Brontekst bekijken van SoftwareSecurity2014/Group 2/Log

=Group 2: log=

===2014-03-28 - first meeting===

* Discussed various opensource web applications
* Chose OwnCloud and downloaded the core
* Initial run of Fortify on the source code to see if it would find anything
* A quick look at RIPS and RATS

===2014-04-01 - second meeting===

* Choose set of requirements: V6: Output Encoding/Escaping (HTML)
* Choose part of the code of OwnCloud to match the requirements: https://github.com/owncloud/core
* Evaluate Fortify results of (preliminary) scan
* Find and install other codescanners: RIPS, RATS
* Run RIPS and RATS on the OwnCloud core
* Evaluate the results of RATS

===2014-04-10 - third meeting===
* Make a to-do list
* Judith & Joost will look a bit more into RIPS
* Koen & Markus are processing the output of the code scan with RATS
* Assessment of the found errors w.r.t. V6
* We took another look at the [https://www.owasp.org/images/4/4e/OWASP_ASVS_2009_Web_App_Std_Release.pdf OWASP-pdf]
* Reflection questions

===2014-04-30 - revisiting XSS===
* Markus tried to provoke an XSS warning in a minimal example
* Scan ownCloud again, update findings

===2014-05-13 - started with part2===
* Make a to-do list w.r.t. project part 2
* Start working on various requirements from V6 (specifically, V6.4, V6.5, V6.6, V6.7)

===2014-05-27===
* Finished working on requirements from last time
* Brainstorm which languages we are going to test for 6.8
* Divide requirements 6.1, 6.2, 6.3
* Plan the last phase of the project (deadline: 6th of June)

===2014-06-03===
* Finished security requirements
* Completed reflection
* We're almost done. :)

===2014-06-10===
* Preparing slides/presentation