01 Introduction to Secure Code Review
[!TIP] Industry Best Practice: Always align this domain with standard frameworks like OWASP, NIST, or CIS benchmarks for optimal security posture.
Theory and Methodology
Secure Code Review is the process of auditing source code for security vulnerabilities before the code is deployed to production. It is one of the most effective ways to identify complex logic flaws that automated tools often miss.
Manual vs SAST Code Review
| Feature | Manual Secure Code Review | Static Application Security Testing (SAST) |
|---|---|---|
| Focus | Business logic, complex authorization, architectural flaws. | Pattern matching, known insecure functions, syntax issues. |
| Speed | Slow and resource-intensive. | Extremely fast, can scan millions of lines in minutes. |
| False Positives | Low (if done by an expert). | High (requires triage and tuning). |
| Best For | High-risk components (Auth, Crypto, Payments). | Broad coverage, continuous integration, baseline checks. |
The Hybrid Approach
The industry gold standard is a hybrid approach:
- Automated (SAST): Run SAST on every commit/PR to catch low-hanging fruit (e.g., hardcoded credentials, direct SQL concatenation).
- Manual (Human): Focus human reviewers on changes to critical components, complex business logic, and areas flagged by SAST that require contextual understanding.
Secure Code Review Methodology
- Understand the Context: What does the application do? What is the threat model? Who are the users?
- Identify High-Risk Areas: Focus on authentication, authorization, data input/output, cryptography, and session management.
- Trace the Data Flow: Follow user input from the entry point (e.g., HTTP request) to the sink (e.g., database query, command execution).
- Analyze the Logic: Look for race conditions, bypassing of business rules, and state manipulation.
- Verify Defenses: Ensure that mitigations (e.g., input validation, output encoding) are implemented correctly and consistently.
Code Review Checklists
A standardized checklist ensures consistency across reviews.
High-Level Checklist
- Authentication: Are passwords hashed strongly? Are sessions managed securely? Are password resets secure?
- Authorization (Access Control): Is access control enforced on every request? Are indirect object references (IDOR) protected?
- Input Validation: Is all input validated against a strict allowlist?
- Output Encoding: Is data contextually encoded before rendering to prevent XSS?
- Data Protection: Are secrets managed securely? Is encryption used correctly?
- Error Handling: Do errors leak sensitive information (stack traces)?
- Business Logic: Can the process be abused (e.g., skipping checkout steps, exploiting race conditions)?