RES: Fail Open Authentication and Parameter Injection

> -----Mensagem original-----
> De: Jeff Williams @ Aspect [mailto:jeff.williams@aspectsecurity.com]

<snip>

> You just can't beat actually looking at the code. You'll need to work
out
> a process for reviewing the code and a standard to review against.
You
> also need to make sure you've found ALL the code. But a code review
will
> give you some real assurance that you've covered everything...in a way

Sure enough but you often have to prioritize opening the possibility of missing something.
Something that should get high priority would be

1. authentication
2. content modifying code etc

Mads Received on Tue Mar 25 15:20:16 2003