Secure code review fundamentals
You review code by following data from source to dangerous sink, go through identity, authorisation, cryptography, error handling and dependencies with checklists, and speed up the review with Semgrep and CodeQL.
Level 301 · 16 lessons · 14 practice labs
Lessons
Approach
- Why and when to do a secure code review
- Scoping the review: risk, change and critical flows
- From source to sink: following data flow
- Checklists: OWASP ASVS and the code review guide
- Short task: list a small app’s entry points and dangerous calls
Review topic by topic
- Input handling and validation
- Authentication and authorisation code
- Use of cryptography and secrets
- Error handling and logging
- Dependencies and known vulnerabilities
- Short task: find and comment on three security issues in a pull request
Tool-assisted review
- Static analysis (SAST): what it finds and what it misses
- Writing rules with Semgrep
- An introduction to CodeQL: querying code like a database
- Writing constructive review comments for developers
- Capstone: carry out a secure code review of an app and report the findings
Practice labs
- List the entry points and dangerous calls: List a small lab app's inputs and dangerous calls and trace three paths between them.
- Risk-based scoping: what to look at first: Rank the files in a change list by risk and write why you would review them in that order.
- Source to sink: a three-layer flow: Trace user input from controller to service to query and find the layer where validation is skipped.
- A review by ASVS items: Review the login and session code against selected ASVS items and list the unmet ones with evidence.
- A secret embedded in code: Find the key left embedded in the repo and its history, move it to an environment variable and note that it must be rotated.
- Code that swallows and leaks errors: Find two blocks that swallow errors silently and leak detail to users and add proper error handling and logging.
- An authorisation check in the wrong order: Find the function that checks authorisation after doing the action and move the check before the action.
- Weak cryptography use: Find three places that use a fixed IV, weak randomness and an old algorithm and replace them with safe library calls.
- Three security issues in a pull request: Find three security issues in a pull request and write a constructive comment with a fix for each.
- Triage SAST output: Classify ten findings in a static analysis report as real, false positive or acceptable.
- A first Semgrep rule: Write and run a simple Semgrep rule that catches a dangerous function call in the codebase.
- Free a Semgrep rule from false positives: Narrow a noisy rule with pattern exclusions and context and show it keeps the real findings.
- A source-to-sink query with CodeQL: Run a CodeQL query that finds flows from a request parameter to a file path and verify the results.
- A full review of a small app: Review the code of the fictional Durelo Orders service, rank the findings by severity and send the fixes as a pull request.
About this course
You review code by following data from source to dangerous sink, go through identity, authorisation, cryptography, error handling and dependencies with checklists, and speed up the review with Semgrep and CodeQL.
What you will learn
- Approach
- Review topic by topic
- Tool-assisted review
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.