Putting an 'I' in Code Review Turning Code Reviewing Interactive
summary
Claim: making manual code review interactive by attaching a debugger to a running Java app gives faster, focused findings than static reading. The demos actually build and run Tomcat, connect from Eclipse to remote Java debug port 8000, set provider-level breakpoints (eg executeQuery) and watch real SQL strings form, proving SQLi, XSS and LFI paths. Alternatives use instrumentation/profiler to log without stopping. Works even without source via bytecode/reflection; requires a test environment and ops cooperation, and complexity grows with high‑traffic apps.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 3:48Whats wrong with code review
- 7:09Interactive application security testing
- 10:04Demo
- 12:25Debugging
- 19:37File
- 24:34Reflector
- 25:24Breakpoints
- 25:39bytecode
- 25:59provider level debugging
- 26:57provider level breakpoint
- 27:20instrumentation
- 29:18debugger
- 29:48provider break points
- 30:42Eclipse
- 37:00When is this bad
