are tools that can be used as lectures Presentations are tools that can be used as lectures 01 - What, Why & How? 02 - Automated Code Review 03 - Manual Code Review AGENDA 04 - Understanding requests flow 05 - Routes 06 - Understanding Functions Presentations are tools that can be used as lectures 07 - Understanding Software Architecture Presentations are tools that can be used as lectures 08 - Examples
things happening under the hood Reveals not only flaws due to insecure coding practices, but also logical flaws. WHY CODE REVIEWS? Helps uncover hidden issues Helps in creating more test cases
development cycle to avoid any insecure coding practices to be deployed in production. WHAT ARE CODE REVIEWS? Code reviews are analysis of source code of an application to uncover vulnerabilities.
Use Dependabot GitHub dependabot provides you with alerts related to vulnerabilities in the dependencies you use. These tools can be integrated into the CI/CD (continuous integration and continuous development) pipeline to find bugs before deployment. AUTOMATION
might also miss bypasses for vulnerabilities which were found using scanners. As they work on rules, you can find only those vulnerabilities whose rules can be formulated. ANY DRAWBACKS?
than automation can ever find. Why? How? Manual code review is efficient with IDEs which makes your flow through code easy. Manual code review involves analyzing code line by line. Tools
of functions, use of variables, etc. Prerequisites Architecture The organizational level code base is very large, spread across different repositories. Large codebases are organized using software architectures like MVC, client-server, layered patterns, etc. Any roadblocks?
It hits the server you make connection with The application listening on the port handles your request. Response There is mapper written in application where this request falls. This request is passed on to the appropriate function or logic by this mapper The logic processes the request and the gives back the response to you
the functions which have the logic necessary for processing. In every application you can find a similar type of file which serve as request routers. ROUTES Those mappers discussed are often referred to as ROUTES. To start reviewing code in large code bases best way to start is either reviewing it from routes or starting from main function.*
Head towards the function associated with that route Analyse the function Validate the checks in the function for permissions and data sanitization Validate how the functions are handling failing conditions. Understand how data is processed and how is flows.
arr, size Out-Parameters: sum Local Parameters: i, sum What is function doing? The function is taking input as the address of array stored in pointer variable and its size. It is running a for loop over the array and storing the sum of the array in the sum variable which is returned as out parameter.
be structured in a specific way. Using right pattern can increase speed, productivity and speed. There are numerous patterns which are used across industries. Understaning the pattern used in the codebase helps us to locate right files and study data flow easily.
Model-View- Controller(MVC) The whole application is divided into three parts. Model contains the data and main functionality. View displays the data and interacts with the user. Controller acts as the handles user input and acts as mediator between view and model. Source: Wikipedia Further read: RedHat Blog
and its patch. CodeQL github Hackerrank To get started, pick up any damn vulnerable open-source software and do a code review of it. Hackerrank is a very nice platform to learn the basics of programming languages and problem solving. OSS Hackerone disclosed reports for programs like GitLab, Internet Bug Bounty, etc have many reports discussing the vulnerability from the perspective of code. Hackerone reports Semgrep Learn can help you get started with creating semgrep rules. Semgrep Learn