Code Review is a fundamental component for ensuring application security. The methodology and techniques used during this phase must be well-structured to maximize the effectiveness of the process and minimize the possibility of critical vulnerabilities remaining undetected.

Let’s delve into how a solid methodology and specific techniques can be applied to achieve this goal.

Structuring the Code Review

The code review methodology must be designed to integrate seamlessly into the software development lifecycle. This integration occurs through a series of well-defined steps, which include review planning, code analysis, and reporting of findings. Each step must be executed systematically to ensure that all relevant areas of the code are adequately examined.

1. Code Review Planning

The code review begins with a planning phase. During this phase, software modules or features that require an in-depth review are identified. This selection is often guided by a risk assessment, which considers factors such as the criticality of the features, exposure to potential attacks, and the impact a vulnerability could have on the entire application.

Planning must include:

• Assigning Reviewers: Identifying individuals with the necessary skills, including specific knowledge of the programming language used and security techniques.
• Timing: Defining when and how frequently reviews will be performed, especially in an Agile development context where iterations are short.

2. Execution of the Review

Code review can be performed using various techniques, which vary depending on the context and specific project objectives. Key techniques include:

• Manual Review: Involves direct analysis of the code by one or more reviewers. This technique allows for the identification of vulnerabilities that might escape automated tools, such as logic problems, implementation errors, and defects related to the specific context of the application. Manual review is particularly effective for detecting complex issues like missing function-level access controls or session management problems.
• Static Code Analysis: Consists of using automated tools to analyze source code without executing it. These tools can identify known vulnerability patterns, such as buffer overflows, injection flaws, and other common issues. Static analysis is useful for covering large portions of code quickly, but it must always be accompanied by a manual review to verify false positives and contextualize the findings.
• Code Crawling: A more specific technique that involves automated analysis of the code flow to track how data moves through an application. This helps identify potential entry points for attacks, such as unvalidated user input that could lead to vulnerabilities like SQL Injection or Cross-Site Scripting (XSS).
• Threat Modeling: Although generally performed before code review, threat modeling can directly influence the review process by identifying key points to examine in greater detail. This allows reviewers to focus on the parts of the code that are most critical from a security perspective.

3. Reporting and Follow-up

Once the code review is complete, the results must be documented clearly and in detail. A good code review report includes:

• Description of Vulnerabilities: Each identified vulnerability must be clearly described, with indications of how it was detected and what its potential implications are.
• Prioritization: Vulnerabilities must be classified based on their severity and the risk they pose to the application. This helps the development team understand which issues must be resolved urgently.
• Recommendations: Suggestions on how to fix the identified vulnerabilities, including specific code changes or the implementation of additional security controls.
• Feedback and Collaboration: It is essential to maintain an open dialogue between reviewers and developers to ensure that corrections are understood and implemented correctly.

Specific Techniques

Some specific techniques that can be used during the review include:

• Source to Sink Analysis: This technique consists of tracing the path of data from the source to the destination (sink), identifying any points where data can be manipulated in a dangerous way. It is particularly useful for detecting vulnerabilities like SQL Injection or XSS.
• Use of Checklists: The use of checklists during code review can help ensure that all critical security aspects are examined. Checklists can be customized to reflect the specific security needs of the application and can cover aspects such as authentication management, encryption, error handling, and security configuration.
• Reviewing Third-Party Components: An often-overlooked part of code review is the examination of third-party components used in the application. These components can introduce vulnerabilities if they are not updated or if they have not been selected with care.

🔙 Return to the ISGroup SRL mini-series dedicated to Code Review!