How code reviews benefit from a sample test setup

In theory, a code reviewer just needs the source code and design documents to do a code review. He wouldn’t need a sample test environment - that’s more for the pen testers, rt.?

Turns out in practice that a sample setup is very useful to the code reviewer too. Here’re some reasons why:

The first step in a good code review is preparing the threat profile of the application. The threat profile identifies the threats relevant to the application, so the code reviewer can focus on those threats. To prepare the threat profile, he needs to undestand the features and functions of the application and the best way to do that is to walk through the application. A sample setup provides that opportunity on day-1.

After the threat profile is created, the reviewer studies the code layout and creates the code review plan. The plan maps each threat in the code review to the relevant classes and pages. Notice that? To map the threats to the relevant pages, it helps to “see” the deployed application. Sure, it can be done by just looking at the raw code without seeing the app, but it’s a lot easier to map the pages after seeing them.

At times the code is complex enough that the reviewer might have to invest a lot of time to unravel it. Often the simplest way out is to see the end result of the code - watch the pages or forms in action, and things start making sense faster. A code reviewer should be investing his time to discover holes. Trying to decipher convoluted code is a waste of time and reduces the time available for finding holes. Ergo, have a sample setup handy.

A sample setup also allows the code reviewer to verify the vulnerabilities he encounters in the code. He can test out an idea and confirm exploitation with the sample setup. This saves time later for the developers - they can focus their energies on fixing confirmed holes.

In our code reviews, we strongly encourage our clients to let use “see the app”, and not just “see the code”. The quality and speed of the code review improves, while the developer’s time to secure the application drops.

• How to get the best results from your code review
• How we do PCI Code Reviews
• How we use automated scanners in code reviews

Plynt provides penetration testing and code review services to clients worldwide. If you are interested, please contact us for a quote. We’ll get back to you within one working day.