Skip to main content

Questions tagged [code-review]

Questions about how to audit source code for security issues. Do note that requests for full code reviews are not on topic.

Filter by
Sorted by
Tagged with
86 votes
6 answers
20k views

How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me? [duplicate]

I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
Paranoid Android's user avatar
51 votes
3 answers
6k views

Security Review - password_hash implementation for PHP

I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
ircmaxell's user avatar
  • 1,416
47 votes
5 answers
11k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
VirtuosiMedia's user avatar
37 votes
6 answers
4k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
schroeder's user avatar
  • 131k
33 votes
1 answer
5k views

Crashing the sha1() function in PHP?

I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here. Here is my methodology: Reset the ...
user5623335's user avatar
23 votes
3 answers
3k views

What ways are there to verify a self-written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter. I needed to secure ...
Vincent's user avatar
  • 433
22 votes
4 answers
6k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
bf2mad's user avatar
  • 401
22 votes
3 answers
6k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...
AviD's user avatar
  • 73.4k
19 votes
6 answers
6k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
AviD's user avatar
  • 73.4k
17 votes
4 answers
3k views

Criteria for Evaluating Static Analysis Tools

As with any tools purchase part of the outcome is in how good the evaluation criteria are, so it is important to understand the criteria people might use when assessing Security static analysis tools. ...
Rory McCune's user avatar
  • 62.4k
16 votes
3 answers
1k views

Getting a manual security code review done - What to watch out for?

We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process. We did specify what kind of tests he should be ...
user avatar
14 votes
6 answers
5k views

Code Analysis: Binary vs Source

While conducting a software security assessment, if you have access to the source code of a compiled application (say C++), would you ever do any analysis upon the compiled version, either with any ...
TobyS's user avatar
  • 1,617
11 votes
4 answers
8k views

Is there a real risk of exploitation in java code where a null pointer is dereferenced

I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool. I know a null pointer dereference can crash a program, but assuming ...
Rory Alsop's user avatar
  • 61.5k
11 votes
3 answers
6k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities? [closed]

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
Magnus's user avatar
  • 1,204
11 votes
1 answer
3k views

Is NoScript bad? [closed]

I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
user21820's user avatar
  • 613
10 votes
5 answers
2k views

Code Review Strategies

As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
p_upadhyay's user avatar
  • 1,141
10 votes
3 answers
1k views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
siliconpi's user avatar
  • 1,087
10 votes
1 answer
571 views

How to encourage responsible disclosure (and react appropriately otherwise)

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
Alessandro Menti's user avatar
10 votes
2 answers
2k views

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise: Are software components of the ...
Silverfox's user avatar
  • 3,407
10 votes
3 answers
1k views

Is the action of accepting a pull request on Github vulnerable to race conditions?

On github, any person (let's call them Alice) can fork a project, make modifications to it, and then submit those changes to the project owner(Bob) as a pull request, and the idea is that Bob reviews ...
Shelvacu's user avatar
  • 2,383
9 votes
5 answers
7k views

How to review code for backdoors?

I have a codebase that needs a code review to evaluate it for backdoors. The code is far too big to review it all, how would you recommend approaching the problem. It is a java web application with ...
Andrew Russell's user avatar
9 votes
4 answers
9k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
Lizbeth's user avatar
  • 757
9 votes
2 answers
2k views

security reviews of third party code

I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is ...
mg1075's user avatar
  • 193
9 votes
4 answers
5k views

What Checkstyle or Findbugs rules detect common vulnerabilities?

Looking for experience with both built in and custom checks. I do not need references to commercial source code analysers.
Vitaly Osipov's user avatar
9 votes
1 answer
546 views

Do the Windows shared source files compile into the same binaries as the retail version?

Microsoft makes the Windows source code available to certain third party organisations such as the US and foreign governments, universities etc. This is their Shared Source Initiative Is this a ...
Peter Hahndorf's user avatar
8 votes
2 answers
5k views

Do these regex show that I was hacked?

What do these regex commands mean? I found them when I ran the history command: grep --include=\*.php -rnw . -e "update.creditcard" grep --include=\*.php -rnw . -e "e41e" grep --include=\*.php -rnw . ...
OldCastle's user avatar
8 votes
4 answers
2k views

Scripting a search through php files for dangerous calls for manual review

I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed. Does anyone have any recommendations for ...
Chris Dale's user avatar
  • 16.1k
8 votes
6 answers
8k views

Fortify360 - Sinks & Sources - Vulnerability count

In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
Purge's user avatar
  • 2,006
8 votes
4 answers
4k views

Static code review approach

My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan. Veracode – Finds security flaws in application binaries and bytecode without requiring source Fortify/...
hindiuniversity's user avatar
8 votes
4 answers
1k views

Benefits of secure code review in-IDE vs. fatapp vs. webapp

For those of you who have worked with commercial secure code review tools such as: Klocwork Coverity Armorize Fortify Checkmarx Appscan Source Edition (formerly Ounce) Or perhaps a free or open-...
atdre's user avatar
  • 19.1k
8 votes
2 answers
828 views

How dangerous is it to use third-party security audit tools?

This question is inspired by two related questions (How safe is backtrack to use, and How to Install, Configure and Use LSAT on Unix SE). Besides a dated (and patched) vulnerability in LSAT (CVE-2007-...
Deer Hunter's user avatar
  • 5,337
8 votes
1 answer
3k views

Is Request.getHeader("host") vulnerable?

If the following is the code snippet, what would be your suggestions? <script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script> Is this a clear ...
p_upadhyay's user avatar
  • 1,141
7 votes
8 answers
994 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
Jeff's user avatar
  • 953
7 votes
3 answers
26k views

Are there any free static analysis tools for C# / .NET code [closed]

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
Epoch Win's user avatar
  • 922
7 votes
2 answers
2k views

GET with additional parameters leads to "code injection" in html displayed

We got a security review done of our PHP code and the security company sent this in their report: Request GET /appdir/ajax/addAvail.php?counter=1216%3cscript%3ealert(0)%3c%2fscript%3e&from=1216%...
siliconpi's user avatar
  • 1,087
7 votes
2 answers
8k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
Robleh's user avatar
  • 73
7 votes
2 answers
1k views

SELinux and text relocations exploitability

I have been assigned the task of adopting and implementing a certain backup software solution for our GNU/Linux farm. As per my deparment defined requirements, this solution should support SELinux ...
dawud's user avatar
  • 448
6 votes
6 answers
3k views

What are some good, free tools to run automated security audits for PHP code?

I've been looking for some time now and have come up short. The most promising I found was Spike PHP, which seems to no longer work. I'm looking to scan my code for potential risks of SQL Injection, ...
James Simpson's user avatar
6 votes
1 answer
4k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
user28464's user avatar
6 votes
1 answer
8k views

Code Review on a Header Injection In Java : any help?

I'm auditing a piece of Java code that might be vulnerable to header injection : String headerValue =request.getParameter("headerVal"); //escaping CRLF headerValue = headerValue.replace("\n", ""); ...
Omar Elfada's user avatar
6 votes
2 answers
955 views

Secure Software Development

I'm researching models on building security into the SDLC and so far have come across: BSIMM Microsoft SDL Open SAMM Are there any other documents and resources to look into? Specific tools that ...
Epoch Win's user avatar
  • 922
6 votes
3 answers
1k views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
rdmueller's user avatar
  • 2,763
6 votes
2 answers
2k views

HTML 5 Security Code Scanner

Are there code scanners in the market that scan HTML 5 code? Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
smiley's user avatar
  • 1,204
6 votes
2 answers
709 views

How do you organize a code review / static analysis report?

Recently I get involved in a security code review. I found many format string, buffer overflow and dangerous libc function call. Right now I need to write down a report with all the stuff founded ...
boos's user avatar
  • 1,066
6 votes
2 answers
607 views

Outsourcing security evaluation

Does anyone have any experience with outsourcing security code review via freelance sites (like Rent-a-coder, Elance, Guru, Getafreelancer, etc.)? Is this effective? What are the best practices? ...
D.W.'s user avatar
  • 99.9k
5 votes
6 answers
2k views

Could a computer program be used to automate testing for trapdoors?

Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
Webber's user avatar
  • 101
5 votes
3 answers
686 views

What to consider in an SLA to ensure secure software when outsourcing software development?

To ensure secure development in the off shore team what are considerations to be taken into account in the SLA? I got this as a reference: http://www.it-director.com/enterprise/technology/content.php?...
Epoch Win's user avatar
  • 922
5 votes
3 answers
1k views

Open source web application penetration testing community

I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
Cut Copy's user avatar
  • 109
5 votes
3 answers
2k views

Secure source code review tool for jQuery

Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
Karthik's user avatar
  • 2,324
5 votes
2 answers
2k views

What are good free opensource tools for helping in manual source code reviews? [closed]

I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
kinunt's user avatar
  • 2,799