Find security vulnerabilities through code review

on YouTube ↗44m

" summary

A practical code-review checklist that flags real, fixable bugs: scan routing files and controllers for missing permissions and delete actions without CSRF tokens (use confirmation forms or route tokens); check database calls for concatenation and replace with placeholders to prevent SQL injection; avoid shell_exec or escape arguments with escapeshellarg when invoking Apache Tika; watch Twig templates for the raw filter and attribute quoting; never blindly call unserialize and disable XML entity expansion to prevent RCE/XXE. Claims come from reviewing more than a thousand modules and mapping issues to OWASP Top Ten.

AI-written summary · about

" chapters (40)

1. 0:00Introduction
2. 0:55Goals of code review
3. 2:43Typical module layout
4. 3:49Routing
5. 5:11Excess Content
6. 5:24Site Configuration
7. 5:44Open Web Application Security Project
8. 6:13Admin Form
9. 6:52Deleting Pants
10. 7:54No Confirmation Step
11. 9:30CSRF tokens
12. 12:03Drupal 7 modernized
13. 12:30Drupal 8 routing
14. 13:20Drupal 7 routing
15. 13:57Attack entry points
16. 16:35Condition API
17. 17:00Extract content from PDF
18. 17:46Shell injection
19. 17:59URL injection
20. 18:44How to prevent this
21. 20:22Access hook
22. 21:00Access result
23. 24:11Crosssite scripting
24. 25:05Markup tags
25. 25:25Tweak template
26. 25:54Crosssite scripting vulnerability
27. 26:21Notes labor
28. 26:44Attribute escape
29. 27:45HTML attribute escape
30. 28:13Uncivilized vulnerability
31. 28:54Remote code execution
32. 30:02What do we learn
33. 30:41XML Entity Expand
34. 31:34Disable Entity Loader
35. 31:57Recap
36. 32:58What could go wrong
37. 34:00Resources
38. 34:44Questions
39. 39:15PHP
40. 40:43Static types

" related talks

• 01h 02mCode Review For SecurityAnthony Ferrara · SunshinePHP 2014
• 55mIs this okay!? How to review code for security issuesRouan Wilsenach · NDC Security 2023
• 28mStandard Classification: How To Review Code For VulnerabilitiesVickie Li · OWASP 20th Anniversary 2021
• 02h 18mWeb application security (Part 2)Anna Filina · Web Summer Camp 2018
• 38mFinding Security Issues in Open SourceAlexander Todorov · TestCon Europe 2019
• 01h 02mUnderstanding the OWASP Top 10Gary Hockin · PHP UK Conference 2015
• 27mHow to Start Security Testing Without FearSander van Beek · Agile Testing Days 2024
• 41mSecurity Vulnerabilities Decomposition: Another Way To Look At VulnerabilitiesKaty Anton · OWASP Global AppSec Amsterdam 2019