Basics of Secure Code Review

Transcript

1. Fadzayi Chiwandire Application Security Consultant Secure code Review
2. Fadzayi Chiwandire Application Security Consultant Software Developer #whoami
3. What is it?
4. OWASP https://cheatsheetseries.owasp.org/ https://owasp.org/www-project-code-review-guide/
5. Checklist https://github.com/mgreiler/secure-code-review-checklist • Input Validation • Authentication and User Management • Authorization • Session Management • Encryption & Cryptography • Exception Handling • Reducing the attack surface
6. Some Examples
7. RegEx export const isPasswordValid = validationMessage => value => ( /^([a-zA-Z0-9!@#$%^&*_\-.()]{13,64})$/ .test(value) ? undefined : validationMessage || 'Password is invalid' )
8. Unit Tests // must contain at least one: digit, lower case, Upper case, special character and be >=8 describe('isPasswordValid()', () => { test('Returns undefined if password is correctly formatted, error message otherwise', () => { expect(isPasswordValid('Password invalid')('12345678')).toBe('Password invalid') expect(isPasswordValid('Password invalid')('aaaaaaaa')).toBe('Password invalid') expect(isPasswordValid('Password invalid')('ABCDEFGH')).toBe('Password invalid') expect(isPasswordValid('Password invalid')('123Abcde')).toBe('Password invalid') expect(isPasswordValid('Password invalid')('12@Ab')).toBe('Password invalid') expect(isPasswordValid('Password invalid')('12@Abcde')).toBe('Password invalid') expect(isPasswordValid('Password invalid')('12@Abcdepoiuy')).toBe(undefined) }) })
9. Tools • Snyk • Semgrep • Insider • OWASP Dependency-Check • TruffleHog (Secret Scanner) • Brakeman (Ruby on Rails) REDACTED Snyk Semgrep