Questions tagged [code-review]
Questions about how to audit source code for security issues. Do note that requests for full code reviews are not on topic.
117
questions
0
votes
1
answer
7
views
How long would this take to bruteforce?
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Having inspected the source code ...
- 383
1
vote
0
answers
26
views
What are some effective strategies to pentest a native code library?
The vast majority of resources out there about penetration testing applications is about web and mobile applications; in some cases there are resources about so-called "native applications" ...
- 1,049
0
votes
0
answers
64
views
Use of JWT Token in open source project
I'm currently performing a code audit for an application that a company will release to the public as open-source in the next few days.
In this application, they use a JWT token for authentication and ...
- 15
-1
votes
4
answers
194
views
Vendor Security Review. When is it overkill?
Looking for everyone's opinion here. One of my buddies was doing a vendor security review for a company that sells different types of software. The software allows you to create 3D models for home and ...
- 133
0
votes
0
answers
125
views
What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically
Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues.
You want to review your database ...
- 1
1
vote
1
answer
441
views
Safe sharing source code with 3rd party for security review?
I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with ...
- 113
0
votes
1
answer
417
views
SQL injection and XSS prevention
I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks.
SQL injection: treated via PDO prepared statements;
XSS: All user's ...
-1
votes
1
answer
458
views
What is the difference between "secure code review" and "secure static code analysis"?
What are the subtle differences in both - as one could say that both are almost the same...
Static Code Analysis (also known as Source Code Analysis) is usually
performed as part of a Code ...
- 11
3
votes
1
answer
2k
views
Safe usage of Runtime.getRuntime.exec(String[])
I was reviewing code of an application that uses the following piece of Java code and wanted to know if the the use of exec() was susceptible to command injection.
public class FindFileInDir {
...
- 233
0
votes
0
answers
93
views
Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority
The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
- 101
87
votes
6
answers
20k
views
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me? [duplicate]
I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
- 711
0
votes
1
answer
3k
views
What are things we look to find Access Control Database?
Currently Working on HP Fortify Access Control Database category.
Source:
userId = request.getParameter(Constants.USERID).trim();
Sink:
pstm1.setString(3,userId.trim());
I saw the definition ...
- 449
2
votes
1
answer
5k
views
Path Manipulation Vulnerability
Currently I am working in code review process.
I have few doubts regrading Path Manipulation Vulnerability.
Some portion of the Path is already hard coded and with extension
public class ReadFile {
...
- 449
1
vote
2
answers
165
views
Mitigating security risks of using open-source software
The title sounds like a trolling question but it is not (I'm a huge fan of OSS).
I have a small company with a web app that is undergoing infosec review with a Fortune 100 company. The questions I ...
- 121
0
votes
1
answer
416
views
Hiring an AppSec Engineer - What to look for?
I am in the process of trying to hire an AppSec Engineer to review our source code manually and have only been able to find those using appscan tools for secure code reviews. Is there something in ...
- 11
3
votes
3
answers
957
views
Ken Thompson's compiler hack
I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point?
Can we be sure that there are no ...
- 245
2
votes
1
answer
2k
views
PHP assert code injection
Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php.
$entityId = $_GET["name"];
public function getMetaData($entityId) {
assert('...
- 43
1
vote
2
answers
362
views
Security code review recommendations [closed]
I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
- 135
1
vote
2
answers
274
views
How to explain to our developer manager the benefits of using a linter also as a security feature?
Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer.
ESlint has a rule to indicate, for example, to use {} which would have ...
- 1,214
-5
votes
2
answers
300
views
Is this Python program secure?
Note: I'm new to information security practices so feel free to point out anything I could be doing better.
Situation : I'm currently creating an encryption system for instant messaging and I want to ...
- 107
-2
votes
1
answer
139
views
If I put a variable in the private section of a class, will the variable have more protection againsted reverse engineering? [closed]
class LockdownUnlock{
private:
/*snip*/
std::string rootCertificate; //Will this protect the data?
/*snip*/
public:
/*snip*/
}LDUnlock;
- 15
1
vote
1
answer
2k
views
Penetration Testing vs Secure Source Code Review [duplicate]
Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing ...
- 455
2
votes
1
answer
301
views
Spectre: Problem with Understanding POC - Reading data from cache
I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
- 179
1
vote
1
answer
258
views
Need to create an interview environment for a Security Engineer candidate
I work in a medium sized startup as DevOps Engineer and we need to hire a security engineer. Since I have never done it, the company asked me to create an environment where the security engineer ...
- 113
7
votes
2
answers
7k
views
Is PHP's eval() function vulnerable to code injection when executing a string built from an array?
I'm trying to learn more about PHP eval() exploitation and I came across this scenario:
<?php
$test = array();
$test[0] = "command0 ";
$test[1] = $_GET["cmd1"];
$test[2] = "command2 ";
$test[3] = ...
- 73
1
vote
2
answers
5k
views
Buffer overflow due to strlen, strcpy, strcat
I'm new to secure code review. I know that strlen will calculates the length until it finds a null character. This is a part of a larger code.
char* executeMount(char* password, char* path, int ...
- 11
1
vote
0
answers
141
views
What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?
What type of vulnerabilities would be found additional in a source code review vs a pentest?
If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
- 11
0
votes
1
answer
77
views
Ensuring security for SharePoint hosted app (Office 365) [closed]
What strategy/approach/method should I use to ensure that programmers aren't deliberately including backdoor or accidentally creating security flaws? This is in regards to SharePoint hosted app in ...
- 1
3
votes
3
answers
183
views
How to gain credibility for your application?
Let's say that you have built an application. It doesn't really matter which type of application but the security of the application is a very important feature.
How do you proceed to gain some ...
- 6,931
0
votes
1
answer
89
views
Do comparative reviews of OS safety exist, which consider the code volume?
I am looking for alternative OS, and security is a key concern. I am interested in reading reviews which compare or simply deal with the security merits of OS, and which moreover not only consider the ...
- 1,432
1
vote
3
answers
692
views
Questions about code review (C) [closed]
As part of a Security Workshop course I did last semester (im in Australia) we had to learn about Code Auditing on our own by reading "The Art of Software Security Assessment".
In our final exam we ...
- 23
1
vote
1
answer
917
views
C++ : memset on a struct containing std::wstring - Is it a risk?
While reviewing a piece of C++ code I came across instances (reported by CPPcheck) where memset() was used on structures containing string members. I have come across a few references that talk about ...
- 7,335
1
vote
1
answer
205
views
Security code review
For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the ...
- 41
3
votes
3
answers
811
views
Basic security checklist for using an open-source library
I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
- 3,936
1
vote
2
answers
1k
views
Security code review Apple Swift - tools and documentation
I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
- 11
10
votes
2
answers
2k
views
Is SWIFT (banking) Software Architecture Secure?
With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise:
Are software components of the ...
- 3,379
11
votes
1
answer
3k
views
Is NoScript bad? [closed]
I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
- 623
1
vote
0
answers
88
views
What is the iOS securecoding feature, and what risks does it mitigate?
iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized
Can anyone explain what this would actually protect to the ...
- 50.4k
0
votes
3
answers
582
views
What are some metrics to be used to evaluate SaaS security?
What are some metrics to be used to evaluate a SaaS app's security?
Some examples:
static code analysis (Fortify)
code coverage (bugs being a potential source of vulnerabilities)
others?
In case it ...
- 334
0
votes
1
answer
108
views
Review of a protocol
I am wondering if anyone could give a second opinion whether the following is secure or not.
I have a system which consist of a mobile device, FTP server and a PC.
The mobile device is to upload ...
- 103
2
votes
1
answer
323
views
How to get around hard coding a PFX password
I've got an application that acts as a SSL server. I've got the pfx file and in code, I've had to hard code the password to use in the following way
PKCS12_parse(p12, PFXPassword, &pkey, &...
- 123
9
votes
3
answers
815
views
Is the action of accepting a pull request on Github vulnerable to race conditions?
On github, any person (let's call them Alice) can fork a project, make modifications to it, and then submit those changes to the project owner(Bob) as a pull request, and the idea is that Bob reviews ...
- 2,363
2
votes
1
answer
2k
views
Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?
I am auditing (reverse engineering) an x86 C++ application without source code.
Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
- 21
0
votes
1
answer
363
views
Secure implementation of user login
Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this
$auth = $_COOKIE['authorization'];
header ("Cache-Control:no-cache"...
22
votes
4
answers
6k
views
Suspicious JavaScript in website header
I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't.
I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
- 401
0
votes
1
answer
251
views
How to check an open source product for password handling quality?
I just created an account on Magento Commerce, which is an online shop solution.
During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain ...
- 3,356
8
votes
2
answers
5k
views
Do these regex show that I was hacked?
What do these regex commands mean? I found them when I ran the history command:
grep --include=\*.php -rnw . -e "update.creditcard"
grep --include=\*.php -rnw . -e "e41e"
grep --include=\*.php -rnw . ...
- 83
0
votes
2
answers
114
views
Does splitting RNG into "private" and "public" entropy sources reduce risks of compromise?
I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that:
https://github.com/awslabs/s2n#compartmentalized-random-number-generation
The security of TLS and its associated ...
- 5,327
4
votes
2
answers
4k
views
Will the following PHP code result in source code info leak/disclosure?
I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php.
So I went ahead to guard ...
- 45
0
votes
3
answers
996
views
Exploiting a desktop application
I'm studying application security and now I have a question which I couldn't find a good answer.
Assume I have a vulnerable desktop application in my virus-free windows 7 PC. Let's say when the file ...
- 366