canmove, Confirmed users
1,220
edits
Security/Reviews/Gaia/Template: Difference between revisions
no edit summary
Ptheriault (talk | contribs) No edit summary |
Ptheriault (talk | contribs) No edit summary |
||
| Line 1: | Line 1: | ||
= Overview = | |||
== Details == | |||
* App: | * App: | ||
* Review Date: | * Review Date: | ||
| Line 6: | Line 6: | ||
* Branch Reviewed: | * Branch Reviewed: | ||
* Review Lead: | * Review Lead: | ||
== Context == | |||
* High level description of what the app does | * High level description of what the app does | ||
* Why are we reviewing it (high level threats) | * Why are we reviewing it (high level threats) | ||
* Any previous reviews | * Any previous reviews | ||
* Links to related reviews | * Links to related reviews | ||
== Scope == | |||
* What did we look at | * What did we look at | ||
* source links | * source links | ||
* does it include shared components | * does it include shared components | ||
== Architecture == | |||
* High level code paths, data flow, functionality | * High level code paths, data flow, functionality | ||
* Interaction between components | * Interaction between components | ||
* Interaction with external agents | * Interaction with external agents | ||
* Generally good spot to put a diagram | * Generally good spot to put a diagram | ||
== Documentation == | |||
* links to further information, design documentation etc | * links to further information, design documentation etc | ||
* links to relevant bugs (perhaps even a bug table if there are a few) | * links to relevant bugs (perhaps even a bug table if there are a few) | ||
= Design Review = | |||
* Permissions: list permission, why are they used | * Permissions: list permission, why are they used | ||
* Messages | * Messages | ||
| Line 31: | Line 31: | ||
* Connections (IAC): | * Connections (IAC): | ||
* Other manifest properties (e.g redirects,origin, entry points etc) | * Other manifest properties (e.g redirects,origin, entry points etc) | ||
== Threat Analysis == | |||
* List of threats | * List of threats | ||
* Mitigating controls | * Mitigating controls | ||
* Discussion of the threats | * Discussion of the threats | ||
= Implementation Review = | |||
== Enumerate data input & outputs, key data flows etc == | |||
* server communication | * server communication | ||
* user input | * user input | ||
* other inputs (indexeddb, | * other inputs (indexeddb, | ||
* views/templates | * views/templates | ||
==Checklist== | |||
* XSS & HTML Injection attacks | * XSS & HTML Injection attacks | ||
* Secure Communications | * Secure Communications | ||
| Line 64: | Line 64: | ||
* Shared files | * Shared files | ||
* Permission Specific Auditing? | * Permission Specific Auditing? | ||
= Actions & Recommendations = | |||
<bugzilla> | <bugzilla> | ||
{ | { | ||