adventures in reviewing mountains of code
Talkat AppSec California 2014 · on Tuesday, 2014-01-28· at 17:15· Track 3, Annenberg Community Beach House, East Pacific Coast Highway·
summary
A code review of 2.6 million lines becomes a project: build a parser that produces an abstract syntax tree, link methods into a control‑flow graph, and run state‑space searches to trace sources to sinks. The prototype flags real SQL/XSS/OS‑command risks, needs no compilation, originally takes eight hours on 20k LOC but with parallelized checks processes gigabytes in minutes, and ships as open‑source tooling on GitHub.
AI-written summary · about
chapters (29)
- 0:00intro
- 0:58jons background
- 1:32what were going to talk about
- 3:54what i tried
- 4:34reading line by line
- 5:03finding vulnerabilities
- 5:48looking for inspiration
- 6:06playing a game
- 7:11C magic
- 8:08C magic fails
- 8:30Code parsing
- 10:34Abstract syntax trees
- 11:33Control flow graph
- 12:13Statespace search
- 12:50Depthfirst search
- 13:30Depthsecond search
- 13:56completeness
- 14:29AI
- 15:03StackTrace
- 15:59Live Demo
- 16:24Static Code Analysis
- 19:46Parallelization
- 20:25Native code
- 22:52Security Metric
- 27:00Unicode Conversion
- 28:34Another example
- 29:51regression testing
- 32:03caveats
- 32:28what next
related talks
38mStatic Code Analysis - A Behind-the-scenes Look
28mStandard Classification: How To Review Code For Vulnerabilities
42mContemporary Automatic Program Analysis
34mKeep your code safe during the development path using OS tools
22mWriting safe and secure code
50mUsing language-theoretics and runtime visibility to align AppSec with DevOps
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once...
46mYour Code Base as a Crime Scene