Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [code-review]

Questions about how to audit source code for security issues. Do note that requests for full code reviews are not on topic.

0
votes
1answer
149 views

Hiring an AppSec Engineer - What to look for?

I am in the process of trying to hire an AppSec Engineer to review our source code manually and have only been able to find those using appscan tools for secure code reviews. Is there something in ...
1
vote
0answers
53 views

Abusively? repurposing authorization token handler

Background I have an authorization handler of the form: Auth(AllowedGroups, Token) -> [Allow/Deny] Where the Token consist of the following tuple and its MAC tag. TbsToken := (userid, ...
1
vote
3answers
302 views

Ken Thompson's compiler hack

I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point? Can we be sure that there are no ...
2
votes
1answer
375 views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
1
vote
2answers
192 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
1
vote
2answers
144 views

How to explain to our developer manager the benefits of using a linter also as a security feature?

Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer. ESlint has a rule to indicate, for example, to use {} which would have ...
-5
votes
2answers
194 views

Is this Python program secure?

Note: I'm new to information security practices so feel free to point out anything I could be doing better. Situation : I'm currently creating an encryption system for instant messaging and I want to ...
-2
votes
1answer
80 views

If I put a variable in the private section of a class, will the variable have more protection againsted reverse engineering? [closed]

class LockdownUnlock{ private: /*snip*/ std::string rootCertificate; //Will this protect the data? /*snip*/ public: /*snip*/ }LDUnlock;
1
vote
1answer
784 views

Penetration Testing vs Secure Source Code Review [duplicate]

Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing ...
2
votes
1answer
232 views

Spectre: Problem with Understanding POC - Reading data from cache

I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
1
vote
1answer
181 views

Need to create an interview environment for a Security Engineer candidate

I work in a medium sized startup as DevOps Engineer and we need to hire a security engineer. Since I have never done it, the company asked me to create an environment where the security engineer ...
6
votes
2answers
3k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
1
vote
2answers
1k views

Buffer overflow due to strlen, strcpy, strcat

I'm new to secure code review. I know that strlen will calculates the length until it finds a null character. This is a part of a larger code. char* executeMount(char* password, char* path, int ...
1
vote
0answers
99 views

What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?

What type of vulnerabilities would be found additional in a source code review vs a pentest? If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
0
votes
1answer
37 views

Ensuring security for SharePoint hosted app (Office 365) [closed]

What strategy/approach/method should I use to ensure that programmers aren't deliberately including backdoor or accidentally creating security flaws? This is in regards to SharePoint hosted app in ...
3
votes
3answers
143 views

How to gain credibility for your application?

Let's say that you have built an application. It doesn't really matter which type of application but the security of the application is a very important feature. How do you proceed to gain some ...
0
votes
1answer
50 views

Do comparative reviews of OS safety exist, which consider the code volume?

I am looking for alternative OS, and security is a key concern. I am interested in reading reviews which compare or simply deal with the security merits of OS, and which moreover not only consider the ...
1
vote
3answers
468 views

Questions about code review (C) [closed]

As part of a Security Workshop course I did last semester (im in Australia) we had to learn about Code Auditing on our own by reading "The Art of Software Security Assessment". In our final exam we ...
1
vote
1answer
454 views

C++ : memset on a struct containing std::wstring - Is it a risk?

While reviewing a piece of C++ code I came across instances (reported by CPPcheck) where memset() was used on structures containing string members. I have come across a few references that talk about ...
1
vote
1answer
138 views

Security code review

For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the ...
3
votes
3answers
457 views

Basic security checklist for using an open-source library

I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
1
vote
2answers
985 views

Security code review Apple Swift - tools and documentation

I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
10
votes
2answers
1k views

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise: Are software components of the ...
11
votes
1answer
1k views

Is NoScript bad? [closed]

I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
1
vote
0answers
50 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
0
votes
3answers
452 views

What are some metrics to be used to evaluate SaaS security?

What are some metrics to be used to evaluate a SaaS app's security? Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others? In case it ...
0
votes
1answer
62 views

Review of a protocol

I am wondering if anyone could give a second opinion whether the following is secure or not. I have a system which consist of a mobile device, FTP server and a PC. The mobile device is to upload ...
2
votes
1answer
120 views

How to get around hard coding a PFX password

I've got an application that acts as a SSL server. I've got the pfx file and in code, I've had to hard code the password to use in the following way PKCS12_parse(p12, PFXPassword, &pkey, &...
8
votes
2answers
464 views

Is the action of accepting a pull request on Github vulnerable to race conditions?

On github, any person (let's call them Alice) can fork a project, make modifications to it, and then submit those changes to the project owner(Bob) as a pull request, and the idea is that Bob reviews ...
2
votes
1answer
855 views

Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?

I am auditing (reverse engineering) an x86 C++ application without source code. Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
0
votes
1answer
250 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ("Cache-Control:no-cache"...
22
votes
4answers
6k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
0
votes
1answer
193 views

How to check an open source product for password handling quality?

I just created an account on Magento Commerce, which is an online shop solution. During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain ...
8
votes
2answers
5k views

Do these regex show that I was hacked?

What do these regex commands mean? I found them when I ran the history command: grep --include=\*.php -rnw . -e "update.creditcard" grep --include=\*.php -rnw . -e "e41e" grep --include=\*.php -rnw . ...
0
votes
2answers
52 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
4
votes
2answers
2k views

Will the following PHP code result in source code info leak/disclosure?

I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php. So I went ahead to guard ...
0
votes
3answers
505 views

Exploiting a desktop application

I'm studying application security and now I have a question which I couldn't find a good answer. Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
23
votes
3answers
3k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
3
votes
5answers
525 views

Why companies do not simply use hackers' tools to find their own vulnerabilities prior to the release of their software? [closed]

It may be a silly question, but hackers do use publicly-available tools to find vulnerabilities. So why don't companies, before releasing their products (Windows, Adobe etc...), use the same tools to ...
4
votes
2answers
1k views

Security review: is this PHP mcrypt wrapper class safe?

Update (6 February 2015): It seems like the class in question has actually updated as a response to the answers here (through an issue, now closed, raised on github). I was looking for an easy to ...
2
votes
2answers
754 views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
-1
votes
2answers
1k views

Why do static code analyzers cite CWE rather than CVE in their findings?

I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities ...
1
vote
0answers
338 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
1
vote
1answer
84 views

Resources for reviewing multi-tiered webabbs in Spring, Hibernate or JAX-WS

I need some pointers to any resources (videos from any conferences or general videos, pdf, anything) for secure source code reviewing of multi-tiered web-apps in JAX-WS, Spring or Hibernate. I am ...
8
votes
4answers
3k views

Static code review approach

My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan. Veracode – Finds security flaws in application binaries and bytecode without requiring source Fortify/...
3
votes
2answers
655 views

Box web application security review - legality? [closed]

is it legal to do a security review/pentest of a web application that we bought and operate on our servers? Meaning, the whole infrastructure is ours + we bought a licence for the software. Can we do ...
1
vote
2answers
876 views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
3
votes
1answer
514 views

OpenSSL Code Review

Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
4
votes
1answer
870 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, paramArrayList....
3
votes
1answer
746 views

Is my AES/CTR/RIPEMD encryption correctly implemented?

Below is my encryption implementation in PHP. It's based on mcrypt, and uses AES-128 in CTR mode along with a RIPEMD-128 HMAC for integrity checking. For brevity, I've inlined the functions for ...