博客园_flyingleaf共同学习VC++，一起进步http://feed.cnblogs.com/blog/u/2115/rss2011-12-22T11:29:26Zflyingleafhttp://www.cnblogs.com/flyingleaf/CNBlogs BlogServerhttp://www.cnblogs.com/flyingleaf/archive/2011/12/22/2298322.html读《大叔手记（13）：T氏法则之Security篇》，无聊之余昨天逛园子，发现Tom的 大叔手记（12）：我的一次面试经历（谈大叔如何应对面试官）我看的津津有味，一口气读完除了佩服还是佩服。 今天又逛，发现Tom写了一篇昨天的T氏法则，然后饶有兴趣的翻了一下。由于以前没翻过，只是阅读和写一些英语，没想到翻译真不是好玩的事情。虽然很多条目都是和条目直接相关的，但是既然翻着玩了，还是翻了一部分，除了《Race Condition》部分，其余都有一些汉字。如果错的离谱，希望大家指点。毕竟我搞了4个小时。2011-12-22T11:28:00Z2011-12-22T11:28:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/<div><p>很久没逛博客园了，不是博客园的原因，是我很久没有C#的原因了。 </p><p></p><p>昨天逛园子，发现Tom的<a href="http://www.cnblogs.com/TomXu/archive/2011/12/21/2292722.html"> 大叔手记（12）：我的一次面试经历（谈大叔如何应对面试官）</a>我 看的津津有味，一口气读完除了佩服还是佩服。 今天又逛，发现Tom写了一篇昨天的T氏法则，然后饶有兴趣的翻了一下。由于以前没翻过，只是阅读和写一些英语，没想到翻译真不是好玩的事情。虽然很多条 目都是和条目直接相关的，但是既然翻着玩了，还是翻了一部分，除了《Race Condition》部分，其余都有一些汉字。如果错的离谱，希望大家指点。毕竟我搞了4个小时。 </p><p>By the way，本来想直接贴到<a href="http://www.cnblogs.com/TomXu/archive/2011/12/22/2297401.html"> 大叔手记（13）：T氏法则之Security篇</a>下面的，但是的确太长了。我拷贝进去，却发表不出来。所以贴到我这里了。希望Tom理解，我无意侵犯版权，前面的连接可以作证。 :) </p><p><span style="color: red;">疑问：既然是法则，为什么喜欢疑问句呢？用肯定句不是更合适吗？</span> <br /></p><p></p><p><strong>Input Validation </strong><strong>输入验证</strong></p><ol><li>Is input data validated to ensure that it contains only valid characters? <br />输入数据中是否只包含合法的字符？</li><li>Is input data validated to ensure that it is within appropriate ranges? <br />输入的数据是否在正确的范围之内？</li><li>Is validation performed by comparing with "known-good" (as opposed to "known-bad") characters or sequences? <br />是否做过这样的验证，通过和已知正确的字符集或者序列比较来验证数据，而不是和已知错误的来比较？</li></ol><p><strong>Output Encoding </strong><strong>输出编码</strong></p><ol><li>Is data encoded using HTMLEncode (or similar function) when forwarding to display in the browser? <br />当需要输出到浏览器显示的时候，使用的是否是HTML编码（或者类似的功能）？</li><li>Is data provided as parameters to a parameterized SQL query (as opposed to concatenation into the query)?<br />作为参数的时候是否使用的是参数化的SQL查询（而不是连接到的查询）？ Oh，dear god! I really know nothing about this item.</li><li>Are steps taken to avoid SQL injection, Cross Site Scripting or other injection attacks (where appropriate)?<br />是否采用了如下措施去避免SQL注入，跨站脚本攻击和其他注入攻击（在适当的情况下）？</li><li>When supplying code and data as output, is it unambiguously clear where code and data are separated?<br />当提供的代码和数据作为输出的时候，是否真正做到了代码和数据的分离？</li></ol><p><strong>Information Exposure </strong><strong>信息披露</strong></p><ol><li>Do error messages distinguish correctly between information sent to internal and external users?<br />是否能够区分错误信息和正确的信息，并发送给内部人员和外部人员？（这句没读出来什么意思，按照我的理解来翻的。是否是说关于bug的级别信息，然后应该发送给不同的人员？Maybe，Tom knows。）</li><li>Are comments and private information removed from transmissions to the user?<br />在交给用户之前是否已经删掉了评论和私人信息？</li><li>Are internal IP addresses masked from external users?<br />内部IP是否屏蔽了外部用户的访问？</li><li>Are debug pages, and unused pages removed from the deployed web site?<br />开发网站上是否删除了调试页面和无用的页面？</li><li>Is debug and tracing code disabled, with no ability for unauthorized parties to use it or enable it?<br />调试和跟踪功能是否已经关闭，并且不会在未授权的情况下被打开或者使用？</li></ol><p><strong>Client-Side Security </strong><strong>客户端安全</strong></p><ol><li>Are security measures such as input validation implemented on the server-side?<br />像输入验证这样的安全措施是否是在服务器端实现的？</li><li>Are all security measures implemented on the client-side backed by equivalent or greater measures on the server-side?<br />所有在客户端验的安全施放，在服务器端是否有同等或者更多的措施来作为支撑？</li><li>Has the application (or changed components) been tested with custom clients that ignore client side restrictions?<br />应用程序（或者组件）在被客户端测试的时候，是否使用了一些客户端做不到的方法？</li></ol><p><strong>Poor Use of Cryptography </strong><strong>很少使用加密？</strong></p><ol><li>Have cryptography choices (key sizes, algorithms, etc.) been reviewed and approved by Policymakers?<br />加密（key的长度，算法等）的选择是否被决策人员审阅和确认过？</li><li>Are cryptographic elements configurable to change key sizes, choice of algorithms, etc.?<br />加密中的一些因素，例如Key的长度，算法是否是可配置的？</li><li>Is the cryptography implementation a widely-available library (as opposed to a custom solution, or developed in-house)?<br />加密的实现是否是一个广泛使用的库（而不是一个客户的解决方案或者闭门自制的）？</li><li>Is provision made for regular key rotation? Emergency key changes?<br />是否提供定期更换Key的功能？紧急情况下Key的修改？（还是别的什么意思？）</li></ol><p><strong>Thinking Only About Features </strong><strong>只关注功能本身</strong></p><ol><li>Has the application been tested by trying to feed it invalid input?<br />是否使用过非法的输入去测试应用程序？</li><li>Have there been any tests attempting to use SQL Injection, Cross-Site Scripting, etc.?<br />是否使用过SQL注入，跨站脚本攻击等办法去测试？</li><li>Has the application been written to reject incorrect or malicious data?<br />应用程序是否考虑到了恶意拒绝和恶意数据？</li><li>Does the application alert its operators about potential malicious behavior on the part of its users?<br />如果使用者在过去一段时间内的操作有潜在的破坏行为，应用程序是否会提醒使用者？</li><li>Does the application alert its operators about (mis-)configurations that reduce its security level?<br />如果某个操作会降低程序的安全性，应用程序是否会提醒使用者？</li><li><span>Has the application been reviewed to ensure that unauthenticated and unauthorized users are not given more access than is appropriate?</span>未授权用或者未被认证的用户不会获得更多</li></ol><p><strong>Race Condition</strong></p><ol><li>Is the code flexible enough to cope with resource requests completing earlier / later than anticipated?</li><li>Are checks on authorization guaranteed to occur before access is granted or resources are fetched?</li><li>Is the application able to handle rapidly repeated requests and distinguish correctly between them?</li><li>Does the application ensure that connection state is kept out of global / shared variables or memory space?</li><li><span>Are locks, mutexes, semaphores, etc. correctly used to ensure that shared resources are not shared across execution or security contexts?</span></li><li><span>Has the review team considered changes that will occur if the compiler / optimizer change the order of execution of statements (within its limits)?</span></li></ol><p><strong>Failing Open, Ignoring Failure </strong><strong>打开失败，忽略失败</strong></p><ol><li>Are all return values checked?<br />是否所有返回值都被处理了？</li><li>Where exceptions are expected, are they all caught?<br />所有的异常都能被捕获到吗？</li><li>Is checking of correct input done by “deny by default” (e.g. a “white-list” of correct characters / sequences)?<br />是否检查了‘潜规则’认为正确的输入（例如白名单列表）？</li><li>Are functions communicating failures up through their call stack?<br />函数调用失败的时候，是否通过调用堆栈来查看错误原因？</li><li>Is the code written to assume that requests are invalid until they prove themselves to be valid?<br />代码中是否假设请求都是无效的，直到有正确的请求到达？</li></ol><p><strong>Failing to Recognize or Enforce Bounds </strong><strong>误差和边界检查</strong></p><ol><li>Are all arithmetic operations guaranteed to not overflow or underflow?<br />所有的算术运算操作都检查上溢出和下溢出了吗？</li><li>Are buffer overflows actively prevented, either by choice of development environment, language or code checks?<br />是否通过选择开发环境、开发语言、代码检查来主动防止缓冲区溢出？</li><li>Are classes and libraries used that prevent overflow or underflow (as opposed to classes that do not)?<br />类和库是否有上下溢出检查（而不是不检查）？</li><li>Are library functions prown to buffer overrun, removed and replaced with?<br />当库出现缓冲区溢出的时候，是替换掉还是删除？（怪怪的。Prown 做何解？）</li><li>Does the test plan execute edge cases on boundary checks?<br />测试计划是否包含边界检查？</li><li><span>Have you checked the entrance and exit criteria for all loops in the code to ensure that they are correct, and correctly handled?<br /></span>确保所有循环的开始和停止条件都是正确的，并且被正确执行了？</li></ol><p><strong>Not Managing Resources from Creation to Destruction </strong><strong>从创建到销毁都没有资源管理？</strong></p><ol><li><span>Does each resource have a complete “story” that allows for a single creation and a single destruction, with managed ‘ownership’ in the middle?<br /></span>在管理从属关系的时候，是否每个资源都有完整的生命周期，是否允许单独创建和单独销毁？（有点乱）</li><li>Does the test plan monitor resource usage to detect inappropriate growth in memory usage, open file handles, etc.?<br />是否有测试用例去检查不合理的内存增长，例如文件句柄的打开等？</li><li>Do object constructors initialize all member variables (if only to a null value)?<br />是否所有的成员都在构造函数被初始化了（只被赋值为空）？</li><li>Do object constructors avoid using operations that can cause failure?<br />是否在构造函数中使用一些可能失败的操作？</li><li>Are circular references correctly avoided?<br />是否存在交叉引用？</li></ol><p><strong>Hard-Coded Password/Assuming the Source Code Is Selected </strong><strong>硬编码的密码或者测试代码<span>被选择？</span></strong></p><ol><li>Are all passwords, keys and other secret material removed from source code to configuration files?<br />密码、keys和其他安全相关的材料，所有这些都从代码中迁移到配置文件中了吗？</li><li>Has the executable code been scanned for the clear-text presence of strings that should not be there?<br />有可执行代码被当做不应该存在的纯粹的字符串吗？ （这么翻对吗？）</li><li>Does the code use a standard, EIS-approved, technique for storing keys in configuration files?<br />代码是否使用规范的技术（例如认证的EIS）， 把关键信息保存在配置文件中？</li><li>If the source code was given, as a whole, to an attacker, would they still be unable to attack the running program?<br />公开所有源代码，正在运行的程序是否依然无懈可击？</li></ol><p><strong>Unnecessary Complexity </strong><strong>没必要搞这个复杂</strong></p><ol><li>Is the code clear to read and understand, even without looking at the comments?<br />是否做到了‘代码就是最好的注释’？<br />第二种翻译：代码是否清晰易读，甚至不需要看注释？</li><li>Do the comments correctly describe the behavior of the source code?<br />注释和代码是否是一致的？</li><li>Do the comments completely describe the behavior of the source code?<br />注释是否涵盖了代码的全部功能？</li><li>Are any hidden / surprising / clever behaviors of the source code explained in comments?<br />一些隐藏的、预料之外的、技巧性的东西是否在注释中都有所提及？</li><li>Are the comments up to date?<br />注释是最新的吗？</li><li>Have all unexecuted portions of code been removed?<br />永远不可能被执行到的代码都被删除了吗？</li><li>Are function and variable names clear and meaningful?<br />函数和变量的名字是否清晰并有意义？</li></ol><p><strong>Static Code Analysis </strong><strong>静态代码分析</strong></p><ol><li>Has the code been analyzed with static code analysis tools that are configured to find security flaws?<br />代码是否采用静态代码分析工具去查找安全缺陷？</li><li>Have all new reports of possible security flaws been remediated correctly?<br />对于所有新发现的可能存在的安全问题，是否都采取了正确的安全补救措施？</li></ol></div><img src="http://www.cnblogs.com/flyingleaf/aggbug/2298322.html?type=1" width="1" height="1" alt=""/><p><a href="http://www.cnblogs.com/flyingleaf/archive/2011/12/22/2298322.html" target="_blank">本文链接</a></p>http://www.cnblogs.com/flyingleaf/archive/2005/12/20/300648.htmlP/Invoke.注册表监测 搞c#3周了，还是用起来觉得不顺。自己写不出来新东西，在codeproject上找了个监测注册表的，结果在.net 2.0上跑不起来，结果问问作者，说是2.0和1.0中的有点出入，结果当时没有来得及看到，导致我自己完全pinvoke了一个类。所以贴出来让大家批判一下，老风格：贴代码，很简单，不做说明了。usingSystem;usingSystem.Collections.Generic;usin...2005-12-20T02:30:00Z2005-12-20T02:30:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/http://www.cnblogs.com/flyingleaf/archive/2005/03/03/112229.html获取Tcp和UDP的连接信息 说明：获取Tcp和UDP的连接信息 。这里仅列了几项。如果需要其他的信息，请参考GetTcpTable and GetUdpTable。需要注意的是： dwTableSize=500*8+4; 我设置的是硬性的.其实是应该使用GetTcpTable先得到空间，接着再获取的。但是，如果那样子作的话，８０％的会失败！因为下一时刻和刚才的ｔｃｐ连接数不一样。如果少了，自然可以。如果多了就不行了。所以我用硬性的来试验。具体使用，请个人根据自己的实际环境吧。2005-03-03T08:10:00Z2005-03-03T08:10:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/http://www.cnblogs.com/flyingleaf/archive/2004/11/23/67588.html获得计算机名，用户名，系统路径，环境路径等。 一个获得系统和计算机信息的例子 高手莫如2004-11-23T07:29:00Z2004-11-23T07:29:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/http://www.cnblogs.com/flyingleaf/archive/2004/11/19/65728.html提高程序权限的函数.一个提升应用程序权限的例子,可以用来杀死系统进程的时候使用! :)2004-11-19T05:26:00Z2004-11-19T05:26:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/http://www.cnblogs.com/flyingleaf/archive/2004/11/09/62049.html海盗分黄金的故事,是老了点,但是还是很值得寻味的. 海盗分黄金的故事,是老了点,但是还是很值得寻味的. 2004-11-09T12:29:00Z2004-11-09T12:29:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/http://www.cnblogs.com/flyingleaf/archive/2004/11/04/60407.html英语妙语 （关于爱情） 肉丝推荐 ：）英语妙语 （关于爱情） 肉丝推荐 ：） 不可多得哦 2004-11-04T07:26:00Z2004-11-04T07:26:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/http://www.cnblogs.com/flyingleaf/archive/2004/10/28/57835.html一个很简练的计算圆周率的例子，具体出处找不到了，据说是个得奖作品      #include <stdio.h>    long a=10000,b=0,c=10000,d,e,f[10001],g;     void main()     {    ...2004-10-28T09:34:00Z2004-10-28T09:34:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/http://www.cnblogs.com/flyingleaf/archive/2004/10/28/57833.html判断输入的三个数字是什么类型的三角形没有技术含量2004-10-28T09:29:00Z2004-10-28T09:29:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/http://www.cnblogs.com/flyingleaf/archive/2004/10/28/57828.html使用数组的猫吃老鼠游戏也没有技术含量2004-10-28T09:22:00Z2004-10-28T09:22:00Zflyingleafhttp://www.cnblogs.com/flyingleaf/