This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Summer Of Code 2008 Index of Tasks Assigned"
| Line 5: | Line 5: | ||
Steps and Roles<br> | Steps and Roles<br> | ||
Code Review Processes<br> | Code Review Processes<br> | ||
| − | Transaction Analysis<br> | + | Transaction Analysis<b> Want to update</b><br> |
How to write an application_security finding<br> | How to write an application_security finding<br> | ||
| − | Applicaiton Threat Modeling<br> | + | Applicaiton Threat Modeling<b> NEW-Author Name:<Add Here> </b><br> |
| − | The Round Trip Code Review<br> | + | The Round Trip Code Review<b> NEW-Author Name:<Add Here> </b><br> |
| − | Code review Metrics<br> | + | Code review Metrics<b> NEW-Author Name:<Add Here> </b><br> |
Crawling Code<br> | Crawling Code<br> | ||
| Line 48: | Line 48: | ||
Reviewing MySQL Security<br> | Reviewing MySQL Security<br> | ||
| + | <b>Need to Update and add additional examples and text</b><br> | ||
Rich Internet Applications<br> | Rich Internet Applications<br> | ||
Flash Applications<br> | Flash Applications<br> | ||
| Line 54: | Line 55: | ||
Example reports <br> | Example reports <br> | ||
| − | How to write<br> | + | How to write<b> NEW-Author Name:<Add Here> </b><br> |
| − | How to determine the risk level of a finding<br> | + | How to determine the risk level of a finding<b> NEW-Author Name:<Add Here> </b><br> |
| − | Sample form<br> | + | Sample form<b> NEW-Author Name:<Add Here> </b><br> |
Automating Code Reviews<br> | Automating Code Reviews<br> | ||
| Line 67: | Line 68: | ||
Ways to achieve secure code on a budget<br> | Ways to achieve secure code on a budget<br> | ||
| − | The OWASP Enterprise Security API ( ESAPI)<br> | + | The OWASP Enterprise Security API ( ESAPI)<b> NEW-Author Name:<Add Here> </b><br> |
| − | Resource & Budget<br> | + | Resource & Budget<b> NEW-Author Name:<Add Here> </b><br> |
| + | |||
References<br> | References<br> | ||
Revision as of 15:13, 7 May 2008
OWASP Code Review Guide Table of Contents
Methodology
Code Review Introduction|Introduction
Steps and Roles
Code Review Processes
Transaction Analysis Want to update
How to write an application_security finding
Applicaiton Threat Modeling NEW-Author Name:<Add Here>
The Round Trip Code Review NEW-Author Name:<Add Here>
Code review Metrics NEW-Author Name:<Add Here>
Crawling Code
Introduction
First sweep of the code base
Examples by Vulnerability
The Following sections need to be updated. Extra examples of good and bad code needed. Diagrams and flows regarding solutions. Additional vulnerabilities to be added also
Reviewing Code for Buffer Overruns and Overflows
Reviewing Code for OS Injection
Reviewing Code for SQL Injection
Reviewing Code for Data Validation
Reviewing code for XSS issues
Reviewing code for Cross-Site Request Forgery issues
Reviewing Code for Error Handling
Reviewing Code for Logging Issues
Reviewing The Secure Code Environment
Reviewing Code for Authorization Issues
Reviewing Code for Authentication
Reviewing Code for Session Integrity issues
Reviewing Cryptographic Code
Reviewing Code for Race Conditions
Language specific best practice
Java
Java gotchas
Java leading security practice
PHP
PHP Security Leading Practice
C/C++
Strings and Integers
MySQL
Reviewing MySQL Security
Need to Update and add additional examples and text
Rich Internet Applications
Flash Applications
AJAX Applications
Web Services
Example reports
How to write NEW-Author Name:<Add Here>
How to determine the risk level of a finding NEW-Author Name:<Add Here>
Sample form NEW-Author Name:<Add Here>
Automating Code Reviews
Preface
Reasons for using automated tools
Education and cultural change
Tool Deployment Model
Code Auditor Workbench Tool
The Owasp Orizon Framework
Ways to achieve secure code on a budget
The OWASP Enterprise Security API ( ESAPI) NEW-Author Name:<Add Here>
Resource & Budget NEW-Author Name:<Add Here>
References
