Code Debug, Analysis and Change Tools

2009 Oct 11

#!/bin/bash
for file in `cvs -nq update | grep '^M'|awk '{print $2}'`
do
 echo tkdiff $file
 tkdiff $file &
done

Static analyzers can find these security bugs:

• Cross-site scripting: causes the browser to execute arbitrary client-side code, hijacking the user's session and allowing an attacker to phish for account info
• Injection flaws: passes through an interpreter when proper input validation is not done, possibly allowing for code injection
• Buffer overflow: possible code or command injection
• Insecure direct object reference: access to internal object handlers exposes data
• Information leakage and improper error handling: overly helpful error messages give too much information about a system (version, type, error type, ...)
• Resource leak: a memory leak can give access similar to buffer overflow
• ignored expressions: when expressions are ignored, code is unreachable and cannot do needed or expected action
• Null pointer de-reference: invalid avlues can lead to crash
• Web services: code can be injected into Web services entry points
• Custom cookies/hiden fields: attacker can view HTTP response by seeing source code of a web page or by using proxies to find hidden files andcookies and then modifying values

2005-2009