白盒测试技术预案.ppt

框架、工具选择 - 单元测试范围、单元粒度、目标的界定 、流程制定 - 开发单元测试代码（TDD、BDD、传统）-效果检查 G:\资料\JAVA白盒测试\Java代码审查\books Module 0: Introduction Course 6437A * CodeSecure提供社区版可免费使用，但是有代码行数扫描限制 Yasca集成了FindBugs、PMD、JLint、PHPLint、Cppcheck等开源工具 G:\亿能 测试服务 解决方案\安全测试解决方案\代码安全审查平台\Find Security Bugs * FindBugs能找到这个SQL注入的潜在漏洞 改用prepareStatement： String sqlString = ????????select * from db_user where username=? and password=?; ??????PreparedStatement stmt = connection.prepareStatement(sqlString); ??????stmt.setString(1, username); ??????stmt.setString(2, pwd); ??????ResultSet rs = stmt.executeQuery(); ??????if (!rs.next()) { ????????throw new SecurityException(User name or password incorrect); ??????} ? ??????// Authenticated, proceed ????} finally { ??????try { ????????connection.close(); ??????} catch (SQLException x) { ????????// forward to handler ??????} ????} Path Manipulation 路径操纵 Compile EightBall.java and run it. It takes an integer as an argument: java EightBall 391 java EightBall 2000 Normally it will reply with a message from the files 0, 1, or 2. However, due to bad error handling, if you put a filename instead of an integer as an argument, it will show the contents of the file. (For simplicity, the user input comes from the command line argument. What would happen if it came from a web form?) Try: java EightBall /etc/passwd (on Unix) java EightBall C:\autoexec.bat (on Windows) /confluence/display/java/The+CERT+Oracle+Secure+Coding+Standard+for+Java The CERT Oracle Secure Coding Standard for Java.pdf /technetwork/java/seccodeguide-139067.html Secure Coding Guidelines for the Java Programming Language, Version 4.0 过去几年的各种研究已经确定：圈复杂度（或 CC）大于 10 的方法存在很大的出错风险。 圈复杂度计算练习.doc 可结合Code Visual To FlowChart、PMD、Metrics、JAVANCSS等工具来辅助计算 JAVANCSS： 主页： http://www.kclee.de/clemens/java/javancss/ 下载： http://www.kclee.de/clemens/java/javancss/#download 使用方法： 1、添加环境变量： JAVANCSS_HOME= C:\javancss-32.53\bin JDK目录不能在Program Files下 2、扫描代码统计复杂度： C:\javancss-32.53\binjavancss.bat