Questions tagged [code-review]

Questions about how to audit source code for security issues. Do note that requests for full code reviews are not on topic.

Filter by
Sorted by
Tagged with
0
votes
1answer
86 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
-1
votes
1answer
55 views

What is the difference between “secure code review” and “secure static code analysis”?

What are the subtle differences in both - as one could say that both are almost the same... Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code ...
3
votes
1answer
151 views

Safe usage of Runtime.getRuntime.exec(String[])

I was reviewing code of an application that uses the following piece of Java code and wanted to know if the the use of exec() was susceptible to command injection. public class FindFileInDir { ...
7
votes
2answers
5k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
0
votes
0answers
35 views

Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority

The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
86
votes
6answers
20k views

How am I ever going to be able to “vet” 120,000+ lines of Composer PHP code not written by me? [duplicate]

I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
14
votes
6answers
4k views

Code Analysis: Binary vs Source

While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
0
votes
1answer
601 views

What are things we look to find Access Control Database?

Currently Working on HP Fortify Access Control Database category. Source: userId = request.getParameter(Constants.USERID).trim(); Sink: pstm1.setString(3,userId.trim()); I saw the definition ...
1
vote
1answer
1k views

Path Manipulation Vulnerability

Currently I am working in code review process. I have few doubts regrading Path Manipulation Vulnerability. Some portion of the Path is already hard coded and with extension public class ReadFile { ...
1
vote
2answers
92 views

Mitigating security risks of using open-source software

The title sounds like a trolling question but it is not (I'm a huge fan of OSS). I have a small company with a web app that is undergoing infosec review with a Fortune 100 company. The questions I ...
0
votes
1answer
243 views

Hiring an AppSec Engineer - What to look for?

I am in the process of trying to hire an AppSec Engineer to review our source code manually and have only been able to find those using appscan tools for secure code reviews. Is there something in ...
1
vote
0answers
67 views

Abusively? repurposing authorization token handler

Background I have an authorization handler of the form: Auth(AllowedGroups, Token) -> [Allow/Deny] Where the Token consist of the following tuple and its MAC tag. TbsToken := (userid, ...
18
votes
4answers
2k views

Criteria for Evaluating Static Analysis Tools

As with any tools purchase part of the outcome is in how good the evaluation criteria are, so it is important to understand the criteria people might use when assessing Security static analysis tools. ...
3
votes
3answers
409 views

Ken Thompson's compiler hack

I have gone through Ken Thompson's compiler hack paper; can't we just go through the compiler's source code and check for any backdoor, what was the article's point? Can we be sure that there are no ...
2
votes
1answer
1k views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
1
vote
2answers
283 views

Security code review recommendations [closed]

I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several ...
5
votes
4answers
335 views

How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)

I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio. You can see the video at Real-time ...
1
vote
2answers
173 views

How to explain to our developer manager the benefits of using a linter also as a security feature?

Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer. ESlint has a rule to indicate, for example, to use {} which would have ...
0
votes
3answers
493 views

What are some metrics to be used to evaluate SaaS security?

What are some metrics to be used to evaluate a SaaS app's security? Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others? In case it ...
1
vote
2answers
1k views

Security code review Apple Swift - tools and documentation

I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
-5
votes
2answers
225 views

Is this Python program secure?

Note: I'm new to information security practices so feel free to point out anything I could be doing better. Situation : I'm currently creating an encryption system for instant messaging and I want to ...
-2
votes
1answer
88 views

If I put a variable in the private section of a class, will the variable have more protection againsted reverse engineering? [closed]

class LockdownUnlock{ private: /*snip*/ std::string rootCertificate; //Will this protect the data? /*snip*/ public: /*snip*/ }LDUnlock;
1
vote
1answer
1k views

Penetration Testing vs Secure Source Code Review [duplicate]

Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing ...
4
votes
5answers
724 views

What is the security flaw in this example of “magic parameters”?

I am reading OWASP Testing Guide v3: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For simplicity, the GET request may be: ...
7
votes
3answers
21k views

Are there any free static analysis tools for C# / .NET code [closed]

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
1
vote
2answers
3k views

Buffer overflow due to strlen, strcpy, strcat

I'm new to secure code review. I know that strlen will calculates the length until it finds a null character. This is a part of a larger code. char* executeMount(char* password, char* path, int ...
2
votes
1answer
255 views

Spectre: Problem with Understanding POC - Reading data from cache

I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
1
vote
1answer
193 views

Need to create an interview environment for a Security Engineer candidate

I work in a medium sized startup as DevOps Engineer and we need to hire a security engineer. Since I have never done it, the company asked me to create an environment where the security engineer ...
37
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
1
vote
0answers
103 views

What web application vulnerabilites are most likey to be found in a source code review vs a grey box pentest?

What type of vulnerabilities would be found additional in a source code review vs a pentest? If my organization performs regular grey box pentests, do we really require to perform source code reviews?...
0
votes
1answer
39 views

Ensuring security for SharePoint hosted app (Office 365) [closed]

What strategy/approach/method should I use to ensure that programmers aren't deliberately including backdoor or accidentally creating security flaws? This is in regards to SharePoint hosted app in ...
2
votes
2answers
448 views

Which software scans software for potential vulnerabilities?

Is there any kind of parser software analysis tool that will analyze C code and outputs possible vulnerabilities like buffer overflows?
3
votes
3answers
145 views

How to gain credibility for your application?

Let's say that you have built an application. It doesn't really matter which type of application but the security of the application is a very important feature. How do you proceed to gain some ...
0
votes
1answer
52 views

Do comparative reviews of OS safety exist, which consider the code volume?

I am looking for alternative OS, and security is a key concern. I am interested in reading reviews which compare or simply deal with the security merits of OS, and which moreover not only consider the ...
1
vote
3answers
576 views

Questions about code review (C) [closed]

As part of a Security Workshop course I did last semester (im in Australia) we had to learn about Code Auditing on our own by reading "The Art of Software Security Assessment". In our final exam we ...
1
vote
1answer
555 views

C++ : memset on a struct containing std::wstring - Is it a risk?

While reviewing a piece of C++ code I came across instances (reported by CPPcheck) where memset() was used on structures containing string members. I have come across a few references that talk about ...
1
vote
1answer
142 views

Security code review

For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the ...
3
votes
3answers
599 views

Basic security checklist for using an open-source library

I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
48
votes
3answers
5k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
17
votes
6answers
6k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
22
votes
4answers
6k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
10
votes
2answers
1k views

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise: Are software components of the ...
11
votes
1answer
2k views

Is NoScript bad? [closed]

I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
1
vote
0answers
50 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
2
votes
1answer
172 views

How to get around hard coding a PFX password

I've got an application that acts as a SSL server. I've got the pfx file and in code, I've had to hard code the password to use in the following way PKCS12_parse(p12, PFXPassword, &pkey, &...
0
votes
1answer
65 views

Review of a protocol

I am wondering if anyone could give a second opinion whether the following is secure or not. I have a system which consist of a mobile device, FTP server and a PC. The mobile device is to upload ...
2
votes
1answer
1k views

Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?

I am auditing (reverse engineering) an x86 C++ application without source code. Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
9
votes
2answers
533 views

Is the action of accepting a pull request on Github vulnerable to race conditions?

On github, any person (let's call them Alice) can fork a project, make modifications to it, and then submit those changes to the project owner(Bob) as a pull request, and the idea is that Bob reviews ...
0
votes
1answer
289 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ("Cache-Control:no-cache"...
10
votes
5answers
2k views

Code Review Strategies

As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...