Improving Web Application Security: Threats and - CGISecurity

642 Part V: Assessing Your SecurityDo You Close Database Connections?Check that your code is not vulnerable to leaving open database connections if, forexample, exceptions occur. Check that the code closes connections inside a finallyblock or that the connection object is constructed inside a C# using statement asshown below. This automatically ensures that it is closed.using ((SqlConnection conn = new SqlConnection(connString))){conn.Open();// Connection will be closed if an exception is generated or if control flow// leaves the scope of the using statement normally.}SummarySecurity code reviews are similar to regular code reviews or inspections except thatthe focus is on the identification of coding flaws that can lead to securityvulnerabilities. The added benefit is that the elimination of security flaws oftenmakes your code more robust.This chapter has shown you how to review managed code for top security issuesincluding XSS, SQL injection, and buffer overflows. It has also shown you how toidentify other more subtle flaws that can lead to security vulnerabilities andsuccessful attacks.Security code reviews are not a panacea. However, they can be very effective andshould feature as a regular milestone in the development life cycle.Additional ResourceFor more information, see MSDN article, “Securing Coding Guidelines for the .NETFramework,” at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/seccodeguide.asp.