SoftwareSecurity2012/Group 3

Group nr. 3

Group members:

• Adrian Garcia Ramirez
• Murad Gurbanov
• Stan Damen
• Dima van de Wouw

all from university TUE

Topic: V6: Output Encoding/Escaping (HTML)

V6 requirements for our group

• V6.1 Verify that all untrusted data thatare output to HTML (including HTML elements, HTML attributes, javascript data values, CSS blocks, and URI attributes) are properly escaped for the applicable context.

• V6.2 Verify that all output encoding/escaping controls are implemented on the server side.

• V6.3 Verify that output encoding/escaping controls encode all characters not known to be safe for the intended interpreter.

• V6.7 Verify that all untrusted data that are included in operating system command parameters are escaped properly.

• V6.8 Verify that all untrusted data that are output to any interpreters not specifically listed above are escaped properly.

Email address output validation

Additionally, we looked at the question whether email addresses were validated (escaped/encoded) properly.

Deliverables

• Log of what we have been doing so far

The log should be a chronological list of who has been doing what, with dates.

Also useful to document decisions on who will be doing what, and by when.

• Code Scanning Results

This should discuss the results of the code scanning. Insofar as possible, put the focus on these from the point of view of the Verfication Requirements your group is looking at, but also point out, but then briefly, findings that might be interesting for other groups.

• Reflection on these code scanners

Describe your impressions about the tools, in capabilities, limitations, etc.

Also, did you learn anything about specific security vulnerabilities from using them?

• Verdict on the security requirements

This should give your verdict for each requirement (Pass/Fail/Don't know) with motivation, and an indication of what you did to reach this verdict.

• Documentation about phpbb we would have wanted

Describe the sort of documentation you would have wanted about phpbb, to make your security review easier.

This can be design decisions, description of the overall architecture and organisation, policies used in the application, styles or guidelines adhered to in the actual coding.

• Reflection on the whole process

Reflect on the whole process of doing a code review, or "Application Security Verification", in the way you did.

Create more sub-pages if you want, of course