		+	====Resource Exhaustion - error handling====
		+	#Author - Open
		+	# [[CRV2_ResourceExhaustionErrHandling|Put content here]]
		+
		+	=====native calls=====
		+	#Author Open
		+	# [[CRV2_ResourceExhaustionNativeCalls|Put content here]]
		+
		+	====Reviewing Logging code - Detective Security====
		+	#Author - Gary Robinson
		+	* Where to Log
		+	* What to log
		+	* What not to log
		+	* How to log
		+	# Internal link: [[https://www.owasp.org/index.php/Logging_Cheat_Sheet]]
		+	# [[CRV2_LoggingCode|Put content here]]
		+
		+	====Reviewing Error handling and Error messages====
		+	#Author - Gary David Robinson
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Error-Handling]]
		+	# [[CRV2_ErrorHandlingMessages|Put content here]]
		+
		+	====Reviewing Security alerts====
		+	#Author - Gary Robinson
		+	# [[CRV2_SecurityAlerts|Put content here]]
		+
		+	====Review for active defense====
		+	#Author - Colin Watson
		+	# [[CRV2_ActiveDefense|Put content here]]
		+
		+	====Reviewing Secure Storage====
		+	#Author - Open source
		+	# New Section
		+	# [[CRV2_SecureStorage|Put content here]]
		+
		+	====Hashing & Salting - When, How and Where====
		+	=====Encryption=====
		+	======.NET======
		+	#Author Larry Conklin, Joan Renchie
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Codereview-Cryptographic_Controls]]
		+	*''Can we talk about key storage as well i.e. key management for encryption techniques used in the application? - Ashish Rao''
		+	'''[[CRV2_HashingandSaltingdotNet|Content here]]'''
		+
		+	=Reviewing by Vulnerability=
		+	===Review Code for XSS===
		+	#Author Examples added by Eoin Keary
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_Cross-Site_Scripting]]
		+	# In reviewing code for XSS - we can give more patterns on "source to sink" patterns for ASP.NET wrf to difference versions and mechanisms to display data in a page - Ashish Rao
		+	# [[CRV2_RevCodeXSS|Put content here]]
		+
		+	===Persistent - The Anti pattern===
		+	#Author
		+	# [[CRV2_RevCodePersistentAntiPatternIntro|Put content here]]
		+
		+	====.NET====
		+	#Author Johanna Curiel, Eoin Keary
		+	# [[CRV2_RevCodePersistentAntiPatterndotNet|Put content here]]
		+
		+	====.Java====
		+	#Author Johanna Curiel
		+	# [[CRV2_RevCodePersistentAntiPatternJava|Put content here]]
		+
		+	====PHP====
		+	#Author Abbas Naderi
		+	# [[CRV2_RevCodePersistentAntiPatternPHP|Put content here]]
		+
		+	====Ruby====
		+	#Author Open
		+	# [[CRV2_RevCodePersistentAntiPatternRuby|Put content here]]
		+
		+	===Reflected - The Anti pattern===
		+	# [[CRV2_RevCodeReflectedAntiPatternIntro|Put content here]]
		+
		+	====.NET====
		+	#Author Johanna Curiel
		+	# [[CRV2_RevCodeReflectedAntiPatterndotNet|Put content here]]
		+
		+	====.Java====
		+	#Author Johanna Curiel
		+	# [[CRV2_RevCodeReflectedAntiPatternJava|Put content here]]
		+
		+	====PHP====
		+	#Author Abbas Naderi
		+	# [[CRV2_RevCodeReflectedAntiPatternPHP|Put content here]]
		+
		+	====Ruby====
		+	# Author - Open
		+	# [[CRV2_RevCodeReflectedAntiPatternIRuby|Put content here]]
		+
		+	===Stored - The Anti pattern===
		+	# Author - Johanna Curiel
		+	# [[CRV2_RevCodeStoredAntiPatternIntro|Put content here]]
		+
		+	====.NET====
		+	#Author Johanna Curiel
		+	# [[CRV2_RevCodeStoredAntiPatterndotNET|Put content here]]
		+
		+	====.Java====
		+	#Author Johanna Curiel
		+	# [[CRV2_RevCodeStoredAntiPatternJava|Put content here]]
		+
		+	====PHP====
		+	#Author Johanna Curiel
		+	# [[CRV2_RevCodeStoredAntiPatternPHP|Put content here]]
		+
		+	====Ruby====
		+	#Author - Johanna Curiel
		+	# [[CRV2_RevCodeStoredAntiPatternRuby|Put content here]]
		+
		+	===DOM XSS ===
		+	#Author Larry Conklin
		+	# [[CRV2_DOMXSS|Put content here]]
		+
		+	===JQuery mistakes===
		+	#Author
		+	# [[CRV2_JQueryMistakes|Put content here]]
		+
		+	===Reviewing code for SQL Injection===
		+	#Author Gary Robinson
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_SQL_Injection]]
		+	# [[CRV2_RevCodeSQLInjection|Put content here]]
		+
		+	====PHP====
		+	#Author - Mennouchi Islam Azeddine
		+	# [[CRV2_SQLInjPHP|Put content here]]
		+
		+	====Java====
		+	#Author - Johanna Curiel
		+	# [[CRV2_SQLInjJava|Put content here]]
		+
		+	====.NET====
		+	#Author - Open
		+	# [[CRV2_SQLInjdotNET|Put content here]]
		+
		+	====HQL====
		+	#Author - Open
		+	# [[CRV2_SQLInjHQL|Put content here]]
		+
		+	===The Anti pattern===
		+	#Author Larry Conklin
		+	#[[CRV2_AntiPattern| Content here]]
		+	https://www.owasp.org/index.php/CRV2_AntiPattern
		+	====PHP====
		+	#Author -
		+	# [[CRV2_AntiPatternPHP|Put content here]]
		+
		+	====Java====
		+	#Author -
		+	#=> Searching for traditional SQL,JPA,JPSQL,Criteria,...
		+	# [[CRV2_AntiPatternJava|Put content here]]
		+
		+	====.NET====
		+	#Author Open
		+	# [[CRV2_AntiPatterndotNet|Put content here]]
		+
		+	====Ruby====
		+	#Author - Open
		+	# [[CRV2_AntiPatternRuby|Put content here]]
		+
		+	====Cold Fusion====
		+	#Author - Open
		+	# [[CRV2_AntiPatternColdFusion|Put content here]]
		+
		+	===Reviewing code for CSRF Issues===
		+	#Author Abbas Naderi
		+	# Previous version to be updated: [[https://www.owasp.org/index.php/Reviewing_Code_for_Cross-Site_Request_Forgery]]
		+	# This page needs to be deleted. [[CRV2_CSRFIssues|Put content here]]
		+
		+	===(This task has been deleted) Transactional logic / Non idempotent functions / State Changing Functions===
		+	# [[CRV2_TransLogic|Put content here]]
		+
		+	===Reviewing code for poor logic /Business logic/Complex authorization===
		+	#Author - Open
		+	# [[CRV2_PoorLogic|Put content here]]
		+
		+	===Reviewing Secure Communications===
		+	====.NET Config====
		+	#Author Johanna Curiel, Renchie Joan
		+	# [[CRV2_SecCommsdotNet|Put content here]]
		+
		+	====Spring Config====
		+	#Author - Open
		+	# [[CRV2_SecCommsSpringConfig|Put content here]]
		+
		+	====HTTP Headers====
		+	#Author Gary Robinson
		+	# [[CRV2_SecCommsHTTPHdrs|Put content here]]
		+
		+	===Tech-Stack pitfalls===
		+	#Author Open
		+	# [[CRV2_TechStackPitfalls|Put content here]]
		+
		+	===Framework specific Issues===
		+	====Spring====
		+	#Author - Open
		+	# [[CRV2_FrameworkSpecIssuesSpring|Put content here]]
		+
		+	====Struts====
		+	#Author - Open
		+	# [[CRV2_FrameworkSpecIssuesStruts|Put content here]]
		+
		+	====Drupal====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesDrupal|Put content here]]
		+
		+	====Ruby on Rails====
		+	#Author - Open
		+	# [[CRV2_FrameworkSpecIssuesROR|Put content here]]
		+
		+	====Django====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesDjango|Put content here]]
		+
		+	====.NET Security / MVC====
		+	#Author Johanna Curiel, Eoin Keary
		+	# [[CRV2_FrameworkSpecIssuesdotNetMVC|Put content here]]
		+
		+	====Security in ASP.NET applications====
		+	#Author Johanna Curiel
		+	# [[CRV2_FrameworkSpecIssuesASPNet|Put content here]]
		+
		+	=====Strongly Named Assemblies=====
		+	#Author Johanna Curiel, Larry Conklin
		+	# [[CRV2_FrameworkSpecIssuesASPNetStrongAssembiles|Put content here]]
		+
		+	======Round Tripping======
		+	# Author - Open
		+	# [[CRV2_FrameworkSpecIssuesASPNetRT|Put content here]]
		+
		+	======How to prevent Round tripping======
		+	# Author - Open
		+	#Author Johanna Curiel
		+	# [[CRV2_FrameworkSpecIssuesASPNetRTPrevention|Put content here]]
		+
		+	=====Setting the right Configurations=====
		+	#Author Johanna Curiel
		+	# [[CRV2_FrameworkSpecIssuesASPNetConfigs|Put content here]]
		+
		+	=====Authentication Options=====
		+	#Author Johanna Curiel
		+	# [[CRV2_FrameworkSpecIssuesASPNetAuth|Put content here]]
		+
		+	=====Code Review for Managed Code - .Net 1.0 and up=====
		+	#Author Johanna Curiel
		+	# [[CRV2_FrameworkSpecIssuesASPNetManagedCode|Put content here]]
		+
		+	=====Using OWASP Top 10 as your guideline=====
		+	#Author Johanna Curiel
		+	# [[CRV2_FrameworkSpecIssuesASPTop10|Put content here]]
		+
		+	=====Code review for Unsafe Code (C#)=====
		+	#Author Johanna Curiel
		+	# [[CRV2_FrameworkSpecIssuesASPNetUnsafeCode|Put content here]]
		+
		+	====PHP Specific Issues====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesPHP|Put content here]]
		+
		+	====Classic ASP====
		+	#Author Johanna Curiel
		+	# [[CRV2_FrameworkSpecIssuesASPClassic|Put content here]]
		+
		+	====C#====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesCsharp|Put content here]]
		+
		+	====C/C++====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesCplusplus|Put content here]]
		+
		+	====Objective C====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesObectiveC|Put content here]]
		+
		+	====Java====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesJava|Put content here]]
		+
		+	====Android====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesAndroid|Put content here]]
		+
		+	====Coldfusion====
		+	#Author Open
		+	# [[CRV2_FrameworkSpecIssuesColdfusion|Put content here]]
		+
		+	====CodeIgniter====
		+
		+	# Author Open
		+	# [[CRV2_FrameworkSpecIssuesCodeIgniter|Put content here]]
		+
		+	=Security code review for Agile development=
		+	#Author Carlos Pantelides
		+	# [[CRV2_CodeReviewAgile|Put content here]]
		+
		+	=Code Review for Backdoors=
		+	#Author Yiannis Pavlosoglou
		+	The review of a piece of source code for backdoors has one excruciating difference to a traditional source code review: The fact that someone with 'commit' or 'write' access to the source code repository has malicious intentions spanning well beyond their current developer remit. Because of this difference, a code review for backdoors is often seen as a very specialised review and can sometimes be considered not a code review per say.
		+
		+	A traditional code review has the objective of determining if a vulnerability is present within the code, further to this if the vulnerability is exploitable and under what conditions. A code review for backdoors has the objective to determine if a certain portion of the codebase is carrying code that is unnecessary for the logic and implementation of the use cases it serves.
		+
		+	Further to this, the reviewer, looks for the trigger points of that logic. Typical examples include a branch statement going off to a part of assembly or obfuscated code. The reviewer is looking for patterns of abnormality in terms of code segments that would not be expected to be present under normal conditions.
−	==Methodology==	+	An excellent introduction into how to look for rootkits in the Java programming language can be found [https://www.blackhat.com/presentations/bh-usa-09/WILLIAMS/BHUSA09-Williams-EnterpriseJavaRootkits-PAPER.pdf  here]. In this paper J. Williams covers a variety of backdoor examples including file system access through a web server, as well as time based attacks involving a key aspect of malicious functionality been made available after a certain amount of time. Such examples form the foundation of what any reviewer for back doors should try to automate, regardless of the language in which the review is taking place.
		+
		+	=Code Review Tools=
		+	https://www.owasp.org/index.php/CRV2_CodeReviewTools

---

Latest revision as of 01:27, 8 January 2016

OWASP Code Review Guide v2.0:

Forward

1. Author - Eoin Keary
2. Previous version to be updated:[[1]]

Content here

Code Review Guide Introduction

1. Author - Eoin Keary
2. Previous version to be updated:[[2]]

Content here

What is source code review and Static Analysis

What is Code Review

1. Author - Zyad Mghazli, Eoin Keary
2. New Section

Content here

Manual Review - Pros and Cons

1. Author - Zyad Mghazli, Eoin Keary,Gary David Robinson
2. New Section
3. Suggestion: Benchmark of different Stataic Analysis Tools Zyad Mghazli
4. Put content here

Advantages of Code Review to Development Practices

1. Author - Gary David Robinson
2. New Section
3. Put content here

Why code review

Scope and Objective of secure code review

1. Author - Ashish Rao
2. Put content here

We can't hack ourselves secure

1. Author - Eoin Keary
2. New Section
3. Put content here

360 Review: Coupling source code review and Testing / Hybrid Reviews

1. Author - eoin Keary
2. New Section
3. Put content here

Can static code analyzers do it all?

1. Author - Ashish Rao
2. New Section
3. Put content here

Methodology

The code review approach

1. Author - Johanna Curiel
2. Put content here

Preparation and context

1. Author - Gary David Robinson
2. Previous version to be updated: [[3]]
3. Put content here

Application Threat Modeling

1. Author - Larry Conklin
2. Previous version to be updated: [[4]]
3. Put content here

Understanding Code layout/Design/Architecture

1. Author - Open
2. Put content here

Understanding Business Logic

1. Put content here

SDLC Integration

1. Author - Larry Conklin
2. Previous version to be updated: [[5]]
3. Put content here

Deployment Models

Secure deployment configurations

1. Author -
2. Put content here

1. New Section

Metrics and code review

1. Author [email protected]
2. Previous version to be updated: [[6]]
3. Put content here

Source and sink reviews

1. Author - Open
2. New Section
3. Put content here

Code review Coverage

1. Author - Open
2. Previous version to be updated: [[7]]
3. Put content here

Design Reviews

1. Author - Ashish Rao

• Why to review design?
  • Building security in design - secure by design principle
  • Design Areas to be reviewed
  • Common Design Flaws

1. Put content here

A Risk based approach to code review

1. Author - Gary David Robinson
2. New Section

• "Doing things right or doing the right things..."
  • "Not all bugs are equal

1. Put content here

Crawling code

1. Author - Open
2. Previous version to be updated: [[8]]

• API of Interest:
  • Java
  • .NET
  • PHP
  • RUBY
• Frameworks:
  • Spring
  • .NET MVC
  • Struts
  • Zend

1. New Section

• Searching for code in C/C++

1. Author - Gary David Robinson

1. Put content here

Code reviews and Compliance

1. Author -Open
2. Previous version to be updated: [[9]]
3. Put content here

Reviewing by Technical Control

Reviewing code for Authentication controls

1. Author - Gary Robinson
2. Put content here

Forgot password

1. Author Abbas Naderi, Larry Conklin
2. Put content here

CAPTCHA

1. Author Larry Conklin, Joan Renchie

Content here

Out of Band considerations

1. Author - Gary Robinson
2. Previous version to be updated: [[10]]
3. Put content here

Reviewing code Authorization weakness

1. Author Eoin Keary .NET MVC added
2. Put content here

Checking authz upon every request

1. Author - Abbas Naderi
2. Put content here

Reducing the attack surface

1. Author Gary Robinson
2. Previous version to be updated: [[11]]
3. Put content here

SSL/TLS Implementations

1. Author - Eoin Keary
2. Put content here

Reviewing code for Session handling

1. Author - Abbas Naderi
2. Previous version to be updated: [[12]]
3. Put content here

Reviewing client side code

1. New Section
2. Put content here

Javascript

1. Author - Abbas Naderi
2. Put content here

JSON

1. Author - Open
2. Put content here

Content Security Policy

1. Author - Open
2. Put content here

"Jacking"/Framing

1. Author - Eoin Keary
2. Put content here

HTML 5?

1. Author - Open
2. Put content here

Browser Defenses

1. Author - Open
2. Put content here

etc...

Review code for input validation

1. Author - Open
2. Put content here

Regex Gotchas

1. Author - Open
2. New Section
3. Put content here

ESAPI

1. Author - Open
2. New Section
3. Internal Link: [[13]]
4. Put content here

Microsoft Web Protection Library

1. Author - Michael Hidalgo
2. New Section
3. Internal Link: [[14]]
4. Put content here

Reviewing code for contextual encoding

Overall approach to content encoding and anti XSS

HTML Attribute

1. Author - Eoin Keary
2. Put content here

HTML Entity

1. Author - Eoin Keary
2. Put content here

Javascript Parameters

1. Author - Eoin Keary
2. Put content here

JQuery

1. Author - Open
2. Put content here

Reviewing file and resource handling code

1. Author - Open
2. Put content here

Resource Exhaustion - error handling

1. Author - Open
2. Put content here

native calls

1. Author Open
2. Put content here

Reviewing Logging code - Detective Security

1. Author - Gary Robinson

• Where to Log
• What to log
• What not to log
• How to log

1. Internal link: [[15]]
2. Put content here

Reviewing Error handling and Error messages

1. Author - Gary David Robinson
2. Previous version to be updated: [[16]]
3. Put content here

Reviewing Security alerts

1. Author - Gary Robinson
2. Put content here

Review for active defense

1. Author - Colin Watson
2. Put content here

Reviewing Secure Storage

1. Author - Open source
2. New Section
3. Put content here

Hashing & Salting - When, How and Where

Encryption

.NET

1. Author Larry Conklin, Joan Renchie
2. Previous version to be updated: [[17]]

• Can we talk about key storage as well i.e. key management for encryption techniques used in the application? - Ashish Rao

Content here

Reviewing by Vulnerability

Review Code for XSS

1. Author Examples added by Eoin Keary
2. Previous version to be updated: [[18]]
3. In reviewing code for XSS - we can give more patterns on "source to sink" patterns for ASP.NET wrf to difference versions and mechanisms to display data in a page - Ashish Rao
4. Put content here

Persistent - The Anti pattern

1. Author
2. Put content here

.NET

1. Author Johanna Curiel, Eoin Keary
2. Put content here

.Java

1. Author Johanna Curiel
2. Put content here

PHP

1. Author Abbas Naderi
2. Put content here

Ruby

1. Author Open
2. Put content here

Reflected - The Anti pattern

1. Put content here

.NET

1. Author Johanna Curiel
2. Put content here

.Java

1. Author Johanna Curiel
2. Put content here

PHP

1. Author Abbas Naderi
2. Put content here

Ruby

1. Author - Open
2. Put content here

Stored - The Anti pattern

1. Author - Johanna Curiel
2. Put content here

.NET

1. Author Johanna Curiel
2. Put content here

.Java

1. Author Johanna Curiel
2. Put content here

PHP

1. Author Johanna Curiel
2. Put content here

Ruby

1. Author - Johanna Curiel
2. Put content here

DOM XSS

1. Author Larry Conklin
2. Put content here

JQuery mistakes

1. Author
2. Put content here

Reviewing code for SQL Injection

1. Author Gary Robinson
2. Previous version to be updated: [[19]]
3. Put content here

PHP

1. Author - Mennouchi Islam Azeddine
2. Put content here

Java

1. Author - Johanna Curiel
2. Put content here

.NET

1. Author - Open
2. Put content here

HQL

1. Author - Open
2. Put content here

The Anti pattern

1. Author Larry Conklin
2. Content here

https://www.owasp.org/index.php/CRV2_AntiPattern

PHP

1. Author -
2. Put content here

Java

1. Author -
2. => Searching for traditional SQL,JPA,JPSQL,Criteria,...
3. Put content here

.NET

1. Author Open
2. Put content here

Ruby

1. Author - Open
2. Put content here

Cold Fusion

1. Author - Open
2. Put content here

Reviewing code for CSRF Issues

1. Author Abbas Naderi
2. Previous version to be updated: [[20]]
3. This page needs to be deleted. Put content here

(This task has been deleted) Transactional logic / Non idempotent functions / State Changing Functions

1. Put content here

Reviewing code for poor logic /Business logic/Complex authorization

1. Author - Open
2. Put content here

Reviewing Secure Communications

.NET Config

1. Author Johanna Curiel, Renchie Joan
2. Put content here

Spring Config

1. Author - Open
2. Put content here

HTTP Headers

1. Author Gary Robinson
2. Put content here

Tech-Stack pitfalls

1. Author Open
2. Put content here

Framework specific Issues

Spring

1. Author - Open
2. Put content here

Struts

1. Author - Open
2. Put content here

Drupal

1. Author Open
2. Put content here

Ruby on Rails

1. Author - Open
2. Put content here

Django

1. Author Open
2. Put content here

.NET Security / MVC

1. Author Johanna Curiel, Eoin Keary
2. Put content here

Security in ASP.NET applications

1. Author Johanna Curiel
2. Put content here

Strongly Named Assemblies

1. Author Johanna Curiel, Larry Conklin
2. Put content here

Round Tripping

1. Author - Open
2. Put content here

How to prevent Round tripping

1. Author - Open
2. Author Johanna Curiel
3. Put content here

Setting the right Configurations

1. Author Johanna Curiel
2. Put content here

Authentication Options

1. Author Johanna Curiel
2. Put content here

Code Review for Managed Code - .Net 1.0 and up

1. Author Johanna Curiel
2. Put content here

Using OWASP Top 10 as your guideline

1. Author Johanna Curiel
2. Put content here

Code review for Unsafe Code (C#)

1. Author Johanna Curiel
2. Put content here

PHP Specific Issues

1. Author Open
2. Put content here

Classic ASP

1. Author Johanna Curiel
2. Put content here

C#

1. Author Open
2. Put content here

C/C++

1. Author Open
2. Put content here

Objective C

1. Author Open
2. Put content here

Java

1. Author Open
2. Put content here

Android

1. Author Open
2. Put content here

Coldfusion

1. Author Open
2. Put content here

CodeIgniter

1. Author Open
2. Put content here

Security code review for Agile development

1. Author Carlos Pantelides
2. Put content here

Code Review for Backdoors

1. Author Yiannis Pavlosoglou

The review of a piece of source code for backdoors has one excruciating difference to a traditional source code review: The fact that someone with 'commit' or 'write' access to the source code repository has malicious intentions spanning well beyond their current developer remit. Because of this difference, a code review for backdoors is often seen as a very specialised review and can sometimes be considered not a code review per say.

A traditional code review has the objective of determining if a vulnerability is present within the code, further to this if the vulnerability is exploitable and under what conditions. A code review for backdoors has the objective to determine if a certain portion of the codebase is carrying code that is unnecessary for the logic and implementation of the use cases it serves.

Further to this, the reviewer, looks for the trigger points of that logic. Typical examples include a branch statement going off to a part of assembly or obfuscated code. The reviewer is looking for patterns of abnormality in terms of code segments that would not be expected to be present under normal conditions.

An excellent introduction into how to look for rootkits in the Java programming language can be found here. In this paper J. Williams covers a variety of backdoor examples including file system access through a web server, as well as time based attacks involving a key aspect of malicious functionality been made available after a certain amount of time. Such examples form the foundation of what any reviewer for back doors should try to automate, regardless of the language in which the review is taking place.

Code Review Tools

https://www.owasp.org/index.php/CRV2_CodeReviewTools