Code Review

What is a Secure Code Review?

Security code review is an essential part of the secure development lifecycle, which ensures that applications are developed safely. Security code review is a process of inspecting the source code and checking for any vulnerabilities or errors that could lead to malicious attacks. This process can be done manually or by using automated tools for static analysis (SAST).

A secure code review does not attempt to identify every issue in the code. Yet, it provides insights into what types of problems exist and helps the application developers understand what categories of wide cases exist. The goal is to provide the developers with information to help them make the application’s source code secure.

Automated vs. Manual Code Review

Secure code review is usually a manual process but can be automated. Automated code reviews are more efficient than manual reviews because they can be performed at scale and in a shorter time frame. Nevertheless, an automated review cannot detect vulnerabilities in the code that a human might find, particularly business logic vulnerabilities –  it is almost impossible for an automated system to identify coding errors concerning the applications’ logic.

Clear Gate performs the code review in both approaches – manually and automatically to assess the entire application’s code in minimum time, which will, on the one hand, reduce costs and time and the other hand, will be insightful with minimum false negatives/positives.

Common Security Issues Found in Code Review Testing:

• Improper Input Validation – Input validation is the most basic security mechanism and can prevent many web vulnerabilities, including injections, Server-Side Request Forgery, Local File Inclusion, and more. This best practice has a simple principle: never trust user input. For example, if a web application asks the user for a phone number, then only inserted data containing numbers will be processed.
• Broken Authentication / Access Control – These are two types of logic vulnerabilities that cannot be easily identified using automated tools as they require an understanding of the application behavior. It occurs when the application fails to check whether the user is logged in before permitting access to a specific resource or feature.
• Hardcoded Credentials – Developers sometimes use hardcoded credentials and secrets for test purposes and easy access. However, sometimes developers forget to remove the secrets before deploying the application to production and even publish them to version control systems. This practice poses a significant security risk that can allow attackers to bypass authentication mechanisms or increase the severity of a vulnerability already found.
• Database Communication – Most modern web applications use a database to store and easily retrieve information. However, it is important to ensure that user-supplied data is not introduced directly into queries executed by the database engine. Otherwise, the application will be vulnerable to SQL Injection vulnerability. As a result, an attacker could view/modify/delete sensitive data of other users or even get unauthorized access to the entire system.