Code Review includes what is now referred to as “static code analysis.” A search for tools which can perform static code analysis will reveal many tools which can assist in your code review.
If this is a PCI DSS concern, see Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified [pdf]. Code Reviews should include vulnerabilities enumerated in Requirement 6.5. Manual code reviews are one approach to satisfying Requirement 6.6.
The OpenSAMM Project (Software Assurance Maturity Model) may be what you are looking for.
Instead, here are notes from the Security Innovation Secure Code Review presentation (pdf) (wmv).
- Focused on security vulnerabilities
Since “security” covers availability, confidentiality, integrity and authenticity, you may feel that this review covers just about everything. Performance, for example, should not distract you.
There’s nothing wrong with saying the same thing in different ways. For example:
- Break into manageable chunks
- Would you be more effective reviewing a million or a thousand lines of code?
- Review iteratively
The iterative reviews focus on the newly added manageable chunks, a few thousand lines of code.
During the code review process, rigorously collect test data today to be used as part of your acceptance test scripts. Test data should test each logical branch of your code. Record the data and its expected result.
In all, the security code review seems much like a structured code review, save that the security code review focuses upon a limited list of coding practices.
Security Innovation whitepapers
Security Innovation list of attacks
Of the 4855 total flaws tracked by CVE in 2008, the flaws can be categorized as:
| Category | Count | % |
|---|---|---|
| SQL Injection | 941 | 19.4% |
| XSS | 681 | 14.0% |
| Buffer Overflow | 455 | 9.4% |
| Directory Traversal | 298 | 6.1% |
| PHP Include | 135 | 2.8% |
| Symbolic Link | 133 | 2.7% |
| Authorization Bypass | 113 | 2.3% |
| DoS Malformed Input | 97 | 2.0% |
| Information Leak | 84 | 1.7% |
| Integer Overflow | 78 | 1.6% |
| CSRF | 57 | 1.2% |
| Bad Permissions | 40 | 0.8% |
| Unnecessary Privileges | 36 | 0.7% |
| Hard coded Password | 36 | 0.7% |
| Upload of code | 34 | 0.7% |
| Weak Crypto | 30 | 0.6% |
| Format String | 26 | 0.5% |
| Insufficient Randomness | 24 | 0.5% |
| Metacharacter Injection | 23 | 0.5% |
| Search Path | 20 | 0.4% |
| Memory Leak | 18 | 0.4% |
| Sensitive data root | 16 | 0.3% |
| Race Condition | 13 | 0.3% |
| DoS Flood | 10 | 0.2% |
| CRLF Injection | 8 | 0.2% |
| Eval Injection | 8 | 0.2% |
| Numeric Error | 7 | 0.1% |
The SANS/CWE Top 25 Software Errors (review About, Sources and About, Documents)
2009 CWE/SANS top 25 Most Dangerous Programming Errors [pdf]
2010 CWE/SANS Top 25 Most Dangerous Software Errors [pdf]
2011 CWE/SANS top 25 Most Dangerous Software Errors [pdf]
Insecure Interaction Between Components
These weaknesses are related to insecure ways in which data is sent and received between separate components, modules, programs, processes, threads, or systems.
- CWE-20: Improper Input Validation
- CWE-116: Improper Encoding or Escaping of Output
- CWE-89: Failure to Preserve SQL Query Structure (‘SQL Injection’)
- CWE-79: Failure to Preserve Web Page Structure (‘Cross-site Scripting’)
- CWE-78: Improper Sanitization of Special Elements used in an OS Command (‘OS Command Injection’)
- CWE-319: Cleartext Transmission of Sensitive Information
- CWE-352: Cross-Site Request Forgery (CSRF)
- CWE-362: Race Condition
- CWE-209: Error Message Information Leak
Risky Resource Management
The weaknesses in this category are related to ways in which software does not properly manage the creation, usage, transfer, or destruction of important system resources.
- CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer
- CWE-642: External Control of Critical State Data
- CWE-73: External Control of File Name or Path
- CWE-426: Untrusted Search Path
- CWE-94: Failure to Control Generation of Code (‘Code Injection’)
- CWE-494: Download of Code Without Integrity Check
- CWE-404: Improper Resource Shutdown or Release
- CWE-665: Improper Initialization
- CWE-682: Incorrect Calculation
Porous Defenses
The weaknesses in this category are related to defensive techniques that are often misused, abused, or just plain ignored.
- CWE-285: Improper Access Control (Authorization)
- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- CWE-259: Hard-Coded Password
- CWE-732: Incorrect Permission Assignment for Critical Resource
- CWE-330: Use of Insufficiently Random Values
- CWE-250: Execution with Unnecessary Privileges
- CWE-602: Client-Side Enforcement of Server-Side Security
See also:
- The Art of Software Security Testing: Identifying Software Security Flaws by Chris Wysopal, Lucas Nelson, Dino Dai Zovi, Elfriede Dustin
- Flawfilder Scan source code for possible security weaknesses
- Source Code Analysis Tools at OWASP
- Agnitio is a tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.
- Minion is a security testing framework built by Mozilla to bridge the gap between developers and security testers. To do so, it enables developers to scan their projects using a friendly interface.
- Microsoft offers many tools for generating test cases, looking for out-of-bounds values. See Free From Microsoft
Aggressive Virus Defense 