Coding review guide مراجعة الشيفرة البرمجية

Coding Review
Guide
Security and review guideline and
practice, life cycle view
‫أﺑوﺣﻣﯾد‬ ‫ﺣﻛﻣت‬ ‫أﻧﯾس‬ :‫إﻋداد‬

‫اﻟﻣﻘدﻣﺔ‬
‫اﻟرﺣﯾم‬ ‫اﻟرﺣﻣن‬ ‫ﷲ‬ ‫ﺑﺳم‬
،ً‫ﺎ‬ّ‫ﯾ‬‫وﻓ‬ ‫ﻟﮫ‬ ‫ﻛﺎن‬ ‫ﻣن‬ ‫وﯾﻛرم‬ ،ً‫ﺎ‬ّ‫ﯾ‬ِ‫ﯾ‬‫ﺣ‬ ‫ﻣﻧﮫ‬ ‫ﻛﺎن‬ ‫ﻣن‬ ُ‫د‬‫وﯾزﯾ‬ ،ً‫ﺎ‬ّ‫ﯾ‬‫ﻧﺟ‬ ‫ﻧﺎداه‬ ‫ﻣن‬ ‫ُﺟﯾب‬‫ﯾ‬‫و‬ ،ً‫ﺎ‬‫ﺧﻔﯾ‬ ‫دﻋﺎه‬ ‫ﻣن‬ ‫ُﺣب‬‫ﯾ‬ ،‫اﻟﻌﺎﻟﻣﯾن‬ ّ‫رب‬ ‫هلل‬ ‫اﻟﺣﻣد‬
.‫اﻟﻌﺎﻟﻣﯾن‬ ّ‫رب‬ ‫هلل‬ ‫اﻟﺣﻣد‬ ،ً‫ﺎ‬ّ‫ﯾ‬‫رﺿ‬ ‫اﻟوﻋد‬ ‫ﺻﺎدق‬ ‫ﻛﺎن‬ ‫ﻣن‬ ‫وﯾﮭدي‬
‫ﻟﻛل‬ ‫اﻟﻣﮭﻣﺔ‬ ‫اﻷﻣور‬ ‫ﻣن‬ ‫ﺑﮫ‬ ‫واﻹھﺗﻣﺎم‬ ‫اﻟﺗطور‬ ‫ھذا‬ ‫وﻣﺗﺎﺑﻌﺔ‬ ،‫وﻣﮭﺎﻣﮭﺎ‬ ‫وظﺎﺋﻔﮭﺎ‬ ‫ﻓﻲ‬ ‫ﺗﺗﻌدد‬ ،‫ﻛﺛﯾرة‬ ‫ﻣﺗﻧوﻋﺔ‬ ‫ﻋﻠوم‬ ‫اﻟﺗﻘﻧﯾﺔ‬ ‫اﻟﻌﻠوم‬
‫ﻣﻊ‬ ‫اﻟﺣﯾﺎة‬ ‫ﻗﯾد‬ ‫ﻋﻠﻰ‬ ‫اﻟﺗﻘﻧﯾﺔ‬ ‫اﻟﻌﻠوم‬ ‫ﺻﺎﺣب‬ ‫ﻟﺗﺟﻌل‬ ‫ﺑﻣﻛﺎن‬ ‫اﻷھﻣﯾﺔ‬ ‫ﻣن‬ ‫وھﻲ‬ ،‫واﻟﻌﻣﻠﯾﺔ‬ ‫اﻟﻌﻠﻣﯾﺔ‬ ‫ﻗدراﺗﮫ‬ ‫ﺗطوﯾر‬ ‫ﻓﻲ‬ ‫ﯾرﻏب‬ ‫ﻣن‬
.‫ﻋﺻره‬ ‫ﺑﻌد‬ ‫ﻣﺎ‬ ‫أو‬ ‫ﻋﺻره‬ ‫ﻓﻲ‬ ‫وﺗﺟددت‬ ‫اﻟﺗﻘﻧﯾﺎت‬ ‫ﺗﻌددت‬ ‫ﻣﮭﻣﺎ‬ ‫أﻗراﻧﮫ‬
‫أي‬ ‫ﻣراﺟﻌﺔ‬ ‫ﯾﻣﻛن‬ ‫ﻛﯾف‬ ‫وھو‬ ،‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﻓﻲ‬ ‫ﻣﮭم‬ ‫ﻷﻣر‬ ‫اﻟﺷراﺋﺢ‬ ‫ھذه‬ ‫ﻓﻲ‬ ‫ﺳﻧﺗطرق‬ ،‫ﺳﺑق‬ ‫ﻣﺎ‬ ‫ﻋﻠﻰ‬ ‫وﺑﻧﺎءا‬ ،‫ﻟذﻟك‬
.‫ﷲ‬ ‫ﺑﺈذن‬ ‫ﻧﺑدأ‬ ‫ھﻧﺎ‬ ‫وﻣن‬ ،‫آﻣﻧﺔ؟‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫اﻋﺗﺑﺎرھﺎ‬ ‫ﯾﻣﻛن‬ ‫وﻛﯾف‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬

‫ﻧﺑدأ‬ ‫أن‬ ‫ﻗﺑل‬
●
‫ﻛﺗﺎﺑﺔ‬ ‫ﺗﻣت‬ ‫وﻗد‬ ،secure coding review ‫وال‬ coding review ‫ال‬ ‫ﻣﻔﺎھﯾم‬ ‫ﻋﻠﻰ‬ ‫ﺗرﻛز‬ ‫اﻟﺷراﺋﺢ‬ ‫ھذه‬
.‫وﻣﮭﺎراﺗﮭم‬ ‫اﻟﻌﻣل‬ ‫ﺑﻔرﯾق‬ ‫اﻟﺧﺎﺻﺔ‬ development plan ‫ال‬ ‫ﻣﻊ‬ ‫ﻟﺗﺗﻧﺎﺳب‬ ‫اﻟﺷراﺋﺢ‬ ‫ھذه‬
●
.‫ﺑﺳﮭوﻟﺔ‬ ‫ﻋﻧﮭﺎ‬ ‫اﻟﺑﺣث‬ ‫وﯾﻣﻛن‬ ،‫ﻣﻔﺻل‬ ‫ﺑﺷﻛل‬ ‫إﻟﯾﮭﺎ‬ ‫اﻟﺗطرق‬ ‫دون‬ ‫ھﻧﺎ‬ ‫اﻟﺗﻘﻧﯾﺔ‬ ‫اﻟﻣﺻطﻠﺣﺎت‬ ‫ﻣن‬ ‫ﻟﻠﻌدﯾد‬ ‫اﻹﺷﺎرة‬ ‫ﯾﺗم‬ ‫ﻗد‬
●
‫ﻣﺳﺗﻘﻠﺔ‬ ‫ﺷرﯾﺣﺔ‬ ‫أﻧﮭﺎ‬ ‫ﻣﻊ‬ ‫ﻗﺑﻠﮭﺎ‬ ‫ﺑﻣﺎ‬ ‫ﺗرﺗﺑط‬ ‫ﻋﻧﺎوﯾن‬ ‫ﺗﺟد‬ ‫ﻗد‬ ‫ﻟذﻟك‬ ،‫اﻟﺳرد‬ ‫طرﯾﻘﺔ‬ ‫ﻣﻊ‬ ‫ﻟﺗﺗﻧﺎﺳب‬ ‫اﻟﺷراﺋﺢ‬ ‫ﺑﻌض‬ ‫ﻋﻧوﻧﺔ‬ ‫ﺗم‬
.‫واﻟﺳرد‬ ‫اﻟﺷرح‬ ‫وﺳﮭوﻟﺔ‬ ‫ﻟﻠﺗﻔﺻﯾل‬ ‫وذﻟك‬

‫اﻟذھﺑﯾﺔ‬ ‫اﻟﻘﺎﻋدة‬
،‫اﻹﻣﻛﺎن‬ ‫ﻗدر‬ ‫واﻷﻣﻧﯾﺔ‬ ‫اﻟﺗﻘﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫وﻣن‬ ‫اﻹﺧﺗراق‬ ‫ﻣن‬ ‫أﻧﻔﺳﻧﺎ‬ ‫ﻧﺣﻣﻲ‬ ‫ﻷن‬ ‫ﻧﺳﻌﻰ‬ ‫أﻧﻧﺎ‬ ‫ھﻲ‬ ،‫ﻧﺑدأ‬ ‫أن‬ ‫ﻗﺑل‬ ‫اﻟذھﺑﯾﺔ‬ ‫اﻟﻘﺎﻋدة‬
‫واﻟﻘﯾﺎم‬ ‫اﻟﻣوﺟودة‬ ‫اﻟﺛﻐرات‬ ‫ﻟﺗﻔﺣص‬ ‫اﻟﻼزم‬ ‫واﻟوﻗت‬ ‫اﻟﻘدرة‬ ‫ﻟدﯾﮭم‬ ‫اﻟﻣﺧﺗرﻗﯾن‬ ‫ﻓﺈن‬ ،‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫ﺣرﯾﺻﯾن‬ ‫ﻛﻧﺎ‬ ‫ﻣﮭﻣﺎ‬ ‫ﻟﻛﻧﻧﺎ‬
،‫اﻟﻣﻌرﻛﺔ‬ ‫أرض‬ ‫ﻋﻠﻰ‬ ‫اﻟﺻﻣود‬ ‫ﺷرف‬ ‫ﻧﻧﺎل‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫ﻟﻛﻧﻧﺎ‬ ،‫ﻋﺎدﻟﺔ‬ ‫ﻏﯾر‬ ‫ﻣﻌرﻛﺔ‬ ‫ھﻲ‬ ،‫ﻋﻠﯾﮭﺎ‬ ‫اﻟﻌﺛور‬ ‫ﺣﯾن‬ ‫اﻻﺧﺗراق‬ ‫ﺑﻌﻣﻠﯾﺎت‬
.‫وﻧﻘﺎوم‬ ‫ﺻﺎﻣدون‬ ‫ﻧﺑﻘﻰ‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﺑل‬ ،‫ﺑﺎﻻﺳﺗﺳﻼم‬ ‫ﻧﻛﺗﻔﻲ‬ ‫ﻻ‬ ‫وأن‬

Secure Code Review ‫ﺑﺎل‬ ‫ﯾﻘﺻد‬ ‫ﻣﺎذا‬
،‫اﻟﺑرﻧﺎﻣﺞ‬- ‫اﻟﺗطﺑﯾق‬ ‫ﻓﻲ‬ ‫اﻟﻣوﺟودة‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻌﯾوب‬ ‫ﻣن‬ ‫واﻟﺗﺣﻘق‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻟﻣراﺟﻌﺔ‬ ‫ﺗﮭدف‬ ‫اﻟﺗﻲ‬ ‫اﻟﻌﻣﻠﯾﺔ‬ ‫ھﻲ‬
‫آﻣﻧﺔ‬ ‫ﺑطرﯾﻘﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫وﺑﻧﺎء‬ ‫ﺑﮫ‬ ‫اﻟﺧﺎص‬ ‫اﻟﺗﺻﻣﯾم‬ ‫وطرﯾﻘﺔ‬ ،‫اﻟﺗطﺑﯾق‬ ‫ﺑﮭذا‬ ‫اﻟﺧﺎﺻﺔ‬ ‫ﺑﺎﻟﻣزاﯾﺎ‬ ‫واﻟﻣﺗﻌﻠﻘﺔ‬ -‫اﻟﺦ‬..‫اﻟﻣوﻗﻊ‬
‫ﺷﯾوﻋﺎ‬ ‫اﻟﮭﺟﻣﺎت‬ ‫أﻛﺛر‬ ‫أﻣﺎم‬ ‫اﻟﺻﻣود‬ ‫ﯾﻣﻛﻧﮫ‬ ‫اﻟﺗطﺑﯾق‬ ‫أن‬ ‫ﺗﺿﻣن‬ ‫وﺑﺣﯾث‬ ،‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﻣن‬ ‫ﻣﻣﻛن‬ ‫ﻋدد‬ ‫وﺑﺄﻗل‬ ‫وﻣﻧﺎﺳﺑﺔ‬
."self-defending" ‫اﻹﻣﻛﺎن‬ ‫ﻗدر‬ ‫ﻧﻔﺳﮫ‬ ‫ﺣﻣﺎﯾﺔ‬ ‫ﻋﻠﻰ‬ ‫اﻟﻘدرة‬ ‫وﻟدﯾﮫ‬
‫ﻟﻛن‬ ،‫اﻟﻣوﺟودة‬ ‫اﻟﺗطﺑﯾﻘﺎت‬ ‫ﺑﻌض‬ ‫اﺳﺗﺧدام‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫أو‬ ‫اﻟﺑﺷري‬ ‫اﻟﺟﮭد‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫ﺑﻌﻣﻠﯾﺔ‬ ‫اﻟﻘﯾﺎم‬ ‫ﯾﻣﻛن‬
‫ذات‬ ‫اﻟﺗطﺑﯾﻘﺎت‬ ‫ﻓﻲ‬ ‫ﺧﺻوﺻﺎ‬ ‫اﻟﺗطﺑﯾﻘﺎت‬ ‫ﻣن‬ ‫اﻹﺳﺗﻔﺎدة‬ ‫وﯾﻣﻛن‬ ،‫اﻟﺑﺷري‬ ‫اﻟﺟﮭد‬ ‫ﻋن‬ ‫اﻹﺳﺗﻐﻧﺎء‬ ‫ﯾﻣﻛن‬ ‫ﻻ‬ ‫اﻷﺣوال‬ ‫ﻛل‬ ‫ﻋﻠﻰ‬
‫اﻷﻣﺎﻛن‬ ‫ھذه‬ ‫ﺑﻣراﺟﻌﺔ‬ ‫اﻷﻣﻧﻲ‬ ‫اﻟﺧﺑﯾر‬ ‫ﻗﯾﺎم‬ ‫ﺛم‬ ‫وﻣن‬ ،‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫أﻣﺎﻛن‬ ‫ﻟﺗﺣدﯾد‬ ‫اﻟﻛﺑﯾرة‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬
...‫ﺑﮭﺎ‬ ‫اﻟﺧﺎص‬ ‫اﻟﻌﻣل‬ ‫وﺳﯾر‬ ‫ودراﺳﺗﮭﺎ‬ ‫اﻟﻌﻣﻠﯾﺎت‬ ‫ﻟﻛل‬ ‫اﻟﻧﺗﺎﺋﺞ‬ ‫ﻛل‬ ‫ﻣن‬ ‫واﻟﺗﺣﻘق‬

Code Review and Secure Code Review ‫ﺑﯾن‬ ‫اﻟﻔرق‬ ‫ھو‬ ‫ﻣﺎ‬
5 ‫إﻟﻰ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫ھذه‬ ‫ﺗﻘﺳﯾم‬ ‫ﯾﻣﻛن‬ ،‫اﻟﺑرﻣﺟﯾﺔ‬ ‫ﻟﻠﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫ﺑﻌﻣل‬ ‫ﺗﻘوم‬ ‫ﺗطﺑﯾﻘﮭﺎ‬ ‫ﺑﺗطوﯾر‬ ‫ﺗﻘوم‬ ‫ﺷرﻛﺔ‬ ‫أي‬ ‫أن‬ ‫اﻟﻘول‬ ‫ﯾﻣﻛن‬
‫ﺗﻛرار‬ ‫ﺗﺣﺗوي‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫ﺑﺎﻟﺷﯾﻔرة‬ ‫اﻟﺧﺎص‬ ‫اﻟﻣﺳﺗوى‬ ‫ھو‬ ‫ﻣﺳﺗوى‬ ‫أول‬ ‫ﻓﯾﻛون‬ ،(CMM) ‫اﻟﻣﻘﯾﺎس‬ ‫وھذا‬ ،‫درﺟﺎت‬
‫واﻟﺷﯾﻔرة‬ ،‫اﻟﻣﺷﺎﻛل‬ ‫ﻣن‬ ‫ﻋدد‬ ‫وﺑﺄﻗل‬ ‫وﻣﻧﺳﻘﺔ‬ ‫ﻣﻧظﻣﺔ‬ ‫ﺗطوﯾر‬ ‫ﺑﯾﺋﺔ‬ ‫وھو‬ ‫اﻟﺧﺎﻣس‬ ‫اﻟﻣﺳﺗوى‬ ‫إﻟﻰ‬ ‫وﺻوﻻ‬ ،‫ﻣﺳﺗﻘرة‬ ‫ﻏﯾر‬ ‫واﻟﻧﺗﺎﺋﺞ‬
،‫اﻟﺻﺣﯾﺢ‬ ‫ﺑﺎﻟﺷﻛل‬ ‫ﯾﺳﯾر‬ ‫اﻟﻌﻣل‬ ‫أن‬ ‫ﻣن‬ ‫ﻟﻠﺗﺣﻘق‬ ‫ﺑﻣراﺣل‬ ‫اﻟﻣﺷروع‬ ‫وﯾﻣر‬ ،‫ﺑﺎﻟﻣﺷروع‬ ‫ﺧﺎص‬ ‫ﺗوﺛﯾق‬ ‫وھﻧﺎك‬ ،‫ﻣوﺛﻘﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬
.Code Review ‫ال‬ ‫ﺿﻣن‬ ‫ﯾﻘﺑﻊ‬ ‫ﻛﻠﮫ‬ ‫ھذا‬
‫أوﻟوﯾﺔ‬ ‫وإﻋطﺎء‬ ‫ﻓﯾﮫ‬ ‫ﺑﻣﺎ‬ ‫اﻟﺳﺎﺑق‬ ‫ﻟﻠﻧﻣوذج‬ ‫ﺗﺣﺳﯾن‬ ‫ﻋن‬ ‫ﻋﺑﺎرة‬ ‫وھﻲ‬ ،Secure Code Review ‫ال‬ ‫دور‬ ‫ﯾﺄﺗﻲ‬ ‫وھﻧﺎ‬
‫اﻟﻣﺷﺎﻛل‬ ‫ﺗراﻋﻲ‬ ‫اﻟﻌﻣل‬ ‫ﻟﺳﯾر‬ ‫وﻗواﻋد‬ ‫ﻧﻣوذج‬ ‫وﺑﻧﺎء‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﯾﺧص‬ ‫ﻣﺎ‬ ‫ﺣول‬ ‫اﻟﻘرار‬ ‫اﺗﺧﺎذ‬ ‫ﻋﻠﻰ‬ ‫وﻗدرة‬
‫أﺛﻧﺎء‬ ‫ﺑﮭﺎ‬ ‫ﯾﻠﺗزﻣوا‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﻌﺎﯾﯾر‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫ﺿﻣن‬ ‫اﻟﻣطورﯾن‬ ‫ﻣﻌﮭﺎ‬ ‫وﯾﺗﻌﺎﻣل‬ ،‫ﺣﺻوﻟﮭﺎ‬ ‫ﻗﺑل‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻷﻣﻧﯾﺔ‬
.‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻛﺗﺎﺑﺔ‬

Coding Review ‫وال‬ ‫اﻟﺗوﺛﯾق‬
‫اﻟﺻﻔر‬ ‫ﺑﯾن‬ ‫اﻟﺷرﻛﺎت‬ ‫ﻓﻲ‬ ‫اﻟﺗوﺛﯾق‬ ‫وﯾﺗرواح‬ ،‫ﺗوﺛﯾﻘﮭﺎ‬ ‫وطرﯾﻘﺔ‬ ‫آﻟﯾﺔ‬ ‫ھﻲ‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﻓﻲ‬ ‫اﻟﺗﺣدﯾﺎت‬ ‫أﻛﺑر‬ ‫ﻣن‬ ‫إن‬
‫ﻋﻧﺎ‬ ‫ﺗﻐﯾب‬ ‫ﻗد‬ ‫اﻟﺗﻲ‬ ‫اﻟﺗوﺛﯾق‬ ‫ﻧﻘﺎط‬ ‫ﻣن‬ ‫واﺣدة‬ ،-module ‫ال‬ ‫ﺣﺟم‬ ‫ﯾﻔوق‬ NASA ‫ﻓﻲ‬ ‫اﻟﺗوﺛﯾق‬- NASA ‫ﻣﺳﺗوى‬ ‫إﻟﻰ‬
‫ﺑوﺿﻊ‬ ‫ﻗﺎم‬ ‫وﻟﻣذا‬ ،‫اﻟﺧوارزﻣﯾﺔ‬ ‫ھذه‬ ‫اﻟﻣﺑرﻣﺞ‬ ‫اﺳﺗﺧدم‬ ‫ﻟﻣﺎذا‬ ‫ﺷرح‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ھو‬ ‫ﺟدا‬ ‫ﻓﻌﺎل‬ ‫ﺑﺷﻛل‬ ‫ﻣﻧﮭﺎ‬ ‫اﻹﺳﺗﻔﺎدة‬ ‫وﯾﻣﻛن‬
‫اﻟﺑرﻣﺟﯾﺔ‬ ‫ﻟﻠﺷﯾﻔرة‬ ‫اﻟرﺟوع‬ ‫ﻣن‬ ‫ﺳﻧوات‬ ‫ﺑﻌد‬ ،‫ﻗدﯾم‬ ‫أو‬ ‫ﺟدﯾد‬ ‫ﻣﺑرﻣﺞ‬ ‫أي‬ ‫ﺳﯾﺳﺎﻋد‬ ‫ھذا‬ ،...‫ﻣﻌﯾن‬ ‫ﺑﺷﻛل‬ ‫ﻟﻠﻌﻣﻠﯾﺎت‬ ‫اﻟﺗﺳﻠﺳل‬
‫وھل‬ ،‫اﻟﻣﺷﻛﻠﺔ‬ ‫ﻟﺣل‬ ‫اﻷﻓﺿل‬ ‫ھو‬ ‫ﻛﺗب‬ ‫ﻣﺎ‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﻓﻲ‬ ‫ھﻧﺎ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫دور‬ ‫وﯾﻛون‬ ،‫ﺳﮭل‬ ‫ﺑﺷﻛل‬ ،‫اﻟﻌﻣل‬ ‫ﺳﯾر‬ ‫وﻓﮭم‬
‫ﻷي‬ ‫اﻟﻧﺎﺗﺟﺔ‬ bugs ‫ال‬ ‫ﻛﻣﯾﺔ‬ ‫ﺗﻘﻠﯾل‬ ‫ﻓﻲ‬ ‫ﺗﺳﺎﻋد‬ ‫اﻟﻌﻣﻠﯾﺔ‬ ‫ھذه‬ ‫ﻓﺈن‬ ‫ھذا‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،...‫ﺻﺣﯾﺢ‬ ‫واﻟﺗﻧﻔﯾذ‬ ،‫ﺻﺣﯾﺢ‬ ‫اﻟﺗوﺛﯾق‬
...‫ﺗﻌدﯾل‬ ‫أي‬ ‫ﻋﻧد‬ bugs ‫ال‬ ‫وﺗﻘﻠﯾل‬ ،‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬

Coding Review ‫وال‬ unit test ‫ال‬
‫ھذه‬ ،unit test ‫ﻛﺗﺎﺑﺔ‬ ‫ﻋﻠﻰ‬ ‫اﻟﻣﺑرﻣﺞ‬ ‫اﺟﺑﺎر‬ ‫أو‬ ‫اﺳﺗﺧدام‬ ‫ھﻲ‬ ‫اﻟﺷرﻛﺔ‬ ‫ﺗﺗﺧذھﺎ‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻟﺟﻣﯾﻠﺔ‬ ‫اﻟﻣﻌﺎﯾﯾر‬ ‫ﻣن‬ ‫واﺣدة‬
‫وﺟود‬ ‫ﻓرﺿﻧﺎ‬ ‫ﻟو‬ ‫ﻣﺛﻼ‬ ،‫ﻣوﺟودة‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫ﻣﺎ‬ ‫ﻟﻌﻣﻠﯾﺔ‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻟﻧﺗﺎﺋﺞ‬ ‫طﯾﺎﺗﮭﺎ‬ ‫ﻓﻲ‬ ‫ﺗﺣوي‬ unit test ‫ال‬
،‫ذﻟك‬ ‫ﻏﯾر‬ ‫اﻟﻧﺎﺗﺞ‬ ‫ﻛﺎن‬ ‫ﻓﺈن‬ ،3 ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﻧﺎﺗﺞ‬ ‫ﻓﺈن‬ ،2 ‫و‬ 1 ‫ﻓﻲ‬ ‫اﻷرﻗﺎم‬ ‫وﻛﺎﻧت‬ function sum(var1,var2)
‫ھﻧﺎ‬ ‫وﻋﺎدة‬ reviewer ‫ال‬ ‫دور‬ ‫ﯾﺄﺗﻲ‬ ،‫ﺑذﻟك‬ ‫ﯾﻘم‬ ‫ﻟم‬ ‫ﻓﺈن‬ ،‫ﻣﻧﮫ‬ ‫اﻟﺗﺣﻘق‬ ‫ﻟﻠﻣطور‬ ‫وﯾﻣﻛن‬ ،‫ﺧطﺄ‬ ‫وﺟود‬ ‫ﻋﻠﻰ‬ ‫دﻟﯾﻼ‬ ‫ھذا‬ ‫ﺳﯾﻛون‬
‫ﺧطﺄ‬ ‫أي‬ ‫ﺣﺻل‬ ‫إن‬ ،‫ﺻﺣﯾﺣﺔ‬ ‫ﺗﻧﻔﯾذھﺎ‬ ‫ﻧﺗﯾﺟﺔ‬ ‫وھل‬ ،‫ﻣوﺟودة‬ unit test ‫ال‬ ‫ھل‬ ‫ﻓﯾﻧظر‬ ،automated test ‫ﯾﻛون‬
...‫اﻟﺟدﯾدة‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫رﻓﻊ‬ ‫ﯾﺗم‬ ‫ﻓﻠن‬

code review ‫ال‬ ‫ﻣن‬ ‫اﻟﻣﺑﺗدﺋﯾن‬ ‫اﻟﻣﺑرﻣﺟﯾن‬ ‫ﯾﺗﻌﻠﻣﮫ‬ ‫ﻣﺎ‬
‫ﺗﻌﻠﻣﮭم‬ ‫ﺑﻌد‬- (junior) ‫ال‬ ‫اﻟﻣﺑﺗدﺋﯾن‬ ‫اﻟﻣﺑرﻣﺟﯾن‬ ‫ﻣﻧﮭﺎ‬ ‫ﯾﺗﻌﻠم‬ ‫اﻟﺗﻲ‬ ‫اﻟطرق‬ ‫أھم‬ ‫ﻣن‬ ‫واﺣدة‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫إن‬
‫اﻟﺧﺑرة‬ ‫اﻷﻛﺛر‬ ‫ﻟﻠﻣﺑرﻣﺟﯾن‬ ‫اﻟﺿﻣﻧﯾﺔ‬ ‫اﻟﻣﻌرﻓﺔ‬ ‫ﻧﻘل‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﺗﺗﺣﻘق‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫ھذه‬ ،-‫اﻟﻛﺗب‬ ‫ﻟﺑﻌض‬ ‫ﻗراءﺗﮭم‬ ‫و‬ ‫اﻟﺑرﻣﺟﺔ‬
‫ﻋﻠﻰ‬ ‫اﻹطﻼع‬ ‫ﻋﻠﻰ‬ ‫ﻗدرة‬ ‫ﻣن‬ ‫ﻟﮫ‬ ‫ﺗﻘدﻣﮫ‬ ‫ﻟﻣﺎ‬ junior ‫ال‬ ‫ﻣﺳﺗوى‬ ‫ﻓﻲ‬ ‫ﻛﺑﯾرة‬ ‫ﻗﻔزات‬ ‫ﺗﻘدم‬ ‫ھذه‬ ‫اﻟﺧﺑرة‬ ‫ﻧﻘل‬ ‫ﻋﻣﻠﯾﺔ‬ ،‫ﻟﻶﺧرﯾن‬
‫ﯾﺗﻌﻠﻣون‬ ‫اﻟﺧﺑرة‬ ‫ذوي‬ ‫اﻟﻣﺑرﻣﺟﯾن‬ ‫أن‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫اﻟﻌﻣل‬ ‫ﻋﻠﻰ‬ ‫ﺗﺳﺎﻋده‬ ‫وﻣﻛﺗﺑﺎت‬ ‫وﺗﻘﻧﯾﺎت‬ ،‫ﻣﺎ‬ ‫ﻣﺷﻛﻠﺔ‬ ‫ﻟﺣل‬ ‫أﺧرى‬ ‫ﺣﻠول‬
‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫ﻣﻧﮫ‬ ‫أﻗدم‬ ‫ھو‬ ‫ﻣن‬ ‫ﯾﻌﻠﻣﮭﺎ‬ ‫وﻟم‬ ‫وﺗﻌﻠﻣﮭﺎ‬ ‫ﻋﻧﮭﺎ‬ ‫ﻗرأ‬ ‫رﺑﻣﺎ‬ ‫اﻟﻣﺷﻛﻠﺔ‬ ‫ﻟﺣل‬ ‫ﺟدﯾدة‬ ‫ﺗﻘﻧﯾﺔ‬ ‫أﺳﺎﻟﯾب‬ junior ‫ال‬ ‫ھذا‬ ‫ﻣن‬
،‫ﺧﺑرة‬ ‫اﻷﻛﺛر‬ ‫ﻟﻠﻣﺑرﻣﺟﯾن‬ ‫اﻟﻣﺑﺗدﺋﯾن‬ ‫اﻟﻣﺑرﻣﺟﯾن‬ ‫ﻣن‬ ‫اﻟﻔﻛرة‬ ‫ﻓﺗﻧﺗﻘل‬ ،‫ﻣﺎ‬ ‫ﻣﺷﻛﻠﺔ‬ ‫ﻟﺣل‬ ‫واﺑداﻋﯾﺔ‬ ‫ذﻛﯾﺔ‬ ‫ﺗﻛون‬ ‫ﻗد‬ ‫اﻟﺗﻲ‬ ‫اﻟﺣﻠول‬
‫ﻻ‬ ‫ﻛﺎن‬ ‫إن‬ ‫واﻟﺧﺑﯾر‬ ،‫اﻟﻣﺑﺗدئ‬ ‫أو‬ ‫اﻟﺧﺑﯾر‬ ‫رأي‬ ‫ﻓوق‬ ‫ھو‬ ‫وﺛﺑت‬ ‫اﻟﻌﻠم‬ ‫ﻣن‬ ‫ﺻﺢ‬ ‫ﻣﺎ‬ ‫أن‬ ‫وھﻲ‬ ،‫ﺟدا‬ ‫ﻣﮭﻣﺔ‬ ‫ﻟﻘﺎﻋدة‬ ‫ﯾﻘودﻧﺎ‬ ‫وھذا‬
‫إﻟﯾﮫ‬ ‫أﻟﻘﻰ‬ ‫ﻣن‬ ‫واﻗﺗراح‬ ‫ﻣﺷورة‬ ‫وﯾرﻓض‬ ،‫اﻟﺗﻌﻠم‬ ‫ﯾرﻓض‬ ‫اﻟذي‬ ‫واﻟﻣﺑﺗدأ‬ ،‫اﻵﺧرون‬ ‫ﺳﯾﺳﺑﻘﮫ‬ ‫أو‬ ‫ﺳﯾﻧﻘرض‬ ‫ﺑرأﯾﮫ‬ ‫إﻻ‬ ‫ﯾﺄﺧذ‬
...‫أﺑدا‬ ‫ﯾﺗطور‬ ‫ﻓﻠن‬ ‫ﻣﻌﻠوﻣﺔ‬

‫واﻟﻌﺰﻳﻤﺔ‬ ،‫اﻷﻣﺮ‬ ‫ﻓﻲ‬ ‫اﻟﺜﺒﺎت‬ ‫أﺳﺄﻟﻚ‬ ‫إﻧﻲ‬ ‫اﻟﻠﻬﻢ‬
‫وأﺳﺄﻟﻚ‬ ،‫ﻧﻌﻤﺘﻚ‬ ‫ﺷﻜﺮ‬ ‫وأﺳﺄﻟﻚ‬ ،‫اﻟﺮﺷﺪ‬ ‫ﻋﻠﻰ‬
‫وأﺳﺄﻟﻚ‬ ،‫ﺳﻠﻴﻤﺎ‬ ‫ﻗﻠﺒﺎ‬ ‫وأﺳﺄﻟﻚ‬ ،‫ﻋﺒﺎدﺗﻚ‬ ‫ﺣﺴﻦ‬
‫ﺑﻚ‬ ‫وأﻋﻮذ‬ ‫ﺗﻌﻠﻢ‬ ‫ﻣﺎ‬ ‫ﺧﻴﺮ‬ ‫ﻣﻦ‬ ‫وأﺳﺄﻟﻚ‬ ،‫ﺻﺎدﻗﺎ‬ ‫ﻟﺴﺎﻧﺎ‬
‫أﻧﺖ‬ ‫إﻧﻚ‬ ،‫ﺗﻌﻠﻢ‬ ‫ﻟﻤﺎ‬ ‫وأﺳﺘﻐﻔﺮك‬ ،‫ﺗﻌﻠﻢ‬ ‫ﻣﺎ‬ ‫ﺷﺮ‬ ‫ﻣﻦ‬
‫اﻟﻐﻴﻮب‬ ‫ﻋﻼم‬

Familiarization with code base
‫أﺟزاء‬ ‫ﻣﻊ‬ ‫ﻣﺗﺂﻟﻔﺎ‬ ‫اﻟﻔرﯾق‬ ‫ﺟﻌل‬ ‫ھﻲ‬ ‫اﻟﻔرﯾق‬ ‫أﻋﺿﺎء‬ ‫ﺑﯾن‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻣن‬ ‫ﺗﻧﺑﺛق‬ ‫اﻟﺗﻲ‬ ‫اﻟﻧﻘﺎط‬ ‫أھم‬ ‫ﻣن‬ ‫واﺣدة‬
‫ﺑﺄن‬ ‫اﻟﻌﻣل‬ ‫ﻓرﯾق‬ ‫ﻓﻲ‬ ‫ﻣﺗواﺟد‬ ‫ﻣطور‬ ‫ﻷي‬ ‫ﻗوة‬ ‫ﯾﻌطﻲ‬ ‫اﻟﺗﺂﻟف‬ ‫ھذا‬ ،‫اﻟﻣﺷروع‬ ‫ﺿﻣن‬ ‫واﻟﻣوﺟودة‬ ‫اﻟﻣﺧﺗﻠﻔﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬
‫ﻓﺈن‬ ‫وﺑﮭذا‬ ،‫واﺣد‬ ‫ﺷﺧص‬ ‫ﻋﻧد‬ ‫اﻟﻣﮭﺎم‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫ﻟﺗﺛﺑﯾت‬ ‫اﻟﺣﺎﺟﺔ‬ ‫ودون‬ ‫ﺳﮭوﻟﺔ‬ ‫ﺑﻛل‬ ‫اﻹﺿﺎﻓﺔ‬ ‫ھذه‬ ‫ﺗﺣﺳﯾن‬ ‫أو‬ ‫ﺑﺗطوﯾر‬ ‫ﯾﺑدأ‬
‫ﻣن‬ ‫اﻹﻧﺗﻘﺎل‬ ‫ﻓﻲ‬ ‫أﻗل‬ ‫ﻟﻣﻣﺎﻧﻌﺔ‬ ‫وﻣﻧﮭﺎ‬ ،‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻟﻣﺟﻣوع‬ ‫ﺷﺎﻣﻠﺔ‬ ‫ﻧظرة‬ ‫ﻟﮫ‬ ‫ﺗﺗﺷﻛل‬ ‫واﻟﺟﻣﯾﻊ‬ ،‫ﻟﻠﺟﻣﯾﻊ‬ ‫ﺗﻧﺗﻘل‬ ‫اﻟﻣﻌرﻓﺔ‬
...‫ﻟﻠوﻗت‬ ‫وإﺿﺎﻋﺔ‬ ‫ﻋﺑﺋﺎ‬ ‫وأﻗل‬ ‫أﺳﮭل‬ ‫ﺑﺷﻛل‬ ‫ﻋﻠﯾﮭﺎ‬ ‫واﻟﻌﻣل‬ ‫ﻟﺟزﺋﯾﺔ‬ ‫ﺟزﺋﯾﺔ‬

Pre-warning of integration clashes
‫اﻟﺷﯾﻔرة‬ ‫ﻋﻠﻰ‬ ‫ﺑرﻣﺟﻲ‬ ‫ﺗﻌدﯾل‬ ‫ﻷي‬ ‫ﻣﺗوﻗﻊ‬ ‫ﻏﯾر‬ ‫ﺧطﺄ‬ ‫أي‬ ‫ﻋن‬ ‫ﻣﺑﻛرا‬ ‫ﺗﺣذﯾرا‬ ‫ﺗﻘدم‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻋﻣﻠﯾﺔ‬
‫ﻣن‬ ‫أﻛﺛر‬ ‫ﻋﻠﯾﮭﺎ‬ ‫ﯾﻌﻣل‬ ‫اﻟﺗﻲ‬ ‫واﻷﻗﺳﺎم‬ ‫اﻷﺟزاء‬ ‫ﻓﻲ‬ ‫ﺧﺻوﺻﺎ‬ ،‫أﺟزاﺋﮫ‬ ‫ﻣﺟﻣوع‬ ‫ﻓﻲ‬ ‫أو‬ ‫ﺟزﺋﯾﺔ‬ ‫أي‬ ‫ﻓﻲ‬ ‫ﻟﻠﻣﺷروع‬ ‫اﻟﺑرﻣﺟﯾﺔ‬
‫ﯾﻌود‬ ‫ذﻟك‬ ‫ﻓﻲ‬ ‫واﻟﺳﺑب‬ ،‫آﺧر‬ ‫ﻣﺑرﻣﺞ‬ ‫ﻣﺳﺋوﻟﯾﺔ‬ ‫ﺗﺣت‬ ‫ﺗﻘﻊ‬ ‫ﺑﺟزﺋﯾﺔ‬ ‫ﻣرﺗﺑط‬ ‫ﺑﮭﺎ‬ ‫اﻟﺧﺎص‬ ‫اﻟﺗﻌدﯾل‬ ‫أن‬ ‫أو‬ ،‫اﻟوﻗت‬ ‫ذات‬ ‫ﻓﻲ‬ ‫ﻣطور‬
‫ﻣن‬ ‫أو‬ ،‫ﺑﺎﻟﺗﻌدﯾل‬ ‫ﯾﺗﺄﺛر‬ ‫ﻗد‬ ‫اﻟذي‬ ‫اﻟﻣطور‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫وﺗﻌدﯾﻼﺗﮭﺎ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﺧطﺄ‬ ‫ﻧﺳﺑﺔ‬ ‫ﺗﻘﻠﯾل‬ ‫ﻓﻲ‬
...‫اﻟﺗﻌدﯾل‬ ‫ھذا‬ ‫ﻟﺗﻔﻌﯾل‬ ‫اﻟﻼزﻣﺔ‬ ‫اﻟﻣﺗطﻠﺑﺎت‬ ‫أو‬ ‫اﻟﺗﻌدﯾل‬ ‫ھذا‬ ‫ﺧطورة‬ ‫ﯾدرﻛون‬ ‫آﺧرﯾن‬ ‫ﺧﻼل‬

‫اﻵﻣﻧﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻟﻣراﺟﻌﺔ‬ ‫اﻟﻔﻧﯾﺔ‬ ‫اﻟﺟواﻧب‬
‫ﯾﺑﺣث‬ ‫اﻟذي‬ ‫اﻷﻣﻧﻲ‬ ‫اﻟﻣراﺟﻊ‬ ‫أو‬ ،‫اﻷﻣﻧﻲ‬ ‫اﻟﺑﺎﺣث‬ ‫ﺑﻧظرة‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﻟﻣراﺟﻌﺔ‬ ‫اﻟﻔﻧﯾﺔ‬ ‫اﻟﺟواﻧب‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫ھﻧﺎك‬
‫ﺑﺎﻟﻧظر‬ ‫ﻓﻘط‬ ‫ﺗﻛﺗﻔﻲ‬ ‫ﻻ‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﻧظرة‬ ‫ھذه‬ ،‫ﻣﻧﮭﺎ‬ ‫ﺑﺎﻟﺗﺣﻘق‬ ‫وﯾرﻏب‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻓﻲ‬ ‫اﻟﻣوﺟودة‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﻋن‬
‫وﺣﺗﻰ‬ ‫اﻟﺑداﯾﺔ‬ ‫ﻣﻧذ‬ ‫اﻟﻌﻣل‬ ‫ﺗﺳﻠﺳل‬ ‫ﻟﺗﻔﮭم‬ ‫ذﻟك‬ ‫ﻣن‬ ‫أوﺳﻊ‬ ‫اﻟﻧظرة‬ ‫ھذه‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﺑل‬ ،‫ﻛﺗﺎﺑﺗﮭﺎ‬ ‫وطرﯾﻘﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫ﻟﻠﺷﯾﻔرة‬
،‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻓﻲ‬ ‫ﻣﻌﺎﻟﺟﺗﮭﺎ‬ ‫ﺳﯾﺗم‬ ‫واﻟﺗﻲ‬ ‫اﺳﺗﻘﺑﺎﻟﮭﺎ‬ ‫ﺳﯾﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣدﺧﻼت‬ ‫ﺟﻣﯾﻊ‬ ‫وﺣﺻر‬ ،‫ﺑرﻣﺟﯾﺔ‬ ‫وظﯾﻔﺔ‬ ‫ﻟﻛل‬ ‫اﻟﻧﮭﺎﯾﺔ‬
‫ﯾﻌﻧﻲ‬ ‫وھذا‬
.1
‫ﻣﺎ‬ ‫ﺟﻣﯾﻊ‬ ‫ﻟدراﺳﺔ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫ﻣﻌﮭﺎ‬ ‫اﺳﺗﺧداﻣﮫ‬ ‫ﺗم‬ ‫اﻟذي‬ validation ‫وال‬ input ﬁeld ‫ال‬ ‫ﺟﻣﯾﻊ‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬
‫ﻻ‬ ‫أم‬ ‫اﻟﺣﺎﻻت‬ ‫ھذه‬ ‫ﺟﻣﯾﻊ‬ ‫ﯾﻐطﻲ‬ ‫اﻟﻣوﺟود‬ validation ‫ال‬ ‫وھل‬ ‫اﺳﺗﺧداﻣﮫ‬ ‫وﻣﻛﺎن‬ ‫اﻟﺣﻘل‬ ‫ھذا‬ ‫ﻓﻲ‬ ‫ﻛﺗﺎﺑﺗﮫ‬ ‫ﯾﻣﻛن‬

‫اﻵﻣﻧﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻟﻣراﺟﻌﺔ‬ ‫اﻟﻔﻧﯾﺔ‬ ‫اﻟﺟواﻧب‬
.2
‫ﻣﻌﺎﻟﺟﺗﮫ‬ ‫ﺗﺗم‬ response ‫أو‬ log writer ‫أي‬ ‫او‬ (dynamic query) ‫ﻗﯾم‬ ‫ﻋﻠﻰ‬ ‫ﺗﻌﺗﻣد‬ sql query ‫أي‬
...‫اﻟﻣﺣﺗﻣﻠﺔ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﺟﻣﻊ‬ ‫ودراﺳﺔ‬ ‫ﺑدﻗﺔ‬ ‫ﻓﺣﺻﮫ‬ ‫ﯾﺟب‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻗﺑل‬ ‫ﻣن‬
.3
‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﺧﻼﻟﮭﺎ‬ ‫ﻣن‬ ‫ﺳﺗﻣر‬ ‫اﻟﺗﻲ‬ component ‫ال‬ ‫أو‬ classes ‫ال‬ ‫ﺟﻣﯾﻊ‬ ‫دراﺳﺔ‬ ‫أﯾﺿﺎ‬ ‫ﺗﺷﻣل‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣراﺟﻌﺔ‬
‫وھذا‬ ،‫ﻟﻠﻣﺳﺗﺧدم‬ response ‫ﺷﻛل‬ ‫ﻋﻠﻰ‬ ‫إرﺟﺎﻋﮭﺎ‬ ‫أو‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻟﻘواﻋد‬ ‫ﻹدﺧﺎﻟﮭﺎ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫ﻟﻣﻛﺎن‬ ‫وﺻوﻻ‬
…‫ﻣرﺣﻠﺔ‬ ‫ﻵﺧر‬ ‫وﺻوﻻ‬ ‫اﻟﻣﺷروع‬ ‫أﺟزاء‬ ‫ﻛل‬ ‫ﻓﻲ‬ ‫اﻟﻌﻣل‬ ‫ﻟﺳﯾر‬ ‫اﻷﻣﻧﻲ‬ ‫اﻟﺗﺳﻠﺳل‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺿﻣن‬
.4
‫ﺧﻼﻟﮭﺎ‬ ‫ﻣن‬ ‫أﻣﻧﯾﺔ‬ ‫ﺛﻐرة‬ ‫ﻟﺣﺻول‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫واﻷﻣﺎﻛن‬ ‫اﻟﺣﺎﻻت‬ ‫إﻟﻰ‬ ‫اﻟﻧظر‬ ‫ﺗﺷﻣل‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫ﻓﺈن‬ ،‫ﻟذﻟك‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬
‫ﻋﻧد‬ css injection ‫ال‬ ‫ﻣﺛل‬ ‫ﺑﺎﻟﺗﻘﻧﯾﺎت‬ ‫ﺧﺎﺻﺔ‬ ‫ﺛﻐرات‬ ‫ﺗوﻗﻊ‬ ‫أو‬ XSS ‫ال‬ ‫ﺛﻐرات‬ ‫ﻣﺛل‬ (‫ﺣﺻوﻟﮭﺎ‬ ‫أﻣﺎﻛن‬ ‫)ﺗوﻗﻊ‬
.css in js ‫ال‬ ‫اﺳﺗﺧدام‬

Security Review ‫ل‬ ‫ﺧطﺔ‬ ‫وﺿﻊ‬ ‫ﻋﻧد‬ ‫ﻣراﻋﺎﺗﮭﺎ‬ ‫ﯾﺟب‬ ‫اﻟﺗﻲ‬ ‫اﻟﻌواﻣل‬
Code
‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫إﻟﻰ‬ ‫اﻹﻧﺗﺑﺎه‬ ‫ﯾﺟب‬ Securty Coding Review ‫ال‬ ‫ﻋﻠﻰ‬ ‫ﺛﻧﺎﯾﺎه‬ ‫ﻓﻲ‬ ‫ﯾﺣﺗوي‬ ‫ﺑﻧظﺎم‬ ‫ﻟﻠﻌﻣل‬ ‫اﻟﺗﺧطﯾط‬ ‫ﻋﻧد‬
‫اﻟﻣراﺟﻌﺔ‬ ‫ﺗﺳﺗﻠزم‬ ‫واﻟﺗﻲ‬ ‫اﻟﻣﺳﺗﻘﻠﺔ‬ ‫وﺣﺎﻟﺗﮭﺎ‬ ،‫اﻟﺧﺎص‬ ‫ﺳﯾﺎﻗﮭﺎ‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻋﻣﻠﯾﺔ‬ ‫وﻟﻛل‬ ،‫اﻟﻣراﺟﻌﺔ‬ ‫ﻋﻠﻰ‬ ‫ﺳﺗؤﺛر‬ ‫اﻟﺗﻲ‬ ‫اﻟﻌواﻣل‬
.…‫اﻟﺗﺄﺛﯾر‬ ‫ﻣﻌدل‬ ‫ﺑﺎﺧﺗﻼف‬ ،‫اﻷﺧرى‬ ‫ﻋن‬ ‫ﻣﺧﺗﻠﻔﺔ‬ ‫ﺑطرﯾﻘﺔ‬
:‫ھﻲ‬ ‫اﻟﻌواﻣل‬ ‫ھذه‬
●
‫ﻷي‬ ‫اﻟﺧطورة‬ ‫ﻣﻌدل‬ ‫ﻗﯾﺎس‬ ‫ﯾﻣﻛن‬ ‫ﻟﻛن‬ ،%100 ‫آﻣﻧﺔ‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﺗﻛون‬ ‫أن‬ ‫اﻟﻣﺳﺗﺣﯾل‬ ‫ﻣن‬ :(risk) ‫اﻟﺧطورة‬
‫اﻟﺧطورة‬ ‫ﺗﺻﻧﯾف‬ ‫زاد‬ ‫وﻛﻠﻣﺎ‬ ،‫ﻓﯾﮭﺎ‬ ‫ﺗﻌدﯾل‬ ‫أي‬ ‫ﻟﻣراﺟﻌﺔ‬ ‫ﻗﺎﺳﯾﺔ‬ ‫ﻣﻌﺎﯾﯾر‬ ‫وﺿﻊ‬ ‫ﯾﺗم‬ ‫ﺣﺗﻰ‬ ‫ﺗﻧﻔﯾذھﺎ‬ ‫ﯾﺗم‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬
‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﻣﻧﻊ‬ ‫وﯾﺟب‬ ،‫اﻟﺟزﺋﯾﺔ‬ ‫ﻟﮭذه‬ ‫اﻟﻼزﻣﺔ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻹﺣﺗﯾﺎطﺎت‬ ‫ﺗزداد‬ ‫ﺗﻌدﯾﻠﮭﺎ‬ ‫أو‬ ‫إﺿﺎﻓﺗﮭﺎ‬ ‫اﻟﻣراد‬ ‫ﻟﻠﺧﺎﺻﯾﺔ‬
-deadline ‫ﻋﻧدك‬ ‫ﻛﺎن‬ ‫ﻟو‬ ‫ﺣﺗﻰ‬- ‫ﺳﻼﻣﺗﮭﺎ‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ﻗﺑل‬ ‫ﺗﻠﯾﮭﺎ‬ ‫اﻟﺗﻲ‬ ‫ﻟﻠﻣرﺣﻠﺔ‬ ‫اﻹﻧﺗﻘﺎل‬ ‫ﻣن‬ ‫ﺑرﻣﺟﯾﺔ‬

Security Review ‫ل‬ ‫ﺧطﺔ‬ ‫وﺿﻊ‬ ‫ﻋﻧد‬ ‫ﻣراﻋﺎﺗﮭﺎ‬ ‫ﯾﺟب‬ ‫اﻟﺗﻲ‬ ‫اﻟﻌواﻣل‬
Code
●
‫ﺣدا‬ ‫ﻋﻠﻰ‬ ‫ﻣراﺟﻌﺗﮭﺎ‬ ‫ﯾﺗم‬ ‫ﺟزﺋﯾﺔ‬ ‫ﺑﻛل‬ ‫اﻟﺧﺎص‬ ‫اﻟﺳﻠوك‬ ‫ﺗﺣدﯾد‬ ‫ﯾﺟب‬ :Purpose & Context
●
‫اﻷﺳطر‬ ‫ﻣن‬ ‫ﻣﻣﻛن‬ ‫ﻋدد‬ ‫أﻗل‬ ‫ﺗﺿﻣن‬ ‫ﺻﺣﯾﺣﺔ‬ ‫ﺑطرﯾﻘﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺗﻘﺳﯾم‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﻔﺿل‬ :Lines of Code
.‫وأﺳرع‬ ‫أﺳﮭل‬ ‫ﺑﺷﻛل‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻷﺧطﺎء‬ ‫ﻣﻛﺎن‬ ‫ﺗﺣدﯾد‬ ‫ﻹﻣﻛﺎﻧﯾﺔ‬ ،block of code ‫ﻛل‬ ‫داﺧل‬ ‫ﻓﻲ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬
●
‫اﻟﺗﻲ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫ﻟﻠﻣﺷﺎﻛل‬ ‫اﻟﺧطورة‬ ‫ﻣﻌدل‬ ‫أو‬ ‫ﻣﺳﺗوى‬ ‫ﻓﻲ‬ ‫اﻟﺑرﻣﺟﺔ‬ ‫ﻟﻐﺎت‬ ‫ﺗﺧﺗﻠف‬ :Programming language
‫اﻻﻋﺗﺑﺎر‬ ‫ﺑﻌﯾن‬ ‫أﺧذھﺎ‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﺗﻲ‬ ‫اﻷﻣور‬ ‫ﻣن‬ ‫وھذا‬ ،‫ﻣﻌﯾﻧﺔ‬ ‫ﺗﻘﻧﯾﺔ‬ ‫ﻣﯾزة‬ ‫ﻟﺗﻧﻔﯾذ‬ ‫اﺳﺗﺧداﻣﮭﺎ‬ ‫ﻣن‬ ‫ﺗﺗﺣﻘق‬ ‫ﻗد‬
buﬀer overﬂows ‫ال‬ ‫ﻣﺷﺎﻛل‬ ‫ﻓﻣﺛﻼ‬ ،‫اﻟﻣﻘﺻودة‬ ‫اﻟﻠﻐﺔ‬ ‫ﻓﻲ‬ ‫ﺣﻘﯾﻘﺔ‬ ‫ﺧﺑرة‬ ‫ﻟﮫ‬ ‫ﻟﯾس‬ ‫اﻟﻌﻣل‬ ‫ﻓرﯾق‬ ‫ﻛﺎن‬ ‫اذا‬ ‫ﺧﺻوﺻﺎ‬
...‫اﻟﻣﺛﺎل‬ ‫ﺳﺑﯾل‬ ‫ﻋﻠﻰ‬ Java ‫ال‬ ‫ﻣن‬ ‫ﺑﻛﺛﯾر‬ ‫أﻛﺑر‬ ‫ﺑﺷﻛل‬ ++C/C ‫ﺑﺎل‬ ‫ﻣوﺟودة‬
●
‫أو‬ ،‫ﻛﻛل‬ ‫اﻟﻣﺷروع‬ ‫ﻟﺗﺳﻠﯾم‬ ‫اﻟﻼزﻣﺔ‬ ‫اﻟﻣدة‬ ‫اﻻﻋﺗﺑﺎر‬ ‫ﺑﻌﯾن‬ ‫اﻷﺧذ‬ ‫ﯾﺟب‬ :Resources, Time & Deadlines
‫ﻟﮭذا‬ ‫اﻟﺣﯾﺎة‬ ‫ﻓﺗرة‬ ‫ﺿﻣن‬ ‫وﻣن‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫ﻣن‬ ‫اﻟﺣﻠﻘﺔ‬ ‫ھذه‬ ‫وﺟود‬ ‫ﯾﺿﻣن‬ ‫ﻣﺳﺗﻘل‬ ‫ﺑﺷﻛل‬ ‫اﺿﺎﻓﺔ‬ ‫أو‬ ‫ﻣزﯾﺔ‬ ‫ﻛل‬ ‫ﺗﺳﻠﯾم‬
...‫اﻟﺧطورة‬ ‫ﻣﻘدار‬ ‫اﻹﻋﺗﺑﺎر‬ ‫ﺑﻌﯾن‬ ‫اﻷﺧذ‬ ‫ﻣﻊ‬ ،...‫اﻟﻣﺷروع‬

Code Review Reports
،‫ﺣدا‬ ‫ﻋﻠﻰ‬ Module ‫ﻟﻛل‬ ‫ﺗﻘﺎرﯾر‬ ‫ﺷﻛل‬ ‫ﻋﻠﻰ‬ ‫إﻧﺷﺎﺋﮭﺎ‬ ‫ﯾﺗم‬ ‫ﺻﯾﻐﺔ‬ ‫ھﻧﺎك‬ ‫ﻓﺈن‬ ،‫ﻟﻠﻣﺷروع‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫ﻧظﺎم‬ ‫إدﺧﺎل‬ ‫ﻋﻧد‬
‫ﻗﺎم‬ ‫اﻟذي‬ ‫اﻟﻣﺑرﻣﺞ‬ ،‫ﻓﺣﺻﮭﺎ‬ ‫ﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﺟزﺋﯾﺔ‬ ‫أو‬ Module ‫ال‬ ،‫اﻟﻣﺷروع‬ ‫إﺳم‬ ،‫اﻟﺗﻘرﯾر‬ ‫ﺗﺎرﯾﺦ‬ ‫ﻋﻠﻰ‬ ‫ﯾﺣﺗوي‬ ‫اﻟﺗﻘرﯾر‬ ‫ھذا‬
‫ﻋن‬ ‫ﻣﺧﺗﺻر‬ ‫وﺻف‬ ،‫اﻟﻣطﻠوﺑﺔ‬ task ‫ال‬ ،‫اﻟﻌﻣل‬ ‫ھذا‬ ‫ﺑﻣراﺟﻌﺔ‬ ‫ﻗﺎم‬ ‫اﻟذي‬ reviewer ‫وال‬ ،Module ‫ال‬ ‫ھذا‬ ‫ﺑﺗﺻﻣﯾم‬
‫ﺧﻼل‬ ‫ﻣن‬ ‫ﺗﻠﻘﺎﺋﻲ‬ ‫ﺑﺷﻛل‬ ‫ھذا‬ ‫ﯾﺗم‬ ‫ﻣﺎ‬ ‫وﻋﺎدة‬ ،Ticket ‫ﺑﺎل‬ ‫اﻟﺗﻘرﯾر‬ ‫ھذا‬ ‫ورﺑط‬ ،‫ﻟذﻟك‬ ‫اﻟﻣﻧﺎﺳﺑﺔ‬ ‫اﻷوﻟوﯾﺔ‬ ‫إﻋطﺎء‬ ‫ﻣﻊ‬ ‫اﻟﻣﺷﻛﻠﺔ‬
FxCop, BinScope Binary Analyzer ‫ﻣﺛل‬ tools ‫ال‬ ‫ﺑﻌض‬

‫؟‬When to Code Review
‫؟‬code review ‫ال‬ ‫ﻟﻌﻣل‬ ‫وﻗت‬ ‫اﻧﺳب‬ ‫ﻣﺗﻰ‬
‫أﻗﺳﺎم‬ ‫ﻟﺛﻼﺛﺔ‬ ‫ﻋﺎدة‬ ‫ﺗﻧﻘﺳم‬ ‫اﻟﺷرﻛﺎت‬
.1
‫ھذه‬ ،-pre-commit- ‫اﻷﺳﺎﺳﯾﺔ‬ branch ‫ال‬ ‫ﻋﻠﻰ‬ ‫رﻓﻌﮭﺎ‬ ‫ﻗﺑل‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺑﻣراﺟﻌﺔ‬ ‫اﻟﺷرﻛﺎت‬ ‫ھذا‬ ‫ﺗﻘوم‬
‫أو‬ ‫ﺻدورھﺎ‬ ‫ﻗﺑل‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﺣل‬ ‫ﺗﺿﻣن‬ ‫ﻓﮭﻲ‬ ،‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﻟﻣراﺟﻌﺔ‬ ‫اﻟطرق‬ ‫أﻓﺿل‬ ‫ﺗﻌد‬ -‫ﺷﺧﺻﯾﺎ‬- ‫اﻟطرﯾﻘﺔ‬
…‫ﺗﺣﺗﺎﺟﮫ‬ ‫اﻟذي‬ ‫اﻟوﻗت‬ ‫ھﻲ‬ ‫اﻷﺳﺎﺳﯾﺔ‬ ‫ﻣﺷﻛﻠﺗﮭﺎ‬ ‫ﻟﻛن‬ ،‫ﻧظﯾﻔﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻋﻠﻰ‬ ‫ﺗﺣﺎﻓظ‬ ‫ﻛﻣﺎ‬ ،‫ﻣﻧﮭﺎ‬ ‫اﻟﺗﻘﻠﯾل‬
.2
‫ﻓﻲ‬ ‫اﻟﺳرﻋﺔ‬ ‫اﻷﺳﻠوب‬ ‫ھذا‬ ‫ﻣﻣﯾزات‬ ‫وأھم‬ ،-post-commit- ‫رﻓﻌﮭﺎ‬ ‫ﺑﻌد‬ ‫اﻟﺗﻌدﯾﻼت‬ ‫ﺑﺳﺣب‬ ‫ھﻧﺎ‬ ‫اﻟﺷرﻛﺎت‬ ‫ﺗﻘوم‬
‫ﻟﺗﻌدﯾﻠﮭﺎ‬ ‫ﻟﻠﻣطور‬ ‫ﻓﯾﮭﺎ‬ ‫اﻟرﺟوع‬ ‫ﯾﺗم‬ ‫ﻣﺷﻛﻠﺔ‬ ‫أي‬ ‫وﺟود‬ ‫وﻋﻧد‬ ،‫اﻟرﻓﻊ‬ ‫ﻋﻣﻠﯾﺔ‬ ‫ﺑﻌد‬ ‫ھﻧﺎ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫وﺗﺗم‬ ،‫اﻷﻋﻣﺎل‬ ‫رﻓﻊ‬
‫ﺑﺄﺟزاء‬ ‫ﺧﺻوﺻﺎ‬ ‫أﻛﺛر‬ ‫أﺧطﺎء‬ ‫وﺟود‬ ‫ﺗﺣﺗﻣل‬ ‫ﻛﻣﺎ‬ ،‫ﺳﯾﺋﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺗﺟﻌل‬ ‫أن‬ ‫ﻓﯾﮭﺎ‬ ‫ﻣﺎ‬ ‫أﺳوأ‬ ‫ﻟﻛن‬ ،‫ﻣﺑﺎﺷرة‬
...‫اﻟﻣﻛﺎن‬ ‫ﻧﻔس‬ ‫ﻓﻲ‬ ‫اﻟﻔﺗرة‬ ‫ھذه‬ ‫أﺛﻧﺎء‬ ‫آﺧر‬ ‫ﻣﺑرﻣﺞ‬ ‫أي‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫ﺗﻌدﯾل‬ ‫أي‬ ‫وﻗوع‬ ‫إﻣﻛﺎﻧﯾﺔ‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫اﻟﺗوﺛﯾق‬

‫؟‬When to Code Review
.3
‫ﻓﺣﯾﻧﮭﺎ‬ ‫أﻣﻧﯾﺔ‬ ‫ﻣﺷﻛﻠﺔ‬ ‫وﺟود‬ ‫ﻋﻧد‬ ‫أو‬ ،‫ﺳﻧوﯾﺎ‬ ‫ﻣﻌﯾن‬ ‫ﻣرات‬ ‫ﻋدد‬ ‫أو‬ ‫ﻣﺣدد‬ ‫وﻗت‬ ‫ﻓﻲ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫وﺿﻊ‬ ‫ھو‬ ‫اﻟﺛﺎﻟث‬ ‫اﻷﺳﻠوب‬
‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫أﺟزاء‬ ‫ﺟﻣﯾﻊ‬ ‫ﻋﻠﻰ‬ ‫ﻟﻠﻣرور‬ ‫إﻻ‬ ‫ﻋﺎدة‬ ‫ﯾﺳﺗﺧدم‬ ‫ﻻ‬ ‫اﻷﺳﻠوب‬ ‫ھذا‬ ،‫ﻛﻛل‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫ﯾﺗم‬
‫ﺑﮫ‬ ‫وﻗﻌت‬ ‫ﺧطﺄ‬ ‫أﻛﺑر‬ ‫ھذا‬ ‫ﻓﺳﯾﻛون‬ ،‫اﻷﺳﻠوب‬ ‫ھذا‬ ‫ﻋﻠﻰ‬ ‫ﻓﻘط‬ ‫اﻟﺷرﻛﺔ‬ ‫اﻋﺗﻣدت‬ ‫إن‬ ‫ﻟﻛن‬ ،‫ﻓﻘط‬ ‫ﻣﻌﯾﻧﺔ‬ ‫ﻷﻧﻣﺎط‬ ‫وﻣراﺟﻌﺗﮭﺎ‬
-‫ﺷﺧﺻﯾﺔ‬ ‫ﻧظر‬ ‫وﺟﮭﺔ‬-

َ
‫ﻚ‬ َ‫وﻟ‬ ، ِ
‫ض‬ ْ
‫واﻷر‬ ِ
‫ات‬ َ
‫ﻮ‬ َ
‫ﻤ‬ َّ
‫اﻟﺴ‬ ُ
‫ﻮر‬ ُ
‫ﻧ‬ َ
‫ﺖ‬ ْ
‫أﻧ‬ ُ‫ﺪ‬ ْ
‫ﻤ‬ َ
‫اﻟﺤ‬ َ
‫ﻟﻚ‬ َّ
‫ﻢ‬ ُ
‫ﻬ‬ َّ‫اﻟﻠ‬
ُ‫ﺪ‬ ْ
‫ﻤ‬ َ
‫اﻟﺤ‬ َ
‫ﻚ‬ َ‫وﻟ‬ ، ِ
‫ض‬ ْ
‫واﻷر‬ ِ
‫ات‬ َ
‫ﻮ‬ َ
‫ﻤ‬ َّ
‫اﻟﺴ‬ ُ
‫ﻢ‬ ِّ
‫ﻴ‬ َ
‫ﻗ‬ َ
‫ﺖ‬ ْ
‫أﻧ‬ ُ‫ﺪ‬ ْ
‫ﻤ‬ َ
‫اﻟﺤ‬
َ
‫ﺖ‬ ْ
‫أﻧ‬ ، َّ
‫ﻦ‬ ِ
‫ﻴﻬ‬ ِ
‫ﻓ‬ ‫ﻦ‬ َ
‫وﻣ‬ ِ
‫ض‬ ْ
‫واﻷر‬ ِ
‫ات‬ َ
‫ﻮ‬ َ
‫ﻤ‬ َّ
‫اﻟﺴ‬ ُّ
‫ب‬ َ
‫ر‬ َ
‫ﺖ‬ ْ
‫أﻧ‬
َ
‫ك‬ ُ
‫ﺎؤ‬ َ
‫ﻘ‬ ِ‫وﻟ‬ ، ُّ
‫ﻖ‬ َ
‫اﻟﺤ‬ َ
‫ﻚ‬ ُ‫ﻟ‬ ْ
‫ﻮ‬ َ
‫وﻗ‬ ، ُّ
‫ﻖ‬ َ
‫اﻟﺤ‬ َ
‫ك‬ ُ‫ﺪ‬ ْ
‫ﻋ‬ َ
‫وو‬ ، ُّ
‫ﻖ‬ َ
‫اﻟﺤ‬
، ٌّ
‫ﻖ‬ َ
‫ﺣ‬ َ
‫ﻮن‬ ُّ‫ﻴ‬ ِ
‫ﺒ‬ َّ
‫واﻟﻨ‬ ، ٌّ
‫ﻖ‬ َ
‫ﺣ‬ ُ
‫ﺎر‬ َّ
‫واﻟﻨ‬ ، ٌّ
‫ﻖ‬ َ
‫ﺣ‬ ُ
‫ﺔ‬ َّ
‫ﻨ‬ َ
‫واﻟﺠ‬ ، ُّ
‫ﻖ‬ َ
‫اﻟﺤ‬
، ُ
‫ﺖ‬ ْ
‫ﻨ‬ َ
‫آﻣ‬ َ
‫ﻚ‬ ِ
‫وﺑ‬ ، ُ
‫ﺖ‬ ْ
‫ﻤ‬ َ‫ﻠ‬ ْ
‫أﺳ‬ َ
‫ﻟﻚ‬ َّ
‫ﻢ‬ ُ
‫ﻬ‬ َّ‫اﻟﻠ‬ ، ٌّ
‫ﻖ‬ َ
‫ﺣ‬ ُ
‫ﺔ‬ َ
‫ﺎﻋ‬ َّ
‫واﻟﺴ‬
، ُ
‫ﺖ‬ ْ
‫ﻤ‬ َ
‫ﺎﺻ‬ َ
‫ﺧ‬ َ
‫ﻚ‬ ِ
‫وﺑ‬ ، ُ
‫ﺖ‬ ْ
‫ﺒ‬ َ
‫أﻧ‬ َ
‫ﻚ‬ ْ
‫ﻴ‬ َ‫وإﻟ‬ ، ُ
‫ﺖ‬ ْ‫ﻠ‬ َّ‫ﻛ‬ َ
‫ﻮ‬ َ
‫ﺗ‬ َ
‫ﻚ‬ ْ
‫ﻴ‬ َ‫ﻠ‬ َ
‫وﻋ‬
، ُ
‫ت‬ ْ
‫ﺮ‬ َّ
‫أﺧ‬ ‫وﻣﺎ‬ ُ
‫ﺖ‬ ْ
‫ﻣ‬ َّ‫ﺪ‬ َ
‫ﻗ‬ ‫ﻣﺎ‬ ‫ﻟﻲ‬ ْ
‫ﺮ‬ ِ
‫ﻔ‬ ْ
‫ﺎﻏ‬ َ
‫ﻓ‬ ، ُ
‫ﺖ‬ ْ
‫ﻤ‬ َ‫ﺎﻛ‬ َ
‫ﺣ‬ َ
‫ﻚ‬ ْ
‫ﻴ‬ َ‫وإﻟ‬
. َ
‫ﺖ‬ ْ
‫أﻧ‬ َّ
‫إﻻ‬ َ
‫ﻪ‬ َ‫إﻟ‬ ‫ﻻ‬ ‫ﻲ‬ ِ
‫ﻬ‬ َ‫إﻟ‬ َ
‫ﺖ‬ ْ
‫أﻧ‬ ، ُ
‫ﺖ‬ ْ
‫ﻨ‬ َ‫ﻠ‬ ْ
‫أﻋ‬ ‫وﻣﺎ‬ ُ
‫ت‬ ْ
‫ر‬ َ
‫ﺮ‬ ْ
‫أﺳ‬ ‫وﻣﺎ‬

:reviewer should develop familiarity with the following aspects
‫ﻣن‬ ‫ﻋدد‬ ‫ﻓﻲ‬ ‫ﻣﮭﺎراﺗﮫ‬ ‫ﺑﺗطوﯾر‬ ‫ﯾﻘوم‬ ‫أن‬ ‫اﻷﻣﻧﯾﺔ‬ ‫ﺑﺎﻟﺟواﻧب‬ ‫واﻹھﺗﻣﺎم‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻷﻋﻣﺎل‬ ‫ﺑﻣراﺟﻌﺔ‬ ‫ﯾرﻏب‬ ‫ﻣطور‬ ‫ﻛل‬ ‫ﻋﻠﻰ‬
:‫وھﻲ‬ ،‫ﺑﮭﺎ‬ ‫ﯾﮭﺗم‬ ‫وأن‬ ‫اﻟﻣﮭﻣﺔ‬ ‫اﻟﻣواﺿﯾﻊ‬
●
‫اﻟﺧﺎﺻﺔ‬ ‫اﻟﻣزاﯾﺎ‬ ‫ﯾﻔﮭم‬ ‫أن‬ ‫ﻣطور‬ ‫ﻛل‬ ‫ﻋﻠﻰ‬ ‫ﯾﺟب‬ :Application features and Business Rules
،Business ‫ﺑﺎل‬ ‫اﻟﺧﺎﺻﺔ‬ ‫واﻟﻣﺣددات‬ ،‫واﻟﺗﻘﻧﯾﺎت‬ ،‫ﺑﺎﻟﻣﺷروع‬ ‫اﻟﺧﺎﺻﺔ‬ ‫واﻟﻣﺣددات‬ ‫اﻟﻘواﻋد‬ ‫وﻛل‬ ،‫اﻟﻣﺷروع‬
‫ﻓﺷﻠﮭﺎ‬ ‫أو‬ ‫ﻣﻌﯾﻧﺔ‬ ‫ﻣزﯾﺔ‬ ‫ﻧﺟﺢ‬ ‫ﻋﻠﻰ‬ ‫وﺗﺄﺛﯾرھﺎ‬ ‫ﺑﺎﻟﻣراﺟﻌﺔ‬ ‫اﻟﺧﺎص‬ ‫اﻟﺗﺄﺛﯾر‬ ‫ﺗﺣدﯾد‬ ‫ﻓﻲ‬ ‫ﺗﻛﻣن‬ ‫اﻟﻧﻘطﺔ‬ ‫ھذه‬ ‫أھﻣﯾﺔ‬ ‫وﺳﺑب‬
Business ‫ال‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫واﻟﻣطﻠوب‬ ‫اﻟﺻﺣﯾﺢ‬ ‫اﻟﻧﺣو‬ ‫ﻋﻠﻰ‬ ‫ﺳﺗﻌﻣل‬ ‫اﻟﺧﺎﺻﯾﺔ‬ ‫ھذه‬ ‫ﻣن‬ ‫واﻟﺗﺄﻛد‬
●
‫اﻟﻣﻌﺎﯾﯾر‬ ‫ﺟﻣﯾﻊ‬ ‫ﺗوﺛﯾق‬ ‫ﯾﺗم‬ ‫أن‬ ‫وﯾﺟب‬ ،‫اﻟﻣراﺟﻌﺔ‬ ‫ﺧﻼﻟﮭﺎ‬ ‫ﻣن‬ ‫ﺗﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﻌﺎﯾﯾر‬ ‫ﺟﻣﯾﻊ‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬ :Context
‫وﻣﻘدار‬ ،‫وﻣﻌﺎﻟﺟﺗﮭﺎ‬ ‫ﻣﻌﮭﺎ‬ ‫اﻟﺗﻌﺎﻣل‬ ‫ﯾﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫أﻧواع‬ ‫ﺟﻣﯾﻊ‬ ‫ذﻟك‬ ‫وﯾﺷﻣل‬ ،‫ﻛذﻟك‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫ﻟﻠﺷﯾﻔرة‬ ‫اﻷﻣﻧﯾﺔ‬
‫ﻋﻠﯾﮭﺎ‬ ‫اﻟﺣﺻول‬ ‫وطرﯾﻘﺔ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ھذه‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫ﻣﻛﺎن‬ ‫اﻻﻋﺗﺑﺎر‬ ‫ﺑﻌﯾن‬ ‫ﺑﺎﻷﺧذ‬- ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ھذه‬ ‫ﻣن‬ ‫اﻟﻣﺗوﻗﻊ‬ ‫اﻟﺿرر‬
. -‫إرﺟﺎﻋﮭﺎ‬ ‫وطرﯾﻘﺔ‬

●
‫ﺧطﯾر‬ ‫ﺑﺷﻛل‬ ‫ﺗﺄﺛر‬ ‫ﻗد‬ ‫واﻟﺗﻲ‬ ،‫اﻟﻧظﺎم‬ ‫ﻓﻲ‬ ‫اﻟﺣﺳﺎﺳﺔ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﺑﺟﻣﯾﻊ‬ ‫اﻹھﺗﻣﺎم‬ ‫اﻟﺟزﺋﯾﺔ‬ ‫ھذه‬ ‫وﺗﺷﻣل‬ :Sensitive Data
‫ﺑﻧﺎﺋﺎ‬ ‫ﻣﻌﻠوﻣﺎﺗﮭم‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫أو‬ ،‫اﻟﺻﺣﯾﺢ‬ ‫ﺑﺎﻟﺷﻛل‬ ‫ﻟﻠﻣﻧﺗﺞ‬ ‫وﺻوﻟﮭم‬ ‫إﻣﻛﺎﻧﯾﺔ‬ ‫ﻋﻠﻰ‬ ‫أو‬ ،‫ﻟﻠﻣﻧﺗﺞ‬ ‫اﻟﻣﻧﺗﺳﺑﯾن‬ ‫اﻷﻓراد‬ ‫ﺧﺻوﺻﯾﺔ‬ ‫ﻋﻠﻰ‬
‫ﺑﺎﻟطرﯾﻘﺔ‬ ‫اﻟﺻﺣﯾﺢ‬ ‫ﺑﺎﻟﺷﻛل‬ ‫ﺣﻔظﮭﺎ‬ ‫ﻣن‬ ‫واﻟﺗﺄﻛد‬ ‫ﺑﮭﺎ‬ ‫واﻹھﺗﻣﺎم‬ ،‫ﺟﯾد‬ ‫ﺑﺷﻛل‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ھذه‬ ‫ﻣﻌرﻓﺔ‬ ‫ﺗﻛون‬ ‫ﻟذﻟك‬ ،‫ﻓﻘده‬ ‫ﺗم‬ ‫ﻣﺎ‬ ‫ﻋﻠﻰ‬
…‫ﻋﺿو‬ ‫ﻷي‬ ‫اﻟﻣرور‬ ‫ﻛﻠﻣﺔ‬ ‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫اﻷﻣﺛﻠﺔ‬ ‫وﻣن‬ ،‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻋﻧد‬ ‫اﻟﻧﻘﺎط‬ ‫أھم‬ ‫ﻣن‬ ‫اﻟﺻﺣﯾﺣﺔ‬
●
‫اﻟﺻﻼﺣﯾﺎت‬ ‫ﺟﻣﯾﻊ‬ ‫ﺗﺣدﯾد‬ ‫ﯾﺗم‬ ‫ﻣﺎ‬ ‫وﻋﺎدة‬ ،‫ﻧظﺎم‬ ‫أي‬ ‫ﻓﻲ‬ ‫ﺟدا‬ ‫ﻣﮭﻣﺔ‬ ‫اﻟﻧﻘطﺔ‬ ‫ھذه‬ :User roles and access rights
‫ﻧظﺎم‬ ‫اﻟﻣراﺟﻊ‬ ‫ﯾﻌرف‬ ‫أن‬ ‫ﺟدا‬ ‫اﻟﻣﮭم‬ ‫ﻣن‬ ‫ﻟذﻟك‬ ،‫ﻣﺳﺑﻘﺎ‬ ‫اﻟﻣﻧﺗﺞ‬ ‫داﺧل‬ ‫اﻟﻣوﺟودة‬ ‫ﻟﻠﻣزاﯾﺎ‬ ‫اﻟوﺻول‬ ‫وإﻣﻛﺎﻧﯾﺔ‬ ‫ﻟﻸﻋﺿﺎء‬
،‫اﻹﻧﺗرﻧت‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫إﻟﯾﮫ‬ ‫اﻟوﺻول‬ ‫ﯾﻣﻛن‬ ‫ﻣﻧﺗﺞ‬ ،‫ﻗﺳﻣﯾن‬ ‫إﻟﻰ‬ ‫اﻟﺟزﺋﯾﺔ‬ ‫ھذه‬ ‫ﺗﺻﻧﯾف‬ ‫وﯾﻣﻛن‬ ،‫اﻟﻌﻣل‬ ‫ﻓﻲ‬ ‫اﻟﻣﺗﺑﻊ‬ ‫اﻟﺻﻼﺣﯾﺎت‬
‫ﻓﻲ‬ ‫اﻟﻣوظﻔﯾن‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﻓﻘط‬ ‫إﻟﯾﮫ‬ ‫اﻟوﺻول‬ ‫ﯾﻣﻛن‬ ‫وﻣﺳﺗوى‬ ،‫اﻟدرﺟﺎت‬ ‫أﻋﻠﻰ‬ ‫ﻓﻲ‬ ‫ﻓﯾﮫ‬ ‫اﻹھﺗﻣﺎم‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫وھذا‬
...‫وﺿوﺣﺎ‬ ‫وأﻛﺛر‬ ‫ﺻراﻣﺔ‬ ‫أﻗل‬ ‫ﻟﻣﻌﺎﯾﯾر‬ ‫ﺗﺧﺿﻊ‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫واﻟﺗﻲ‬ ‫اﻟﻣؤﺳﺳﺔ‬

●
‫اﻟﺗﻲ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﻓﺈن‬ ،‫ﻋﻠﯾﮫ‬ ‫ﯾﻌﻣل‬ ‫اﻟذي‬ ‫اﻟﺗطﺑﯾق‬ ‫ﺑﻧوع‬ ‫ﯾﮭﺗم‬ ‫أن‬ ‫اﻟﻣراﺟﻊ‬ ‫ﻋﻠﻰ‬ ‫ﯾﺟب‬ :Application type
‫أو‬ desktop ‫ال‬ ‫ﺗطﺑﯾﻘﺎت‬ ‫ﻋﻠﻰ‬ ‫ﺗظﮭر‬ ‫اﻟﺗﻲ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﻋن‬ ‫ﺗﺧﺗﻠف‬ ‫ﻗد‬ ‫اﻹﻟﻛﺗروﻧﯾﺔ‬ ‫اﻟﻣواﻗﻊ‬ ‫ﻋﻠﻰ‬ ‫ﺗظﮭر‬
…‫ﺧﺻوﺻﺎ‬ ‫اﻷﻣﻧﻲ‬ ‫ﺑﺎﻟﺟﺎﻧب‬ ‫ﺳﯾﮭﺗم‬ ‫اﻟذي‬ ‫ﻟﻠﻣراﺟﻊ‬ ‫ﻣﮭﻣﺔ‬ ‫اﻟﺗطﺑﯾق‬ ‫وﻧوع‬ ‫ﺑطﺑﯾﻌﺔ‬ ‫اﻟﻌﻠم‬ ‫ﻟذﻟك‬ ،‫اﻟﻣﺣﻣوﻟﺔ‬ ‫اﻟﮭواﺗف‬
●
‫ﻗد‬ ‫اﻟﺗﻲ‬ ‫وﺧﺑﺎﯾﮭﺎ‬ ‫ﻣزاﯾﺎھﺎ‬ ‫ﻟﻐﺔ‬ ‫ﻟﻛل‬ ‫ﻷن‬ ،‫ﺟدا‬ ‫ﺟدا‬ ‫ﻣﮭم‬ ‫أﻣر‬ ‫ﻓﯾﮭﺎ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﻠﻐﺔ‬ ‫ﻣﻌرﻓﺔ‬ :Code
‫ﺗﺣﺳﯾن‬ ‫ﯾﺗم‬ ‫ﺣﺗﻰ‬ ‫اﻟﻠﻐﺔ‬ ‫ھذه‬ ‫ﻓﻲ‬ ً‫ﺎ‬‫ﻣﻠﻣ‬ ‫ﯾﻛون‬ ‫أن‬ ‫اﻟﻣراﺟﻊ‬ ‫ﻋﻠﻰ‬ ‫ﯾﺟب‬ ‫ﻟذﻟك‬ ،‫اﻟﻠﻐﺔ‬ ‫ھذه‬ ‫ﺧﺎرج‬ ‫ھو‬ ‫ﻣن‬ ‫ﻋﻠﻰ‬ ‫ﺗﺧﻔﻰ‬
…‫اﻟﻣﻣﻛﻧﺔ‬ ‫اﻟﺿﻌف‬ ‫ﺑﺄﻣﺎﻛن‬ ‫اﻟﻌﻠم‬ ‫ﺑﺳﺑب‬ ‫ﻣﻣﻛﻧﺔ‬ ‫ﺣﻣﺎﯾﺔ‬ ‫أﻓﺿل‬ ‫ﻣﻊ‬ ،‫ﻟﮫ‬ ‫ﺷﻛل‬ ‫ﺑﺄﻓﺿل‬ ‫ﻟﯾﻛون‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬

●
،‫ﻵﺧر‬ Design Pattern ‫ﻣن‬ ‫ﺗﺧﺗﻠف‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﻓطرﯾﻘﺔ‬ ،‫ﺟدا‬ ‫ﻣﮭﻣﺔ‬ ‫اﻟﻧﻘطﺔ‬ ‫وھذه‬ :Design
‫ﻓﻲ‬ ،‫ﺑﮫ‬ ‫ﺧﺎص‬ Pattern ‫ﺑﻛﺗﺎﺑﺔ‬ ‫ﻗﺎم‬ ‫ﻋﻣن‬ ‫ﯾﺧﺗﻠف‬ MVC ‫ال‬ ‫ﯾﺳﺗﺧدم‬ ‫ﻣن‬ ‫ﻓﻣﺛﻼ‬ ،‫آﺧر‬ ‫إﻟﻰ‬ Code Layout ‫وﻣن‬
‫ﺷﻛل‬ ‫ﺗﺷﻣل‬ design ‫ال‬ ‫وﻛذﻟك‬ ،‫آﺧر‬ ‫إﻟﻰ‬ ‫ﺷﻛل‬ ‫ﻣن‬ ‫ﺳﺗﺧﺗﻠف‬ ‫وﺣﻣﺎﯾﺗﮭﺎ‬ ‫وﺣﻔظﮭﺎ‬ Conﬁguration ‫ال‬ ‫أﻣﺎﻛن‬
‫اﻟﺦ‬...user ‫ﻷي‬ ‫وﺷﻛﻠﮫ‬ rendering ‫ال‬ ‫طرﯾﻘﺔ‬ ‫ﺗﺷﻣل‬ ‫ﻛﻣﺎ‬ ،‫اﻟرواﺑط‬ ‫ھذه‬ ‫وﺗﺳﻠﺳل‬ Url ‫ال‬
●
‫وﯾﺟب‬ ،‫اﻷﻗﺳﺎم‬ ‫ﺑﯾن‬ ‫ﻣﺷﺎرﻛﺗﮭﺎ‬ ‫ﻓﯾﺟب‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻟﻛﺗﺎﺑﺔ‬ ‫ﻟﻠﺷرﻛﺔ‬ ‫ﻣرﺟﻌﯾﺔ‬ ‫أي‬ ‫وﺟود‬ ‫ﺣﺎل‬ ‫ﻓﻲ‬ :Guideline
...‫اﻟﻣﻌﺎﯾﯾر‬ ‫ھذه‬ ‫ﻓﮭم‬ ‫اﻟﺟﻣﯾﻊ‬ ‫ﻋﻠﻰ‬ ‫وﯾﺟب‬ ،‫اﻟﺗطوﯾر‬ ‫ﻓرﯾق‬ ‫أﻋﺿﺎء‬ ‫ﺑﯾن‬ ‫ﻣﺷﺎرﻛﺗﮭﺎ‬ ‫ﺗﺗم‬ ‫أن‬

Questions During Secure Code Review

Code Review Checklist
‫اﻟﻌﻣل‬ ‫ﺗم‬ ‫إن‬ ‫اﻟﻣﺑﺎدئ‬ ‫ھذه‬ ،‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫ﻷي‬ ‫ﻣراﺟﻌﺔ‬ ‫ﺑﺄي‬ ‫اﻟﺧﺎﺻﺔ‬ ‫اﻟﻣﺑﺎدئ‬ ‫ﻟﺗﺣدﯾد‬ ‫ﺻﻣﻣت‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﺗﻧوﻋﺔ‬ ‫اﻟﻧﻣﺎذج‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫ھﻧﺎك‬
‫ھذه‬ ،‫اﻟﺻﺣﯾﺢ‬ ‫ﺑﺷﻛﻠﮭﺎ‬ ‫اﻟﻣﺑﺎدئ‬ ‫ﺑﮭذه‬ ‫ﻋﻣﻠﮫ‬ ‫ﺣﺎل‬ ‫ﻓﻲ‬ ‫اﻟﺧﺑراء‬ ‫ﻣن‬ ‫ﯾﻌد‬ ‫إﻧﮫ‬ ‫ﺑل‬ ،‫واﻟﺧﺑراء‬ ‫اﻟﻣﺣﺗرﻓﯾن‬ ‫ﻟدرﺟﺔ‬ ‫ﯾرﺗﻘﻲ‬ ‫اﻟﻣراﺟﻊ‬ ‫ﺳﺗﺟﻌل‬ ‫ﺑﮭﺎ‬
‫اﻟﻣﺷﺎﻛل‬ ‫وﻣﻌﺎﻟﺟﺔ‬ ‫ﻟﻣراﻗﺑﺗﮭﺎ‬ ‫وﺗﮭدف‬ ‫ﻓﯾﮭﺎ‬ ‫ﺗﮭﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﻌرﯾﺿﺔ‬ ‫اﻟﻌﻧﺎوﯾن‬ ‫أو‬ ‫اﻷﺳﺎﺳﯾﺔ‬ ‫اﻟﻧﻘﺎط‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫ﻋﻠﻰ‬ ‫ﺗﺣﺗوي‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﻘﺎﺋﻣﺔ‬
:‫وھﻲ‬ ،‫ﻣﻧﮭﺎ‬ ‫اﻟﻣﺗوﻗﻌﺔ‬
● Security & Architecture: Data Validation, Authentication, Session Management, Authorization,
Cryptography, Error Handling, Logging, Security Conﬁguration, Network Architecture.
● Application Design: Font uniformity, Color Accessibility, Uniformity of color and design scheme,
Ease of use for users, Minimum number of screens to achieve a use-case, Performance,
Presentation of information, Responsiveness, Accessible content, Accuracy of information
‫ﻓﻲ‬ ‫اﻟﺗﻲ‬ ‫اﻟﻧﻘﺎط‬ ‫ﻓﻲ‬ ،...‫اﻟﺷرﻛﺔ‬ ‫اﺣﺗﯾﺎﺟﺎت‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫ﺑﻧﺎﺋﮫ‬ ‫أو‬ ‫اﻟﻧﻣوذج‬ ‫اﺧﺗﯾﺎر‬ ‫وﯾﺗم‬ ،‫ﻋﺎﻣﺔ‬ ‫وﻧﻣﺎذج‬ ‫ﺗﻔﺻﯾﻠﯾﺔ‬ ‫ﻧﻣﺎذج‬ ‫وھﻧﺎك‬ ،‫وأھداﻓﮭﺎ‬ ‫اﻟﻧﻣﺎذج‬ ‫ﺗﺗﻌدد‬ ‫طﺑﻌﺎ‬
‫ﺑﺷﻛل‬ ‫ﺗﺗوزع‬ ‫أو‬ ،‫اﻛﺑر‬ ‫ﻋﻧوان‬ ‫ﺗﺣت‬ ‫ﻣرﺗﺑﺔ‬ ‫ﻧﻘﺎط‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫ﻣن‬ ‫ﺟزﺋﯾﺔ‬ ‫اﻵﺧر‬ ‫ﺑﻌﺿﮭﺎ‬ ‫وﻓﻲ‬ ،‫اﻷﺳﺎﺳﯾﺔ‬ ‫اﻟﻌﻧﺎوﯾن‬ ‫ھﻲ‬ ‫اﻟﻧﻣﺎذج‬ ‫ﺑﻌض‬ ‫ﻓﻲ‬ ‫ﺗﻛون‬ ‫ﻗد‬ ‫اﻷﻋﻠﻰ‬
...‫ﻣﺧﺗﻠف‬

●
‫ﻟﺗﺣﺳﯾن‬ ‫وذﻟك‬ ،!‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺗﻧﺳﯾق‬ ‫أن‬ ‫ﻣن‬ ‫ﺗﺣﻘق‬ ،‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺗﺻﻔﺢ‬ ‫أﺛﻧﺎء‬ :Code formatting
tabbing, ‫ال‬ ‫اﻟﻛﻼم‬ ‫ھذا‬ ‫وﯾﺷﻣل‬ ،‫ﻗراﺋﺗﮫ‬ ‫أو‬ ‫إﻟﯾﮫ‬ ‫اﻟﻧظر‬ ‫ﻋﻧد‬ ‫إزﻋﺎج‬ ‫أي‬ ‫وﺟود‬ ‫ﻋدم‬ ‫ﻣن‬ ‫واﻟﺗﺄﻛد‬ ‫اﻟﻘراءة‬ ‫ﻗﺎﺑﻠﯾﺔ‬
...spacing, naming conventions, line length, remove any commented code
‫اﻟﺦ‬
●
‫اﻟﻣﺷروع‬ ‫ﺗﻘﺳﯾم‬ ‫ﯾﺷﻣل‬ ‫وھذا‬ ،‫واﺿﺢ‬ ‫ﺑﺷﻛل‬ ‫وﻣﺑﻧﯾﺔ‬ ‫ﻣﻧظﻣﺔ‬ ‫اﻟﻣﺷروع‬ ‫ﻣﻌﻣﺎرﯾﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ :Architecture
html, css, js ‫ﻣﺛﻼ‬ ‫ﻣﻧظم‬ ‫ﺑﺷﻛل‬ ‫اﻟﻣﻠﻔﺎت‬ ‫وﺗﻘﺳﯾم‬ ،data layer, presentation ‫ال‬ ‫ﻣﺛل‬ ‫طﺑﻘﺎت‬ ‫ﻋدة‬ ‫إﻟﻰ‬
‫اﻟﻣﻛﺗوﺑﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫ﻣﺳﺗﻘﻠﺔ‬ ‫ﻣﻠﻔﺎت‬ ‫ﺷﻛل‬ ‫وﻋﻠﻰ‬ ،‫وواﺿﺣﺔ‬ ‫ﻣﺣددة‬ ‫ﻣﺳﺎرات‬ ‫ﻓﻲ‬
design ‫ال‬ ‫واﺳﺗﺧدام‬ ‫اﻋﺗﻣﺎد‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫اﻟﻣﺳﺗﺧدم‬ framework ‫ال‬ ‫ﻣﻊ‬ ‫ﺻﺣﯾﺢ‬ ‫ﺑﺷﻛل‬ ‫وﺗﺳﯾر‬ ‫ﺗﺗﺑﻊ‬
...‫ﺑرﻣﺟﯾﺎ‬ ‫اﻟﻣﺷروع‬ ‫ﺑﺑﻧﺎء‬ ‫اﻟﺑدء‬ ‫ﻗﺑل‬ ‫اﻟﻣﻧﺎﺳب‬ pattern

●
‫اﻟﺷﯾﻔرة‬ ‫ﻟﻛﺗﺎﺑﺔ‬ ‫اﻟﻣﻌﺎﯾﯾر‬ ‫ﺑﺄھم‬ ‫اﻹﻟﺗزام‬ ‫ﯾﺟب‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻛﺗﺎﺑﺔ‬ ‫أﺛﻧﺎء‬ :Coding best practices
،Don't write hard coded ‫ﺗﺷﻣل‬ ‫اﻟﻣﻌﺎﯾﯾر‬ ‫ھذه‬ ،-‫ﻧﻘطﺔ‬ ‫أول‬ ‫ﻓﻲ‬ ‫ذﻛرﻧﺎ‬ ‫ﻛﻣﺎ‬- ‫ﺑﺗﻧﺳﯾﻘﮭﺎ‬ ‫ﻧﻠﺗزم‬ ‫ﻛﻣﺎ‬ ‫اﻟﺑرﻣﺟﺔ‬
‫ال‬ ‫ﺑﻛﺗﺎﺑﺔ‬ ‫وﻋﻠﯾك‬ ،conﬁguration variable ‫ﺗﺿﯾف‬ ‫أو‬ const ‫ﺗﻌرف‬ ‫أو‬ ‫ﺗﺳﺗﺧدم‬ ‫داﯾﻣﺎ‬ ‫ﺑﺗﻘدر‬
‫اﺿﺎﻓﺔ‬ ‫ﺗم‬ ‫ﻟﻣﺎذا‬ ‫وﺗوﺿﯾﺢ‬ ‫ﺷرح‬ ‫ﻓﻲ‬ ‫ﺗﻛﻣن‬ comments ‫ال‬ ‫أھﻣﯾﺔ‬ ‫أن‬ ‫اﻹﻋﺗﺑﺎر‬ ‫ﺑﻌﯾن‬ ‫اﻷﺧذ‬ ‫ﻣﻊ‬ comments
،‫اﻟﺗﻌدﯾل‬ ‫ﻗﺑل‬ ‫إﻟﯾﮭﺎ‬ ‫اﻟﻧظر‬ ‫ﯾﺟب‬ ‫ﻣﺣﺗﻣﻠﺔ‬ ‫ﻣﺷﺎﻛل‬ ‫ھﻧﺎك‬ ‫ﻛﺎن‬ ‫وإن‬ ،‫اﻟﺷﻛل‬ ‫ﺑﮭذا‬ block of code ‫ال‬ ‫ھذا‬ ‫ﻛﺗﺎﺑﺔ‬ ‫أو‬
‫اﻟﺻﻐﯾرة‬ enums ‫ال‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺎت‬ ‫ﺑﻧﺎء‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫ﯾﺣﺗوﯾﮫ‬ ‫ﻣﺎ‬ ‫أو‬ ‫اﻟﻣﺗﻐﯾر‬ ‫ھذا‬ ‫وظﯾﻔﺔ‬ ‫اﻟﻣﺗﻐﯾرات‬ ‫ﻋﻧد‬ ‫واﻟﻛﺗﺎﺑﺔ‬
nested loop, ‫ال‬ ‫ﺗﺟﻧب‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،...Gender: {Male, Female} ‫ﻣﺛل‬ ‫اﻟﺑرﻣﺟﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫داﺧل‬
‫وﺗﺣﻘﯾق‬ ،‫ظﮭورھﺎ‬ ‫ﺣﺎل‬ ‫ﻓﻲ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ھذه‬ ‫ﻣﺛل‬ ‫ﻟﺣل‬ ‫أﺧرى‬ ‫ﺑطرق‬ ‫واﻟﺗﻔﻛﯾر‬ ،levels 3 ‫ﻣن‬ ‫ﻷﻛﺛر‬ nested if
...custom code ‫أي‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﻗﺑل‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ ‫اﻟﻣﻛﺎﺗب‬ ‫او‬ framework ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﻣﻣﻛﻧﺔ‬ ‫اﺳﺗﻔﺎدة‬ ‫أﻛﺑر‬

●
‫وﯾﻣﻛن‬ ‫ﻣﺑرﻣﺞ‬ ‫ﻷي‬ ‫اﻟﻣﮭﻣﺔ‬ ‫واﻟﻘواﻋد‬ ‫اﻟﻣﻔﺎھﯾم‬ ‫ﺟﻣﯾﻊ‬ ‫وﺗﺷﻣل‬ :Non Functional requirements
:‫ﯾﻠﻲ‬ ‫ﻓﯾﻣﺎ‬ ‫اﺧﺗﺻﺎرھﺎ‬
○
‫وھذا‬ ،‫ﻣﻣﻛن‬ ‫ﺟﮭد‬ ‫ﺑﺄﻗل‬ ‫واﻟﺗﺣدﯾث‬ ‫ﻟﻠﺻﯾﺎﻧﺔ‬ ‫ﻗﺎﺑل‬ ‫ﺑﻧﺎﺋﮫ‬ ‫اﻟﻣراد‬ ‫اﻟﻣﺷروع‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬ :Maintainability (Supportability)
‫ﻓﺎﻟﺷﯾﻔرة‬ ،Readability، Testability، Debuggability، Conﬁgurability :‫وھﻲ‬ ‫رﺋﯾﺳﯾﺔ‬ ‫ﻣواﺿﯾﻊ‬ 4 ‫ﻓﻲ‬ ‫اﻹھﺗﻣﺎم‬ ‫ﯾﻌﻧﻲ‬
‫وھذه‬ ،comments ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ذﻟك‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﻓﯾﺟب‬ ‫ﺳﮭﻼ‬ ‫ذﻟك‬ ‫ﯾﻛن‬ ‫ﻟم‬ ‫ﻓﺈن‬ ،‫ﺑﻧﻔﺳﮭﺎ‬ ‫ﻧﻔﺳﮭﺎ‬ ‫ﺗﻔﺳر‬ ‫واﺿﺣﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﺑرﻣﺟﯾﺔ‬
‫ﺗﺣﺗوي‬ ،small blocks ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺗﻘﺳﯾم‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﯾﺗم‬ ‫وھذا‬ ،Test ‫ﻋﻣﻠﯾﺔ‬ ‫ﺑﺄي‬ ‫اﻟﻘﯾﺎم‬ ‫ﻋﻧد‬ ‫ﺳﮭﻠﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﺷﯾﻔرة‬
‫ﻋﻣل‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﻣﻣﻛﻧﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﺗﺗﺑﻊ‬ ‫إﻣﻛﺎﻧﯾﺔ‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،block ‫ال‬ ‫ھذا‬ ‫ﺿﻣن‬ ‫ﯾﺗم‬ ‫واﻟﺗﺣﻘق‬ ،block ‫ﻛل‬ ‫ﻓﻲ‬ ‫ﺗﻧﻔﯾذھﺎ‬ ‫اﻟﻣراد‬ ‫اﻟوظﺎﺋف‬
‫ﻣﻌﮫ‬ ‫اﻟﺗﻌﺎﻣل‬ ‫ﯾﺗم‬ ‫ﻣﻛﺎن‬ ‫ﻓﻲ‬ conﬁguration ‫ال‬ ‫ﯾﻛون‬ ‫وأن‬ ،‫اﻟﻔﺣص‬ ‫ﻋﻣﻠﯾﺔ‬ ‫أﺛﻧﺎء‬ ‫ﺗﺣدﯾث‬ ‫اﻟﺗﻲ‬ ‫أو‬ ،‫ﺣدﺛت‬ ‫اﻟﺗﻲ‬ ‫ﻟﻠﻌﻣﻠﯾﺎت‬ ‫واﺿﺢ‬ log
…hard code ‫ﺷﻛل‬ ‫ﻋﻠﻰ‬ ‫ﯾﻛﺗب‬ ‫ﻻ‬ ‫وأن‬ dynamically ‫ﺑﺷﻛل‬
○
‫ﻟل‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺗﻛون‬ ‫وأن‬ ،‫ﻣﻛﺎن‬ ‫ﻣن‬ ‫أﻛﺛر‬ ‫ﻓﻲ‬ ‫ﻟﻺﺳﺗﺧدام‬ ‫ﻗﺎﺑﻠﺔ‬ ‫ﺗﻛﺗﺑﮭﺎ‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ :Reusability
‫ﺑﻛﺗﺎﺑﺔ‬ ‫أﺑدا‬ ‫ﺗﻘم‬ ‫ﻓﻼ‬ ،DRY ‫ھو‬ ‫ھﻧﺎ‬ ‫اﻟﻣﺑﺎدئ‬ ‫أھم‬ ‫وﻣن‬ ،‫ﺑﺳﮭوﻟﺔ‬ ‫ﻣﻛﺎن‬ ‫ﻣن‬ ‫أﻛﺛر‬ ‫ﯾﺧدم‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫ﺑﺷﻛل‬ ‫ﻣﺻﻣﻣﺔ‬ classes & function
.‫ﻣﻛﺎن‬ ‫ﻣن‬ ‫أﻛﺛر‬ ‫ﻓﻲ‬ ‫ﻣﻛررة‬ ‫ﻣﺗطﺎﺑﻘﺔ‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬

○
‫ﻓﻲ‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ ‫ﻏﯾر‬ ‫اﻟﻣﺻﺎدر‬ ‫ﻣن‬ ‫أي‬ ‫وﺣذف‬ ‫ﺗﻧظﯾف‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫اﻟﻣﺗوﻗﻌﺔ‬ ‫ﻏﯾر‬ ‫اﻷﺧطﺎء‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫ﺗﺷﻣل‬ ‫وھﻲ‬ :Reliability
.‫اﻟﻣﺷروع‬
○
.‫ﺑﺳﮭوﻟﺔ‬ ‫أﺧرى‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫ﻓﻲ‬ ‫واﻻﺳﺗﺑدال‬ ‫ﻟﻠﺗﺣدﯾث‬ ‫ﻗﺎﺑﻠﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫أن‬ ‫ﺗﻌﻧﻲ‬ ‫وھذه‬ :Extensibility
○
‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫واﻟﺗﮭدﯾدات‬ Authentication, authorization, input data validation ‫ﻛل‬ ‫ﺗﺷﻣل‬ ‫وھﻲ‬ :Security
،‫اﻟﻣرور‬ ‫ﻛﻛﻠﻣﺎت‬ ‫وﺣﻣﺎﯾﺗﮭﺎ‬ ‫اﻟﺣﺳﺎﺳﺔ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻋﻠﻰ‬ ‫ﺑﺎﻟﺣﻔﺎظ‬ ‫اﻻھﺗﻣﺎم‬ ‫ﻋﻠﻰ‬ ‫ﺗﺷﺗﻣل‬ ‫ﻛﻣﺎ‬ ،‫أﻟﺦ‬...XSS, SQL injection ‫ﻛﺎل‬ ‫ذﻟك‬ ‫وراء‬ ‫ﻣن‬
…‫وﻏﯾرھﺎ‬ ‫اﻻﺋﺗﻣﺎﻧﯾﺔ‬ ‫اﻟﺑطﺎﻗﺎت‬ ‫وﻣﻌﻠوﻣﺎت‬
○
‫ھو‬ ‫اﻟﻣوﺿوع‬ ‫ﻟﮭذا‬ ‫اﻟﻌرﯾﺿﺔ‬ ‫اﻟﻧﻘﺎط‬ ‫وأھم‬ ،‫ﻟﻠﻧظﺎم‬ ‫وﻣﻣﺗﺎز‬ ‫ﻋﺎﻟﻲ‬ ‫أداء‬ ‫ﻋﻠﻰ‬ ‫ﻟﻠﺣﻔﺎظ‬ ‫اﻟﻣﻣﻛﻧﺔ‬ ‫اﻟوﺳﺎﺋل‬ ‫ﻛل‬ ‫ﺗﺷﻣل‬ ‫وھﻧﺎ‬ :Performance
synchronous ‫ال‬ ‫اﺳﺗﺧدام‬ ‫ﻋن‬ ‫واﻻﻣﺗﻧﺎع‬ Lazy loading, asynchronous and parallel processing ‫ال‬ ‫اﺳﺗﺧدام‬
.session data ‫وال‬ Caching ‫ال‬ ‫اﺳﺗﺧدام‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫ﻟﻠﺿرورة‬ ‫إﻻ‬
○
‫اﻟﻣﺗوﻗﻌﺔ‬ ‫أو‬ ‫اﻟﻣﻔﺎﺟﺋﺔ‬ ‫اﻟزﯾﺎدة‬ ‫ﺗﺣﻣل‬ ‫ﻋﻠﻰ‬ ‫ﻗﺎدر‬ ‫أﺑﻧﯾﮫ‬ ‫وﻣﺎ‬ ‫ﻓﯾﮫ‬ ‫أﻗوم‬ ‫ﻣﺎ‬ ‫ھل‬ ،‫اﻟﻣﺷروع‬ ‫ﺗﻧﻔﯾذ‬ ‫وأﻧﺛﺎء‬ ‫ﻣﺳﺑﻘﺎ‬ ‫اﻟﺗﻔﻛﯾر‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬ :Scalability
‫ﻻﺣق؟‬ ‫وﻗت‬ ‫ﻓﻲ‬ ‫اﻟزﯾﺎدات‬ ‫ﻣﻊ‬ ‫ﻟﺗﺗﻧﺎﺳب‬ ‫اﻟﺟزﺋﯾﺔ‬ ‫ھذه‬ ‫ﺑﺗطوﯾر‬ ‫ﯾﺳﻣﺢ‬ ‫اﻟﻧظﺎم‬ ‫وھل‬ ،‫ﻣﺛﻼ؟‬ ‫اﻟﻣﺳﺟﻠﯾن‬ ‫اﻷﻋﺿﺎء‬ ‫زﯾﺎدة‬ ‫ﺣﺎل‬ ‫ﻓﻲ‬
○
‫ﻓﺈن‬ ،‫وﻣﻔﮭوم‬ ‫ﺳﮭل‬ ‫ﺑﺷﻛل‬ ‫ﻟﻺﺳﺗﺧدام‬ ‫ﻗﺎﺑﻠﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﻧظﺎم‬ ‫ﻓﻲ‬ ‫ﺗظﮭر‬ ‫وظﯾﻔﺔ‬ ‫وأي‬ ‫ﺑﺑﻧﺎﺋﮭﺎ‬ ‫ﺗﻘوم‬ API ‫أي‬ ‫أن‬ ‫اﻟﺗﺄﻛد‬ ‫وﯾﺟب‬ :Usability
...‫ﻣﻌﮭم‬ ‫ﺑك‬ ‫اﻟﺧﺎﺻﺔ‬ ‫اﻷﻓﻛﺎر‬ ‫وﻣﻧﺎﻗﺷﺔ‬ product ‫ال‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻓﻌﻠﯾك‬ ‫ﺑﺎﻟﺗﺻﻣﯾم‬ ‫ﻣﻘﺗﻧﻌﺎ‬ ‫ﺗﻛن‬ ‫ﻟم‬

●
:Object-Oriented Analysis and Design (OOAD) Principles
○
‫وﻟﯾﻛن‬ ،class ‫ال‬ ‫أو‬ function ‫ال‬ ‫ﻋﻠﻰ‬ ‫واﺣد‬ ‫ﻣطور‬ ‫أو‬ ‫ﻣﺑرﻣﺞ‬ ‫ﺑوﺿﻊ‬ ‫ﻗم‬ :Single Responsibility Principle (SRS)
‫ﯾوﺟد‬ function ‫أو‬ class ‫وﻛل‬ ،functions ‫وال‬ classes ‫ال‬ ‫ﻣن‬ ‫ﻗطﻊ‬ ‫ﺷﻛل‬ ‫ﻋﻠﻰ‬ ‫ﻣﻘﺳﻣﺎ‬ OOP ‫أﺳﺎس‬ ‫ﻋﻠﻰ‬ ‫ﻟﻠﻌﻣل‬ ‫اﻟﺗوزﯾﻊ‬ ‫ﻧظﺎم‬
‫أﺛﻧﺎء‬ ‫ﻟﻛن‬ ،function ‫ال‬ ‫او‬ class ‫ال‬ ‫ھذا‬ ‫ﺗطوﯾر‬ ‫ﻓﻲ‬ ‫اﻵﺧرﯾن‬ ‫دﻣﺞ‬ ‫ﻣﻊ‬ ‫ﯾﺗﻌﺎرض‬ ‫ﻻ‬ ‫ھذا‬ ‫وطﺑﻌﺎ‬ ،‫ﻟﺑﻧﺎﺋﮫ‬ ‫ﻋﻠﯾﮫ‬ ‫ﯾﻌﻣل‬ ‫ﻓﻘط‬ ‫واﺣد‬ ‫ﻣﺻدر‬
،‫أﺟزاﺋﮫ‬ ‫ﺑﺗطوﯾر‬ ‫اﻟﻣطورﯾن‬ ‫ﻣن‬ ‫ﻛل‬ ‫ﺷروع‬ ‫ﻗﺑل‬ ‫واﺿﺣﺔ‬ ‫اﻟﻣﺧﺗﻠﻔﺔ‬ ‫اﻟﻣﺻﺎدر‬ ‫ﺑﯾن‬ ‫واﻻﻋﺗﻣﺎدﯾﺔ‬ ‫اﻟﺗوزﯾﻊ‬ ‫ﺗﻛون‬ ‫أن‬ ‫وﯾﻔﺿل‬ ،‫اﻟﻛﻼم‬ ‫ﯾﺧﺗﻠف‬ ‫اﻟﺑﻧﺎء‬
.‫ﺑﯾﻧﮭم‬ ‫ﻓﯾﻣﺎ‬ ‫اﻟﺗﻘﺎطﻊ‬ ‫ﻧﻘﺎط‬ ‫ﻟﻣﻌرﻓﺔ‬
○
‫أي‬ ‫ﺗﻌدﯾل‬ ‫ﻋن‬ ‫اﻟﺗوﻗف‬ ‫ﻓﯾﺟب‬ -New functionality- ‫ﺟدﯾدة‬ ‫ﺧﺎﺻﯾﺔ‬ ‫وﺗطوﯾر‬ ‫ﺑﺗﻧﻔﯾذ‬ ‫اﻟﻘﯾﺎم‬ ‫ﻋﻧد‬ :Open Closed Principle
‫ﺑﺣدوث‬ ‫ذﻟك‬ ‫ﻓﯾﺗﺳﺑب‬ ‫ﻣﺗﻧﺎﺳق‬ ‫ﻏﯾر‬ ‫ﺗﺣدﯾث‬ ‫أي‬ ‫أو‬ ‫ﻣﺗوﻗﻌﺔ‬ ‫ﻏﯾر‬ ‫ﻣﺷﺎﻛل‬ ‫أي‬ ‫ﺣدوث‬ ‫ﻟﻣﻧﻊ‬ functionality ‫ال‬ ‫ﺑﮭذه‬ ‫ﻣرﺗﺑطﺔ‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬
…‫ﻟﮭﺎ‬ ‫ﺣﺻر‬ ‫ﻻ‬ ‫ﻣﺷﺎﻛل‬
○
‫أن‬ ‫ﯾﺟب‬ sub class ‫ال‬ ‫ﻓﺈن‬ ،sub class ‫وال‬ super class ‫وﺟود‬ ‫ﺣﺎل‬ ‫ﻓﻲ‬ :Liskov substitutability principle
‫ﯾﻣﻛن‬ ‫ﻻ‬ ‫ﻟﮭذا‬ ،‫ﻣﺷﻛﻠﺔ‬ ‫أي‬ ‫ﺣﺻول‬ ‫دون‬ sub class ‫ﺑﺎل‬ super class ‫ﺑﺎل‬ ‫اﻟﺧﺎص‬ object ‫ال‬ ‫إﺳﺗﺑدال‬ ‫ﻣن‬ ‫ﺗﻣﻛﻧﮫ‬ ‫ﺑطرﯾﻘﺔ‬ ‫ﯾﻛﺗب‬
‫ﯾﺟب‬ ‫ﻓﮭﻧﺎ‬ ،!‫ﺑذﻟك‬ super class ‫ال‬ ‫ﯾﺳﻣﺢ‬ ‫أن‬ ‫دون‬ override ‫ﻋﻠﯾﮭﺎ‬ ‫اﻧﻌﻣل‬ method ‫ﻣن‬ param ‫ﺣذف‬ ‫أو‬ ‫ﻣﺣددات‬ ‫وﺿﻊ‬ ‫ﻣﺛﻼ‬
...‫اﻟﻘواﻋد‬ ‫ﺑﻧﻔس‬ ‫ﻟﻛن‬ sub class ‫ﻟل‬ ‫ﻣﻌدﻟﺔ‬ ‫ﻧﺳﺧﺔ‬ ‫ھﻲ‬ override method ‫ال‬ ‫ﺗﻛون‬ ‫أن‬

○
interface ‫ﻛل‬ ‫ﻟﯾﺷﻣل‬ ‫اﻟﻣﺳﺗطﺎع‬ ‫ﻗد‬ ‫ﺣﺟﻣﮭﺎ‬ ‫وﺗﻘﻠﯾل‬ interface ‫ال‬ ‫ﻓﺻل‬ ‫ﻣﺑدأ‬ ‫ﻋﻠﻰ‬ ‫ﺗﻘوم‬ ‫وھذه‬ :Interface segregation
.interface ‫ال‬ ‫داﺧل‬ -required- ‫ﺿرورﯾﺔ‬ ‫ﻏﯾر‬ params ‫أي‬ ‫إﺿﺎﻓﺔ‬ ‫ﻋن‬ ‫اﻹﻣﺗﻧﺎع‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫ﻓﻘط‬ ‫ﻷﺟﻠﮭﺎ‬ ‫ﺑﻧﻲ‬ ‫اﻟﺗﻲ‬ ‫اﻟوظﺎﺋف‬
○
‫أي‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﻣن‬ ‫ﺗﻣﻧﻊ‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﺑدأ‬ ‫أو‬ ‫اﻟطرﯾﻘﺔ‬ ‫ﺑﺄﻧﮭﺎ‬ ‫اﻟﻘول‬ ‫ﯾﻣﻛن‬ ‫ﻋﺎم‬ ‫ﺑﺷﻛل‬ :Dependency Inversion principle
‫ﺑﺗﺻﻣﯾﻣﮫ‬ ‫ﻗﻣﻧﺎ‬ ‫ﻣﺎ‬ ‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫اﻷﻣﺛﻠﺔ‬ ‫وﻣن‬ ،‫ﻣﻛﺎن‬ ‫ﻣن‬ ‫أﻛﺛر‬ ‫ﻓﻲ‬ dependency ‫ال‬ ‫ھذه‬ ‫اﺳﺗﺧدام‬ ‫وﺳﯾﺗم‬ ‫ﺟزﺋﯾﺔ‬ ‫داﺧل‬ dependency
.axios ‫ال‬ ‫طرﯾق‬ ‫ﻋن‬ API ‫ال‬ ‫ﻣن‬ ‫ﻟﻠﺑﯾﺎﻧﺎت‬ fetch ‫ﻟﻌﻣل‬
،Low level ‫ال‬ ‫ﻋﻠﻰ‬ ‫ﯾﻌﺗﻣد‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﻻ‬ High level ‫ﻓﺈن‬ abstractions ‫ال‬ ‫ﺛﻧﺎﯾﺎھﺎ‬ ‫ﻓﻲ‬ ‫ﺗﺣﺗوي‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑرﻣﺟﺔ‬ ‫ﻟﻐﺎت‬ ‫ﻓﻲ‬ :‫ﻣﻼﺣظﺔ‬
abstractions ‫ال‬ ‫ﻋﻠﻰ‬ ‫ﯾﻌﺗﻣدو‬ ‫ﻻزم‬ low level & high level ‫ال‬ ‫ﺑل‬

●
:Application Design
○
‫واﻷﻗﺳﺎم‬ ‫اﻷﺟزاء‬ ‫ﺟﻣﯾﻊ‬ ‫ﻓﻲ‬ ‫واﺣد‬ ‫ﺣﺟم‬ ‫وذات‬ ،‫اﻟﺣﺟم‬ ‫ﻣﺗﻧﺎﺳﻘﺔ‬ ‫اﻟﺗطﺑﯾق‬ ‫داﺧل‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ ‫اﻟﺧطوط‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ :Font uniformity
…‫اﻷﺟﮭزة‬ ‫ﺟﻣﯾﻊ‬ ‫ﻋﻠﻰ‬ ‫ﻟﻠﻘراﺋﺔ‬ ‫ﻗﺎﺑﻠﺔ‬ ‫اﻟﺧطوط‬ ‫أﺣﺟﺎم‬ ‫ﺗﻛون‬ ‫أن‬ ‫وﯾﺟب‬ ،‫اﻷﻟوان‬ ‫وﻛذﻟك‬ ،‫اﻟﻣﺗﺷﺎﺑﮭﺔ‬
○
‫ﻓﻲ‬ ‫اﻟﻣﺳﺗﺧدﻣﯾن‬ ‫ﻓﺋﺎت‬ ‫ﺟﻣﯾﻊ‬ ‫ﻣن‬ ‫إﻟﯾﮭﺎ‬ ‫اﻟوﺻول‬ ‫وﯾﻣﻛن‬ ‫ﻣﺳﺗﺧدﻣﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﻧظﺎم‬ ‫ﻓﻲ‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ ‫اﻷﻟوان‬ :Color Accessibility
‫اﻟﻣوﻗﻊ‬
○
.‫ﺑﺎﻟوﺿوح‬ ‫وﯾﺗﺳﻣﺎن‬ ،‫ﻣﻌﺎ‬ ‫ﻣﺗﻧﺎﺳﻘﯾن‬ ‫واﻟﺗﺻﻣﯾم‬ ‫اﻷﻟوان‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ :Uniformity of color and design scheme
○
.‫ﻟﻠﻣﺳﺗﺧدﻣﯾن‬ ‫وﺳﻠﺳﻠﺔ‬ ‫ﺳﮭﻠﺔ‬ ‫اﻟوﺻول‬ ‫طرﯾﻘﺔ‬ ‫ﻣﻌرﻓﺔ‬ ‫أو‬ ‫اﻟوﺻول‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬ :Ease of use for users
○
‫اﻟﻣﺳﺗﺧدﻣﯾن‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫ﻟﻠﻣطﻠوب‬ ‫اﻟوﺻول‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺣب‬ :Minimum number of screens to achieve a use-case
‫واﻟﺗﻧﻘﻼت‬ ‫اﻟواﺟﮭﺎت‬ ‫ﻣن‬ ‫ﻋدد‬ ‫ﺑﺄﻗل‬
○
.‫ﻟﻠﻌرض‬ ‫ﻓﻘط‬ ‫اﻟﻣطﻠوﺑﺔ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫واﺳﺗرﺟﺎع‬ ،‫اﻟﺳﯾرﻓر‬ ‫ﻋﻠﻰ‬ requests ‫ال‬ ‫ﻣﻣﻛن‬ ‫ﻋدد‬ ‫وأﻗل‬ caching ‫ال‬ ‫وﺗﺷﻣل‬ :Performance

○
،‫ﻣﺗﺎﺣﺔ‬ ‫طرﯾﻘﺔ‬ ‫أو‬ format ‫ﺑﺄﻓﺿل‬ ‫ﻣﺗﺎﺣﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﻋرﺿﮭﺎ‬ ‫ﯾﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ :Presentation of information
‫اﻷﺟﮭزة‬ ‫أﻧواع‬ ‫ﺟﻣﯾﻊ‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ ‫ﻟﮭذه‬ ‫اﻟوﺻول‬ ‫ﯾﺗم‬ ‫أن‬ ‫وﯾﺟب‬ ،‫واﺿﺣﺔ‬ ‫ﺑطرﯾﻘﺔ‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ ‫ھذه‬ layout ‫ال‬ ‫ﯾﻌرض‬ ‫أن‬ ‫وﯾﺟب‬
…‫اﻟطرﯾﻘﺔ‬ ‫ﺑﻧﻔس‬ ‫وﻏﯾرھﺎ‬ ‫واﻟﻣواﻗﻊ‬ ‫واﻟﮭواﺗف‬
○
.‫اﻟﻣﺧﺗﻠﻔﺔ‬ ‫اﻟﺷﺎﺷﺎت‬ ‫ﻷﺣﺟﺎم‬ ‫اﻷﺳﺎﺳﯾﺔ‬ ‫اﻟواﺟﮭﺎت‬ ‫ﺟﻣﯾﻊ‬ ‫اﻟوﯾب‬ ‫ﺗطﺑﯾق‬ ‫ﯾدﻋم‬ ‫أن‬ ‫ﯾﺟب‬ :Responsiveness
○
‫ﺣﺗﻰ‬ ‫اﻟﻣﺗﺻﻔﺣﺎت‬ ‫او‬ ‫اﻷﺟﮭزة‬ ‫ﺟﻣﯾﻊ‬ ‫ﻋﻠﻰ‬ ‫وﺳﺗﻌﻣل‬ ‫ﺳﯾظﮭر‬ ‫ﺑﺗﺻﻣﯾﻣﮫ‬ ‫ﺗﻘوم‬ ‫اﻟذي‬ ‫اﻟﻣﺣﺗوى‬ ‫ﺑﺄن‬ ‫ﺗﮭﺗم‬ ‫أن‬ ‫ﯾﺟب‬ :Accessible content
،mobile ‫وﺟود‬ ‫ﺣﺎل‬ ‫ﻓﻲ‬ touch screen ‫ﻛﺎل‬ ‫اﻟﻣﮭﻣﺔ‬ ‫اﻟﺧﺻﺎﺋص‬ ‫ﺑﻌض‬ ‫اﻹﻋﺗﺑﺎر‬ ‫ﺑﻌﯾن‬ ‫اﻷﺧذ‬ ‫ﯾﺟب‬ ‫ﻛﻣﺎ‬ ،‫اﻟﺷرﻛﺎت‬ ‫اﺧﺗﻠﻔت‬ ‫ﻟو‬
.‫ﺗﻠزم‬ ‫ﻻ‬ redirects ‫أي‬ ‫ﻋن‬ ‫واﻻﻣﺗﻧﺎع‬
○
‫ﯾﺗوﻗف‬ ‫أن‬ ‫دون‬ ‫ﯾﺣﺗﺎج‬ ‫ﻟﻣﺎ‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ﯾﺻل‬ ‫ﺑﺄن‬ ‫ﻛﻔﯾﻠﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ API ‫ال‬ ‫ﯾﻘدﻣﮭﺎ‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ :Accuracy of information
.‫ﻓﯾﮫ‬ ‫ﯾﻘوم‬ ‫اﻟذي‬ ﬂow ‫ال‬ ‫ﻟﺗﺳﻠﺳل‬ ‫ﻗطﻊ‬ ‫أي‬ ‫ﻣن‬ ‫ﻣﻣﻛن‬ ‫ﻗدر‬ ‫وﺑﺄﻗل‬

:‫اﻟﺰﻣﺮ‬ ‫ﺳﻮر‬ ‫ﻓﻲ‬ ‫ﺗﻌﺎﻟﻰ‬ ‫ﻗﺎل‬
ُ
‫ر‬َ‫ﺬ‬ ْ
‫ﺤ‬ َ
‫ﻳ‬ ‫ﺎ‬ ً
‫ﻤ‬ ِ
‫ﺎﺋ‬ َ
‫ﻗ‬ َ
‫و‬ ‫ا‬ ً‫ﺪ‬ ِ
‫ﺎﺟ‬ َ
‫ﺳ‬ ِ
‫ﻞ‬ ْ
‫ﻴ‬ َّ‫اﻟﻠ‬ َ
‫ﺎء‬ َ
‫آﻧ‬ ٌ
‫ﺖ‬ ِ
‫ﺎﻧ‬ َ
‫ﻗ‬ َ
‫ﻮ‬ ُ
‫ﻫ‬ ْ
‫ﻦ‬ َّ
‫ﻣ‬َ‫"أ‬
َ
‫ﻳﻦ‬ ِ
‫ﺬ‬ َّ‫اﻟ‬ ‫ي‬ ِ
‫ﻮ‬ َ
‫ﺘ‬ ْ
‫ﺴ‬ َ
‫ﻳ‬ ْ
‫ﻞ‬ َ
‫ﻫ‬ ْ
‫ﻞ‬ ُ
‫ﻗ‬ ۗ ِ
‫ﻪ‬ ِّ
‫ﺑ‬ َ
‫ر‬ َ
‫ﺔ‬ َ
‫ﻤ‬ ْ
‫ﺣ‬ َ
‫ر‬ ‫ﻮ‬ ُ
‫ﺟ‬ ْ
‫ﺮ‬ َ
‫ﻳ‬ َ
‫و‬ َ
‫ة‬ َ
‫ﺮ‬ ِ
‫ﺧ‬ ْ
‫اﻵ‬
‫ﻮ‬ ُ‫وﻟ‬ُ‫أ‬ ُ
‫ﺮ‬ َّ‫ﻛ‬َ‫ﺬ‬ َ
‫ﺘ‬ َ
‫ﻳ‬ ‫ﺎ‬ َ
‫ﻤ‬ َّ
‫ﻧ‬ِ‫إ‬ ۗ َ
‫ﻮن‬ ُ
‫ﻌ‬ َ
‫ﻳ‬ َ
‫ﻻ‬ َ
‫ﻳﻦ‬ ِ
‫ﺬ‬ َّ‫اﻟ‬ َ
‫و‬ َ
‫ﻮن‬ ُ
‫ﻌ‬ َ
‫ﻳ‬
" ِ
‫ﺎب‬ َ
‫ﺒ‬ ْ‫ﻟ‬ َ ْ
‫اﻷ‬

Application Threat Modeling
‫أي‬ ‫ﻓﻲ‬ ‫اﻷﻣﻧﻲ‬ ‫اﻟﻧظﺎم‬ ‫ﺗﺣﻠﯾل‬ ‫ﺻﻣﯾم‬ ‫ﻓﻲ‬ ‫ﺗدﺧل‬ ‫اﻟﺗﻲ‬ ‫اﻟطرق‬ ‫إﺣدى‬ Application Threat Modeling ‫ال‬ ‫ﺗﻌد‬
‫ﻓﻲ‬ ‫اﻟﻧظر‬ ‫ﻋﻧد‬ ‫ﻟﻠﻣطورﯾن‬ ‫ﻣﮭﻣﺔ‬ ‫ﻟﻠﻔﺗﺔ‬ ‫ﻧﻣوذج‬ ‫ﺗﻘدم‬ ‫أﻧﮭﺎ‬ ‫إﻻ‬ ،‫اﻟﺷراﺋﺢ‬ ‫ھذه‬ ‫ﺻﻣﯾم‬ ‫ﻣن‬ ‫ﻟﯾﺳت‬ ‫اﻟﺟزﺋﯾﺔ‬ ‫ھذه‬ ‫أن‬ ‫وﻣﻊ‬ ،‫ﺗطﺑﯾق‬
‫أﻗرب‬ ‫ﯾﻛون‬ ‫ﻗد‬ ‫ﺗﻌداد‬ ‫أو‬ ‫ﺑﺻﯾﻐﺔ‬ ‫ﻟﻛن‬ modeling ‫ال‬ ‫ھذا‬ ‫ﺑﮭﺎ‬ ‫ﯾﮭﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻷﺟزاء‬ ‫ھﻧﺎ‬ ‫وﺳﺄذﻛر‬ ،‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬
:‫وھﻲ‬ ،‫اﻟﺗﺳﻠﺳل‬ ‫ﻟﺳرد‬ ‫اﻟﻛﺗﺎب‬ ‫ﻓﻲ‬ ‫اﻟﻣﻌﺗﻣدة‬ ‫اﻟﺧطوات‬ ‫ﻧﻔس‬ ‫ﺳﺄﻋﺗﻣد‬ ‫و‬ ،‫اﻟﺷراﺋﺢ‬ ‫ھذه‬ ‫ﻟﻣوﺿوع‬
:‫اﻷوﻟﻰ‬ ‫اﻟﺧطوة‬
‫اﻟﺗطﺑﯾق‬ ‫ﺑﻔﮭم‬ ‫اﻻھﺗﻣﺎم‬ ‫ﺑوﺟوب‬ ‫ﺗﻔﯾد‬ ‫واﻟﺗﻲ‬ ‫ﺧطوة‬ ‫وأھم‬ ‫أول‬ ‫اﻟﺧطوة‬ ‫ھذه‬ :Decompose the Application
‫ﺛﺎﻟث‬ ‫طرف‬ ‫أو‬ ‫ﺟﮭﺔ‬ ‫أي‬ ‫ﻣﻊ‬ ‫اﻟﺗطﺑﯾق‬ ‫ﺗﻌﺎﻣل‬ ‫وﻛﯾﻔﯾﺔ‬ ‫ﻋﻣﻠﮫ‬ ‫وﺳﯾر‬
:‫ﺑﮭﺎ‬ ‫اﻹھﺗﻣﺎم‬ ‫ﯾﺟب‬ ‫اﻟﺗﻲ‬ ‫اﻟﻧﻘﺎط‬ ‫أھم‬ ‫ھﻲ‬ ‫وھذه‬

●
‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ﯾﺟب‬ ‫ﺧﺎرﺟﯾﺔ‬ dependencies ‫ك‬ ‫ﻋﻧﺻر‬ ‫أي‬ ‫إﺿﺎﻓﺔ‬ ‫ﻋﻧد‬ :External Dependencies
‫إذا‬ ‫ﻓﻣﺛﻼ‬ ،‫ﺗﺣدﯾدا‬ production env ‫ال‬ ‫ﻋﻠﻰ‬ ‫واﻟﺗﺄﺛﯾر‬ ‫اﻹﺳﺗﺧدام‬ ‫طرﯾﻘﺔ‬ ‫اﻟﺗﺄﺛﯾر‬ ‫ﯾﺷرح‬ ‫ﺑﺷﻛل‬ ‫ﻟﻠﺗوﺛﯾق‬ ‫إﺿﺎﻓﺗﮭﺎ‬
production ‫ال‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫اﻟﻣراد‬ ‫وﺗطﺑﯾق‬ ‫ﺑﻧﺎء‬ ‫آﻟﯾﺔ‬ ‫ﺗوﺛﯾق‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﻓﯾﺟب‬ AWS ‫ﻋﻠﻰ‬ ‫اﻋﺗﻣدﻧﺎ‬
‫وﻋدم‬ ‫ﺑﺎﻟﻣؤﺳﺳﺔ‬ ‫اﻟﻣﻌﺗﻣدة‬ ‫اﻟﺗوﺛﯾق‬ ‫طرﯾﻘﺔ‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫ﻣﻧظم‬ ‫ﺑﺷﻛل‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﺑﺟب‬ ‫اﻟﺗوﺛﯾق‬ ‫وھذا‬ ،environment
‫ﺣﯾن‬ ‫اﻟﻔﺎﺋدة‬ ‫ﻣﻊ‬ ،task ticket ‫ﻋﻠﻰ‬ ‫اﻟﺗﻌﻠﯾق‬ ‫ﺑﻛﺗﺎﺑﺔ‬ ‫اﻹﻛﺗﻔﺎء‬ ‫ﻣﺛل‬ ‫ﺑﮭﺎ‬ ‫ﺗﺗﻌﻠق‬ ‫ﻻ‬ ‫اﻟﺗﻲ‬ ‫اﻷﻧظﻣﺔ‬ ‫ﻋﻠﻰ‬ ‫ﺑﺗوﺛﯾﻘﮭﺎ‬ ‫اﻹﻛﺗﻔﺎء‬
...‫ﺗﺣرﯾﻛﮭﺎ‬ ‫أو‬ ‫إﻏﻼﻗﮭﺎ‬ ‫ﻗﺑل‬ ‫اﻟﺗﻛت‬ ‫ﻋﻠﻰ‬ ‫ﻛﺗﺎﺑﺗﮭﺎ‬
●
‫اﻟﻣﺧرب‬ ‫أو‬ ‫اﻟﻣﺧﺗرق‬ ‫أو‬ ‫اﻟﻣﮭﺎﺟم‬ ‫ﺧﻼﻟﮭﺎ‬ ‫ﻣن‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﻧﺎﻓذ‬ ‫ﺟﻣﯾﻊ‬ ‫ﺳرد‬ ‫ﺗﺷﻣل‬ ‫اﻟﻧﻘطﺔ‬ ‫ھذه‬ :Entry Points
‫اﻟﻣواﻗﻊ‬ ‫ﻓﻲ‬ ‫اﻟﺟزﺋﯾﺔ‬ ‫ھذه‬ ‫وﺗﺷﻣل‬ ،attack vector ‫ب‬ ‫أﯾﺿﺎ‬ ‫وﺗﺳﻣﻰ‬ ،‫ھدﻓﮫ‬ ‫إﻟﻰ‬ ‫ﻟﻠوﺻول‬ ‫اﺳﺗﻐﻼھﺎ‬ ‫ﻣن‬
،popup window ‫ال‬ ،chat ‫ال‬ ‫وﺗﺷﻣل‬ ،emails ‫ال‬ ‫ﻣﺛﻼ‬ ‫وﺗﺷﻣل‬ ،form pages ‫ﻣﺛﻼ‬ ‫اﻹﻟﻛﺗروﻧﯾﺔ‬
‫ﻓﻲ‬ ‫واﻟﺗﻌدﯾل‬ ،‫ﺟدا‬ ‫دﻗﯾﻘﺔ‬ ‫اﻟﺟزﺋﯾﺎت‬ ‫ھذه‬ ‫ﻓﻲ‬ ‫اﻟﻣراﺟﻌﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﻟذﻟك‬ ،...socket messages ‫ال‬
.‫اﻟﻣﻧﻔذ‬ ‫ﻟﮭذا‬ ‫ﺷﺎﻣﻠﺔ‬ ‫ﻣراﺟﻌﺔ‬ ‫ﯾﺗطﻠب‬ ‫ﺟزﺋﯾﺎﺗﮭﺎ‬

●
‫وإﻣﺎ‬ ،Physical Assets ‫ال‬ ‫ﻓﻲ‬ ‫رﻏﺑﺔ‬ ‫إﻣﺎ‬ ،‫إﺛﻧﯾن‬ ‫ﻣن‬ ‫ﻟﮭدف‬ ‫ﺑذﻟك‬ ‫ﯾﻘوم‬ ‫ﻣﺎ‬ ‫ﻋﺎدة‬ ‫ﻣﺧﺗرق‬ ‫أي‬ ‫إن‬ :Assets
‫ﻓﻲ‬ ‫ﻋوﻧﺎ‬ ‫ﻟﮫ‬ ‫ﺗﻘدم‬ ‫ﻗد‬ ‫وﺑﯾﺎﻧﺎت‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫ﻣن‬ ‫ﻋﻠﯾﮫ‬ ‫ﯾﺣﺻل‬ ‫ﻗد‬ ‫ﻣﺎ‬ ‫ﻓﻲ‬ ‫ﻣﮭﺗم‬ ‫ﻓﮭو‬ ‫اﻷوﻟﻰ‬ ‫ﻓﻲ‬ ،abstract asset
‫إن‬ ،‫ﻟذﻟك‬ ،‫اﺧﺗراﻗﮭﺎ‬ ‫اﻟﻣراد‬ ‫اﻟﺷرﻛﺔ‬ ‫ﺑﺳﻣﻌﺔ‬ ‫ﻟﻺﺿرار‬ ‫ﺗﻛون‬ ‫واﻟﺛﺎﻧﯾﺔ‬ ،‫اﻟﺦ‬...‫ﻣﺎدﯾﺔ‬ ‫ﻣﻧﻔﻌﺔ‬ ،‫أﺧرى‬ ‫اﺧﺗراق‬ ‫ﻋﻣﻠﯾﺎت‬
‫ﻓﺈن‬ ‫ﻟﮭذا‬ ،‫ﺑوﺟودھﺎ‬ ‫ﺗﻧﺑﺄت‬ ‫أو‬ ‫اﻟﺧطورة‬ ‫ﻣﻘدار‬ ‫ﻣن‬ ‫ﻗﻠﻠت‬ ‫ﺣﻣﺎﯾﺗﮭﺎ‬ ‫ﯾﺟب‬ ‫واﻟﺗﻲ‬ ‫ﻟدﯾك‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫أھم‬ ‫ﺗﺣدﯾد‬ ‫اﺳﺗطﻌت‬
...‫ﺑﺧﺳﺎرﺗﮫ‬ ‫ﺗرﻏب‬ ‫ﻻ‬ ‫وﻣﺎ‬ ‫ﺑﺣﻣﺎﯾﺗﮫ‬ ‫ﺗرﻏب‬ ‫ﻣﺎ‬ ‫اﻹﻋﺗﺑﺎر‬ ‫ﺑﻌﯾن‬ ‫ﺗﺄﺧذ‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻋﻣﻠﯾﺔ‬ ‫أي‬
●
‫اﻟﺗﻲ‬ ‫اﻟطرق‬ ‫أﻛﺛر‬ ‫ﻣن‬ ‫وﺗوﻗﻌﮭﺎ‬ ‫اﻟﮭﺟوم‬ ‫طرق‬ ‫ﺗﺣدﯾد‬ ‫ﯾﻌد‬ :Determining the Attack Surface
‫ھﻲ‬ ‫ﺟزﺋﯾﺔ‬ ‫وأول‬ ،‫اﻟﻧظﺎم‬ ‫ھذا‬ ‫ﺣﻣﺎﯾﺔ‬ ‫ﻋن‬ ‫ﻣﺳؤول‬ ‫ھو‬ ‫ﻣن‬ ‫وﻛذﻟك‬ ،‫ﻧظﺎم‬ ‫أي‬ ‫إﻟﻰ‬ ‫ﻟﻠدﺧول‬ ‫اﻟﻣﺧﺗرﻗون‬ ‫ﯾﺳﺗﺧدﻣﮭﺎ‬
‫ھذا‬ ‫وﯾﺷﻣل‬ ،‫اﻟﻌﻣل‬ ‫أﺛﻧﺎء‬ ‫ﻋﻠﯾﮭﺎ‬ ‫ﯾطرأ‬ ‫ﺗﻌدﯾل‬ ‫أي‬ ‫وﻣراﺟﻌﺔ‬ ‫ﻣﻧﮭﺎ‬ ‫واﻟﺗﺣﻘق‬ ‫اﻟﻣﻣﻛﻧﺔ‬ input paths ‫ال‬ ‫ﺟﻣﯾﻊ‬ ‫ﺣﺻر‬
Browser input, Cookies, Property ﬁles, External processes, Data feeds,
Service responses, Flat ﬁles, Command line parameters, Environment
variables

●
‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﻣﻊ‬ ‫اﻟﺗﻌﺎﻣل‬ ‫ﻓﻲ‬ ‫ﻣﮭم‬ ‫أﻣر‬ ‫ﺟزﺋﯾﺔ‬ ‫أي‬ ‫ﻋﻠﻰ‬ ‫اﻟﻌﻣل‬ ‫ﻋﻧد‬ ‫اﻟﻼزﻣﺔ‬ ‫اﻟﺻﻼﺣﯾﺔ‬ ‫ﻣﻘدار‬ ‫ﺗﺣدﯾد‬ :Trust Levels
‫ﻣراﺟﻌﺔ‬ ‫أﺛﻧﺎء‬ ‫اﻟﻣﺑدأ‬ ‫ھذا‬ ‫ﻋﻠﻰ‬ ‫اﻟﺗﺄﻛﯾد‬ ‫ﯾﻌﻧﻲ‬ ‫وھذا‬ ،external resource ‫ال‬ ‫ﻣن‬ ‫ﺧﺻوﺻﺎ‬ ‫ﻟﻠﺗﻧﻔﯾذ‬ ‫ﻗﺎﺑﻠﺔ‬ ‫ﺑرﻣﺟﯾﺔ‬
‫ﻓﯾﺟب‬ ‫ﻧﻘﺻﺎن‬ ‫أو‬ ‫زﯾﺎدة‬ ‫إﻣﺎ‬ ‫اﻟﻘواﻋد‬ ‫ﺗﻐﯾﯾر‬ ‫وﻋﻧد‬ ،‫اﻟﻣطﻠوب‬ ‫ﻣن‬ ‫أﻛﺑر‬ ‫ﺻﻼﺣﯾﺔ‬ ‫ﻹﻋطﺎء‬ ‫داﻋﻲ‬ ‫ﻓﻼ‬ ،‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬
…‫اﻟﺟدﯾد‬ ‫اﻟﺗﻌدﯾل‬ ‫ﻣﻊ‬ ‫ﯾﺗﻧﺎﺳب‬ ‫ﺑﻣﺎ‬ ‫أﯾﺿﺎ‬ ‫اﻟﺻﻼﺣﯾﺔ‬ ‫ﻋﻠﻰ‬ ‫اﻟﺗﻌدﯾل‬
●
‫وﻛﯾﻔﯾﺔ‬ ‫ﻣﻌﺎﻟﺟﺗﮭﺎ‬ ‫آﻟﯾﺔ‬ ‫ھﻲ‬ ‫وﻣﺎ‬ dynamic data & static data ‫ال‬ ‫ﻣﻌرﻓﺔ‬ :Data ﬂow analysis
...‫ﺗﺣﻣﻠﮭﺎ‬ ‫اﻟﺗﻲ‬ ‫اﻟﻘﯾم‬ ‫وﻣﻌﺎﻟﺟﺔ‬ ‫ﺑﮭﺎ‬ ‫اﻟﺧﺎﺻﺔ‬ params ‫ال‬ ‫ﻣﻊ‬ ‫اﻟﺗﻌﺎﻣل‬

●
‫ﺟﻣﯾﻊ‬ ‫ﻋن‬ ‫ﯾﻌرف‬ ‫أن‬ ‫اﻟﻣراﺟﻊ‬ ‫ﻋﻠﻰ‬ ‫ﻓﯾﺟب‬ ،‫ﺟدا‬ ‫ﺟدا‬ ‫اﻟﻣﮭﻣﺔ‬ ‫اﻟﻧﻘﺎط‬ ‫ﻣن‬ ‫اﻟﻧﻘطﺔ‬ ‫ھذه‬ :Transaction analysis
‫اﻟﻣوﺿوع‬ ‫ھذا‬ ‫أھﻣﯾﺔ‬ ‫وﺗﻛﻣن‬ ،‫ﻣﻌﮭﺎ‬ ‫اﻟﺗﻌﺎﻣل‬ ‫ﯾﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻋﻠﻰ‬ ‫أﻣﺎﻣﮫ‬ ‫اﻟﺣﺎﺻﻠﺔ‬ Transaction ‫ال‬
:‫ب‬ ‫ﺟﻣﻌﮭﺎ‬ ‫ﯾﻣﻛن‬ ‫اﻟﺣرﻛﺎت‬ ‫وھذه‬ ،"‫وإﻟﻰ‬ ‫"ﻣن‬ ‫اﻟﺣرﻛﺎت‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫ﻋﻠﻰ‬ ‫ﻗﺎﺋم‬ ‫ھو‬ ‫اﻟﻧظﺎم‬ ‫ﺑﺄن‬
Data/Input Validation of data from all untrusted sources, Authentication,
Session Management, Authorization, Cryptography (data at rest and in
transit), Error Handling /Information Leakage, Logging /Auditing

‫ﻓﻣن‬ ،‫اﻟﻣراﺟﻌﺔ‬ ‫ﻣن‬ ‫اﻷﻣﻧﻲ‬ ‫اﻟﺟﺎﻧب‬ ‫ﯾﺑرز‬ ‫اﻟﺧطوة‬ ‫ھذه‬ ‫ﻓﻲ‬ :Determine and rank threats :‫اﻟﺛﺎﻧﯾﺔ‬ ‫اﻟﺧطوة‬
‫اﻟﺗﮭدﯾدات‬ ‫ﻟﮭذه‬ ‫ﺗﺻﻧﯾﻔﺎت‬ ‫ﺑﻧﺎء‬ ‫ﯾﺗم‬ ‫اﻟﻣرﺣﻠﺔ‬ ‫ھذه‬ ‫ﻓﻲ‬ ،‫اﻟﺧطورة‬ ‫ﺣﯾث‬ ‫ﻣن‬ ‫وﺗرﺗﯾﺑﮭﺎ‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻟﺗﮭدﯾدات‬ ‫ﺗﺣدﯾد‬ ‫ﯾﺗم‬ ‫ﺧﻼﻟﮭﺎ‬
.STRIDE ‫ال‬ ‫ﻣﻧﮭﺎ‬ ‫ﻧذﻛر‬ ‫ﻟذﻟك‬ ‫ﻧﻣﺎذج‬ ‫ﻋدة‬ ‫وھﻧﺎك‬ ،‫اﻟﻣﺣﺗﻣﻠﺔ‬
Spooﬁng, Tampering, Repudiation, Information ‫ل‬ ‫اﺧﺗﺻﺎر‬ ‫ھﻲ‬ STRIDE ‫ال‬
‫ال‬ ‫إﺣدى‬ ‫وھﻲ‬ ،Disclosure, Denial of Service (DoS), and Elevation of privilege
‫واﻵن‬ ،‫ﺧﻼﻟﮭﺎ‬ ‫ﻣن‬ ‫اﻹﺳم‬ ‫ﺑﻧﺎء‬ ‫ﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻻﺧﺗﺻﺎرات‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫اﻷﻣﻧﯾﺔ‬ ‫ﻟﻠﺗﮭدﯾدات‬ ‫ﺗﺻﻧﯾف‬ ‫ﻟﺑﻧﺎء‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ models
:‫اﻟﻣﺻطﻠﺣﺎت‬ ‫ﻟﮭذه‬ ‫ﺑﺳﯾط‬ ‫ﺑﺗوﺿﯾﺢ‬ ‫ﺳﻧﻘوم‬

●
‫ﺗﺣدث‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﺧﺎطر‬ ‫أھم‬ ‫ﻣن‬ ‫واﺣدة‬ ‫وھﻲ‬ ،”Identity spooﬁng“ ‫ال‬ ‫ﺑﮭﺎ‬ ‫وﯾﻘﺻد‬ :Spooﬁng
‫ﻻ‬ ‫أﻣر‬ ‫وھذا‬ ،‫اﻟﺗطﺑﯾق‬ ‫ﻣﺳﺗوى‬ ‫ﻋﻠﻰ‬ ‫أو‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻗواﻋد‬ ‫ﻣﺳﺗوى‬ ‫ﻋﻠﻰ‬ ‫ﯾﻛون‬ ‫ﻗد‬ ‫ھذا‬ ‫اﻟﮭوﯾﺔ‬ ‫اﻧﺗﺣﺎل‬ ،‫ﺗطﺑﯾق‬ ‫أي‬ ‫ﻓﻲ‬
‫ﯾﻣﻧﻊ‬ ‫ﻣﺎ‬ ‫ﻓﯾﮭﺎ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﻣن‬ ‫ھﻧﺎ‬ ‫اﻟﻣراﺟﻊ‬ ‫ودور‬ ،‫ﺟدا‬ ‫ﺧطر‬ ‫وھو‬ ‫اﻟﻧظﺎم‬ ‫ﻓﻲ‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬
‫ﻣﺳﻣوﺣﺔ‬ ‫أﻧﮭﺎ‬ ‫ﯾﻌﻧﻲ‬ ‫ﻓﮭذا‬ ‫ﻣوﺟودة‬ ‫ﻛﺎﻧت‬ ‫إذا‬ ‫ﺗﺄﻛﯾد‬ ‫ﺑﻛل‬- y ‫ﻣﺳﺗﺧدم‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫ﺑﺗﻌدﯾل‬ x ‫ﻣﺳﺗﺧدم‬ ‫ﯾﻘوم‬ ‫أن‬ ‫ﻣن‬ ‫ﻣﺛﻼ‬
.-‫ﺑذﻟك‬ ‫ﺗﺳﻣﺢ‬ ‫واﺿﺣﺔ‬ role ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﺗﺗم‬ ‫أن‬ ‫وﯾﺟب‬
●
‫اﻟﺗﻼﻋب‬ ‫ھذا‬ ،‫اﻟﺛﻐرات‬ ‫واﻛﺗﺷﺎف‬ ‫ﺑﺎﻟﺑﯾﺎﻧﺎت‬ ‫ﻟﻠﺗﻼﻋب‬ ‫اﻟطرق‬ ‫أﺷﮭر‬ ‫ﻣن‬ ‫واﺣدة‬ ‫ﺑﺎﻟﺑﯾﺎﻧﺎت‬ ‫اﻟﻌﺑث‬ :Tampering
‫ﺧﻼل‬ ‫ﻣن‬ ‫أو‬ response ‫ك‬ ‫اﻟﺳﯾرﻓر‬ ‫ﻣن‬ ‫اﻟﻘﺎدﻣﺔ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻣﺳﺗﻐﻼ‬ client side ‫ال‬ ‫ﺟﺎﻧب‬ ‫ﻋﻠﻰ‬ ‫ﯾﺣﺻل‬
‫ودور‬ ،!‫ھدﻓﮫ‬ ‫ﻟﮫ‬ ‫ﻟﺗﺣﻘق‬ ‫ﺑﺗﻌدﯾﻠﮭﺎ‬ ‫اﻟﻣﮭﺎﺟم‬ ‫ھذا‬ ‫ﯾﻘوم‬ ‫ﺛم‬ ،‫اﻟﺦ‬..network ‫ال‬ ‫أو‬ memory ‫ال‬ ‫ﻣن‬ ‫ﺳرﻗﺗﮭﺎ‬
‫أو‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫أي‬ ‫ﻋﻣل‬ ‫ﻗﺑل‬ ‫ﻣوﺟود‬ ‫ﻋﺑث‬ ‫أي‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﻋﻠﻰ‬ ‫ﻗﺎدر‬ server ‫ال‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﻣن‬ ‫ھﻧﺎ‬ ‫اﻟﻣراﺟﻊ‬
.auth user ‫ﻣن‬ ‫ﻗﺎدم‬ request ‫ال‬ ‫ھذه‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ھﻧﺎ‬ ‫ﻟﻠﺗﺣﻘق‬ ‫ﺷرط‬ ‫وأھم‬ ،‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻗواﻋد‬ ‫داﺧل‬ ‫ﺣﻔظﮭﺎ‬

●
‫ﻋﻠﻰ‬ ‫اﻟﺗﺣﺎﯾل‬ ‫اﻟطرق‬ ‫ھذه‬ ‫وإﺣدى‬ ،‫ﻛﺷﻔﮭم‬ ‫ﯾﺗم‬ ‫ﻻ‬ ‫ﺣﺗﻰ‬ ‫وﺟودھم‬ ‫ﺑﺈﺧﻔﺎء‬ ‫اﻟﻣﺧﺗرﻗﯾن‬ ‫ﯾﻘوم‬ ‫ﻣﺎ‬ ‫ﻋﺎدة‬ :Repudiation
.log ‫ال‬ ‫ﺗﻌدﯾل‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫أو‬ ‫اﻟﯾوزر‬ ‫ﻟﮭذا‬ ‫اﻟﺻﺣﯾﺢ‬ ‫اﻟﺗﺗﺑﻊ‬ ‫ﻣﻧﻊ‬ ‫ﺧﻼل‬ ‫ﻣن‬ log/track ‫ال‬ ‫ﻧظﺎم‬
●
‫ﻣن‬ ‫ﯾﻌد‬ ‫اﻟﻣﺳﺟﻠﯾن‬ ‫ﻟﻸﻋﺿﺎء‬ ‫واﻟﻣﮭﻣﺔ‬ ‫اﻟﺣﺳﺎﺳﺔ‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ ‫ﻛﺷف‬ ‫أو‬ ‫ﺳرﻗﺔ‬ :Information Disclosure
‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺑﺄن‬ ‫اﻟﺗﺄﻛد‬ ‫ﻓﻲ‬ ‫ھﻧﺎ‬ ‫ﻟﻠﻣراﺟﻊ‬ ‫ﺟدا‬ ‫ﻣﮭم‬ ‫دور‬ ‫ھﻧﺎك‬ ‫ﻟذﻟك‬ ،‫ﻣﺎ‬ ‫ﺑﺷرﻛﺔ‬ ‫ﺗﺗﺣﻘق‬ ‫ﻗد‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﺧﺎطر‬ ‫أﻛﺑر‬
‫وذﻟك‬ ،SQL Injection ‫ﻛﺎل‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻟﺛﻐرات‬ ‫ﻣن‬ ‫ﺧﻠوھﺎ‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ھذه‬ ‫ﺣﻣﺎﯾﺔ‬ ‫ﺗﺿﻣن‬
‫اﻟﺦ‬...query ‫وال‬ ،‫ﺻﺣﯾﺢ‬ ‫ﺑﺷﻛل‬ ‫وﺿﻌت‬ ‫أﻧﮭﺎ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻗواﻋد‬ ‫ﺻﻼﺣﯾﺎت‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫أﯾﺿﺎ‬ ‫ﯾﺷﻣل‬

●
‫أﺷد‬ ‫ﺣذرا‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫وﻣﺻﻣم‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻊ‬ :Denial of Service (DoS)
‫ﻷي‬ request ‫أي‬ ‫ﻣﻧﻊ‬ ‫ھﻲ‬ ‫اﻟﮭﺟﻣﺎت‬ ‫ھذه‬ ‫ﺣدة‬ ‫ﺗﻘﻠﯾل‬ ‫أو‬ ‫ﻟﺗﺟﻧب‬ ‫اﻟﻘواﻋد‬ ‫وأھم‬ ،Dos ‫ال‬ ‫ھﺟﻣﺎت‬ ‫ﻣن‬ ‫اﻟﺣذر‬
…‫ﻟﻠﺗﻧﻔﯾذ‬ ‫ﻋﺎﻟﯾﺔ‬ resource ‫و‬ ‫ﻟوﻗت‬ ‫ﯾﺣﺗﺎج‬ api/function ‫أي‬ ‫ﻋﻠﻰ‬ non-auth user
●
‫ﻋﻠﻰ‬ ‫ﺑﺗﻌدﯾل‬ ‫ﯾﻘوم‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫ﻻ‬ ‫ﺑﺎﻷﺳﻔل‬ ‫اﻟذي‬ ‫ﺑﺄن‬ ‫واﻟﺗﺣﻘق‬ ‫اﻟﺻﻼﺣﯾﺎت‬ ‫ﻧظﺎم‬ ‫ﺗﻘﯾﯾم‬ :Elevation of privilege
.‫واﺿﺣﺔ‬ ‫ﺗﺻﻧﯾﻔﺎت‬ ‫وﺿﻣن‬ ‫ﺑﺣذر‬ ‫اﻟﺻﻼﺣﯾﺎت‬ ‫ﺗﻘﺳﯾم‬ ‫وﯾﺟب‬ ،‫ﺻﻼﺣﯾﺔ‬ ‫ﻣﻧﮫ‬ ‫أﻋﻠﻰ‬ ‫ھو‬ ‫ﻣن‬

●
:Microsoft DREAD threat-risk ranking model
‫اﻟﻧﻣوذج‬ ‫ھذا‬ ‫ﯾﺳﺗﺧدم‬
‫ﺣﺳﺎب‬ ‫أو‬ ‫ﻟﺗﺣدﯾد‬
‫اﻟﺗﺄﺛﯾر‬ ‫ﻣﻌﺎﻣل‬
‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫واﻟﺧطورة‬
‫اﺳﺗﻐﻼل‬ ‫ﺳﮭوﻟﺔ‬
‫اﻛﺗﺷﺎﻓﮭﺎ‬ ‫أو‬ ‫اﻟﺛﻐرات‬
‫اﻟﺿرر‬ ‫وﻛﻣﯾﺔ‬
…‫ﻋﻠﯾﮭﺎ‬ ‫اﻟﻣﺗرﺗﺑﺔ‬

Determine countermeasures and mitigation :‫اﻟﺛﺎﻟﺛﺔ‬ ‫اﻟﺧطوة‬
‫اﻷﻣور‬ ‫ﻣن‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ھذه‬ ‫ﻣﺛل‬ ‫ﺣدوث‬ ‫ﻟﻣﻧﻊ‬ ‫اﻟﻼزﻣﺔ‬ ‫اﻟﺗداﺑﯾر‬ ‫اﺗﺧﺎذ‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻟﺗﻘﻧﯾﺔ‬ ‫أو‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺧﺎطر‬ ‫ﺗﺣدﯾد‬ ‫ﯾﻌد‬
:‫أﺳﺎﺳﯾﺔ‬ ‫طرق‬ 3 ‫ﺧﻼل‬ ‫ﻣن‬ ‫ھذه‬ ‫اﻟﺿﻌف‬ ‫ﻧﻘﺎط‬ ‫ﻣﻊ‬ ‫اﻟﺗﻌﺎﻣل‬ ‫وﯾﻣﻛن‬ ،‫اﻟﻣﺷروع‬ ‫ﻋﻠﻰ‬ ‫ﺗﺄﻛﯾد‬ ‫ﺑﻛل‬ ‫ﺳﺗؤﺛر‬ ‫واﻟﺗﻲ‬ ‫اﻟﻣﮭﻣﺔ‬
.1
.‫ﺧطورة‬ ‫اﻷﻗل‬ ‫إﻟﻰ‬ ‫اﻷﺧطر‬ ‫ﻣن‬ ‫وﺗرﺗﯾﺑﮭﺎ‬ ‫واﻟﻘوة‬ ‫اﻟﺿﻌف‬ ‫ﻧﻘﺎط‬ ‫ﺗﺣدد‬ ‫ﺧرﯾطﺔ‬ ‫ﺑﻧﺎء‬
.2
‫ﺗﺣﻣﻠﮭﺎ‬ ‫ﯾﻣﻛن‬ ‫ھذه‬ ‫اﻟﺧطورة‬ ‫ﻧﺳﺑﺔ‬ ‫ﺑﺎﻋﺗﺑﺎر‬ ‫ﻣﺎ‬ ‫ﻣﻛﺎن‬ ‫ﻓﻲ‬ ‫اﻟﻛﺎﺋن‬ ‫اﻟﺿﻌف‬ ‫ﻗﺑول‬ ‫ﻋﻠﻰ‬ ‫اﻟﻣؤﺳﺳﺎت‬ ‫ﺑﻌض‬ ‫ﺗﺗﻌﺎﻣل‬
‫ﺣﺎل‬ ‫ﻓﻲ‬ ‫ﻣﻌﮫ‬ ‫اﻟﺗﻌﺎﻣل‬ ‫وطرق‬ ‫ﺑﮭذا‬ ‫اﻟﻣﺳﺗﺧدﻣﯾن‬ ‫ﺗﻌﻠم‬ ‫ﺿواﺑط‬ ‫وﺿﻊ‬ ‫ﻣﻊ‬ ‫اﻟﻣﺷروع‬ ‫طﺑﯾﻌﺔ‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫ﻣﻌﮭﺎ‬ ‫واﻟﺗﻌﺎﻣل‬
.‫ﺣدوﺛﮫ‬
.3
‫اﻟﺧطورة‬ ‫ﻛﺎﻧت‬ ‫إذا‬ ‫اﻟﺣﺎﻟﺔ‬ ‫ھذه‬ ‫وﻓﻲ‬ ،‫اﺣﺗراز‬ ‫أي‬ ‫وﺑدون‬ ‫ﺗﻣﺎﻣﺎ‬ ‫اﻟﺿﻌف‬ ‫ﻧﻘﺎط‬ ‫ﺗﺟﺎھل‬ ‫ﻋﻠﻰ‬ ‫اﻟﻣؤﺳﺳﺎت‬ ‫ﺑﻌض‬ ‫ﺗﺗﻌﺎﻣل‬
‫اﻟﺗطﺑﯾق‬ ‫إﻏﻼق‬ ‫ﻓﺳﯾﺗم‬ ‫اﻟﺗطﺑﯾق‬ ‫ﻣن‬ ‫اﻟﻣرﺟوة‬ ‫اﻟﻣﻧﻔﻌﺔ‬ ‫ﻣن‬ ‫أﻛﺑر‬ ‫واﻟﺿرر‬

:‫اﻟﻔﺘﺢ‬ ‫ﺳﻮرة‬ ‫ﻓﻲ‬ ‫ﺗﻌﺎﻟﻰ‬ ‫ﻗﺎل‬
ُ
‫وه‬ ُ
‫ر‬ ِّ
‫ﺰ‬ َ
‫ﻌ‬ ُ
‫ﺗ‬ َ
‫و‬ ِ
‫ﻪ‬ ِ‫ﻮﻟ‬ ُ
‫ﺳ‬ َ
‫ر‬ َ
‫و‬ ِ
‫ﻪ‬ َّ‫ﺎﻟﻠ‬ ِ
‫ﺑ‬ ‫ﻮا‬ ُ
‫ﻨ‬ ِ
‫ﻣ‬ ْ
‫ﺆ‬ ُ
‫ﺘ‬ ِّ‫ﻟ‬ (8) ‫ا‬ ً
‫ﻳﺮ‬ ِ
‫ﺬ‬ َ
‫ﻧ‬ َ
‫و‬ ‫ا‬ ً
‫ﺮ‬ ِّ
‫ﺸ‬ َ
‫ﺒ‬ ُ
‫ﻣ‬ َ
‫و‬ ‫ا‬ ً‫ﺪ‬ ِ
‫ﺎﻫ‬ َ
‫ﺷ‬ َ
‫ﺎك‬ َ
‫ﻨ‬ ْ‫ﻠ‬ َ
‫ﺳ‬ ْ
‫ر‬َ‫أ‬ ‫ﺎ‬ َّ
‫ﻧ‬ِ‫"إ‬
" ً
‫ﻴﻼ‬ ِ
‫ﺻ‬َ‫أ‬ َ
‫و‬ ً
‫ة‬ َ
‫ﺮ‬ْ‫ﻜ‬ ُ
‫ﺑ‬ ُ
‫ﻮه‬ ُ
‫ﺤ‬ ِّ
‫ﺒ‬ َ
‫ﺴ‬ ُ
‫ﺗ‬ َ
‫و‬ ُ
‫وه‬ ُ
‫ﺮ‬ ِّ
‫ﻗ‬ َ
‫ﻮ‬ ُ
‫ﺗ‬ َ
‫و‬
‫ﻣﺴﻠﻢ‬ ‫ﻛﻞ‬ ‫ﻋﻠﻰ‬ ‫واﺟﺒﺔ‬ ‫وﺳﻠﻢ‬ ‫ﻋﻠﻴﻪ‬ ‫ﷲ‬ ‫ﺻﻠﻰ‬ ‫اﻟﺮﺳﻮل‬ ‫ﻧﺼﺮة‬ ‫أن‬ ‫أﺧﻲ‬ ‫ﻳﺎ‬ ‫ﻓﻠﺘﻌﻠﻢ‬
‫وﻏﻄﺮﺳﺘﻬﺎ‬ ‫ﻓﺮﻧﺴﺎ‬ ‫ﻧﺬاﻟﺔ‬ ‫أﻣﺎم‬ ‫اﻵن‬ ‫ﻋﻠﻴﻪ‬ ‫ﻧﻘﺪر‬ ‫ﻣﺎ‬ ‫وأﺑﺴﻂ‬ ،‫ﻋﻠﻴﻪ‬ ‫ﻳﻘﺪر‬ ‫وﻓﻴﻤﺎ‬
‫واﻟﻌﻤﻞ‬ ،‫اﻟﺴﺒﻞ‬ ‫ﺑﻜﻞ‬ ‫ﻣﻘﺎﻃﻌﺘﻬﺎ‬ ‫ﻫﻮ‬ ‫واﻟﻤﺴﻠﻤﻴﻦ‬ ‫اﻹﺳﻼم‬ ‫ﻋﻠﻰ‬ ‫وﺣﺮﺑﻬﺎ‬
‫إﻻ‬ ‫ﻗﻮة‬ ‫وﻻ‬ ‫ﺣﻮل‬ ‫وﻻ‬ ،‫ﻗﻮة‬ ‫ﻣﻦ‬ ‫أوﺗﻴﻨﺎ‬ ‫ﻣﺎ‬ ‫ﺑﻜﻞ‬ ‫اﻟﻘﺮن‬ ‫ﻫﺬا‬ ‫ﻋﺒﻮدﻳﺔ‬ ‫ﻣﻦ‬ ‫ﻟﻠﺨﺮوج‬
…‫ﺑﺎﻟﻠﻪ‬
:‫اﻟﺘﻮﺑﺔ‬ ‫ﺳﻮرة‬ ‫ﻓﻲ‬ ‫ﺗﻌﺎﻟﻰ‬ ‫ﻗﺎل‬
ُ
‫ه‬ َ
‫ﺮ‬ َ
‫ﺼ‬ َ
‫ﻧ‬ ْ‫ﺪ‬ َ
‫ﻘ‬ َ
‫ﻓ‬ ُ
‫وه‬ ُ
‫ﺮ‬ ُ
‫ﺼ‬ ْ
‫ﻨ‬ َ
‫ﺗ‬ َّ
‫ﻻ‬ِ‫إ‬ "
" ِ‫ﺎر‬ َ
‫ﻐ‬ ْ‫اﻟ‬ ‫ﻲ‬ ِ
‫ﻓ‬ ‫ﺎ‬ َ
‫ﻤ‬ ُ
‫ﻫ‬ ْ‫ذ‬ِ‫إ‬ ِ
‫ﻦ‬ ْ
‫ﻴ‬ َ
‫ﻨ‬ ْ
‫اﺛ‬ َ‫ﻲ‬ ِ
‫ﺎﻧ‬ َ
‫ﺛ‬ ‫وا‬ ُ
‫ﺮ‬ َ
‫ﻔ‬ َ‫ﻛ‬ َ
‫ﻳﻦ‬ ِ
‫ﺬ‬ َّ‫اﻟ‬ ُ
‫ﻪ‬ َ
‫ﺟ‬ َ
‫ﺮ‬ ْ
‫ﺧ‬َ‫أ‬ ْ‫ذ‬ِ‫إ‬ َُّ‫ﷲ‬

Metri and Code Review
‫اﻟﺷﯾﻔرة‬ ‫ﻓﻲ‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﻌدل‬ ‫ﺣﺳﺎب‬ ‫ﺧﻼﻟﮭﺎ‬ ‫ﻣن‬ ‫ﯾﻣﻛن‬ ‫واﺿﺣﺔ‬ ‫طرﯾﻘﺔ‬ ‫ھﻧﺎك‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﻓﯾﺟب‬ ‫ﺳﺎﺑﻘﺎ‬ ‫ذﻛرﻧﺎه‬ ‫ﻣﺎ‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬
‫اﻟﺧﺻﺎﺋص‬ ‫ﻣن‬ ‫واﻟﻌدﯾد‬ ‫إﺳﺗﺧداﻣﮭﺎ‬ ‫وإﻋﺎدة‬ ‫وﻧﻘﻠﮭﺎ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ھذه‬ ‫ﺗﻌدﯾل‬ ‫ﻋﻠﻰ‬ ‫واﻟﻘدرة‬ ‫اﻟﺟودة‬ ‫وﻣﺳﺗوى‬ ‫اﻟﺑرﻣﺟﯾﺔ‬
:‫وھﻲ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻋﻧد‬ ‫ﻣﻧﮭﺎ‬ ‫اﻻﻧطﻼق‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻟﺧﺻﺎﺋص‬ ‫أھم‬ ‫ھﻧﺎ‬ ‫ﺳﻧذﻛر‬ ‫ﻟذﻟك‬ ،‫اﻷﺧرى‬
●
(‫ﻻﺗﺣﺳب‬ comments ‫ال‬ ‫وأﺳطر‬ ‫اﻟﻔﺎرﻏﺔ‬ ‫)اﻷﺳطر‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻷﺳطر‬ ‫ﻋدد‬ :LOC
●
‫وﺗﺧﺗﻠف‬ ،‫اﻟﻣﺷروع‬ ‫ﻓﻲ‬ ‫ﻣﺣددة‬ ‫ﻣﮭﻣﺔ‬ ‫ﺑﺗﻧﻔﯾذ‬ ‫ﺗﻘوم‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻷﺳطر‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫وھﻲ‬ :Function Point
.Function Point ‫ال‬ Class ‫ال‬ ‫ﯾﻣﺛل‬ OOP ‫ﺑﺎل‬ ‫ﻓﻣﺛﻼ‬ ،‫اﻟﺑرﻣﺟﺔ‬ ‫ﻟﻐﺔ‬ ‫اﺧﺗﻼف‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫ھذه‬

●
‫أﺣد‬ ‫أو‬ ‫اﻟﺑرﻧﺎﻣﺞ‬ ‫ﻓﻲ‬ ‫اﻛﺗﺷﺎﻓﮭﺎ‬ ‫ﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣؤﻛدة‬ ‫اﻟﻌﯾوب‬ ‫ﻋدد‬ ‫إﻟﻰ‬ ‫اﻟﻣﺻطﻠﺢ‬ ‫ھذا‬ ‫ﯾﺷﯾر‬ :Defect Density
‫ﻣﺳﺗوى‬ ‫وﻟﺣﺳﺎب‬ ،(LOC) ‫اﻟﺑرﻧﺎﻣﺞ‬ ‫ﺣﺟم‬ ‫ﻋﻠﻰ‬ ‫ًﺎ‬‫ﻣ‬‫ﻣﻘﺳو‬ ،‫اﻟﺗﺷﻐﯾل‬ ‫أو‬ ‫اﻟﺗطوﯾر‬ ‫ﻣن‬ ‫ﻣﺣددة‬ ‫ﻓﺗرة‬ ‫ﺧﻼل‬ ‫اﻟﻣﻛوﻧﺎت‬
:(‫اﻟﺷرﯾﺣﺔ‬ ‫ھذه‬ ‫ﺑﻌد‬ ‫ﻣﺛﺎﻻ‬ ‫)ﺳﻧذﻛر‬ ‫اﻟﻣﻌﺎدﻟﺔ‬ ‫ھذه‬ ‫ﺗﻧﻔﯾذ‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗطﺑﯾق‬ ‫ﻓﻲ‬ (‫واﻟﻣﺷﺎﻛل‬ ‫اﻟﻌﯾوب)اﻟﺧﻠل‬ ‫ﻛﺛﺎﻓﺔ‬
Defect Density = Defect count/size of the release
●
‫إﻟﻰ‬ ‫وﺗﻘﺳم‬ ‫اﻟﺳﺎﺑﻘﺔ‬ ‫اﻟﻧﻘﺎط‬ ‫ﺿﻣن‬ ‫اﻟﻣﺗﺣﻘﻘﺔ‬ ‫اﻟﻣﺧﺎطر‬ ‫ﻛﺛﺎﻓﺔ‬ ‫ﻣﻘدار‬ ‫إﻟﻰ‬ ‫ﯾﺷﯾر‬ ‫ﻣﺻطﻠﺢ‬ ‫وھو‬ :Risk Density
:‫ﺑﺎﻵﺗﻲ‬ ‫ﺗﻣﺛﯾﻠﮭﺎ‬ ‫وﯾﻣﻛن‬ Low, Medium and High
Risk Level / LOC OR Risk Level / Function Point
Example:
4 High Risk Defects per 1000 (Lines of Code)
2 Medium Risk Defects per 3 Function Points

:‫ﻣﺛﺎل‬
:‫ﺑﺎﻵﺗﻲ‬ release ‫ال‬ ‫ﻟﮭذه‬ ‫اﻷﺧطﺎء‬ ‫ﻛﺛﺎﻓﺔ‬ ‫ﺣﺳﺎب‬ ‫ﯾﻣﻛﻧﻧﺎ‬ ‫اﻟﺳﺎﺑق‬ ‫اﻟﺟدول‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬
Defect Density = 40 / 6000= 0.00666666667=> ‫ﻟل‬ ‫اﻟﻛﺛﺎﻓﺔ‬ ‫ﻣﺳﺗوى‬ ‫ھذه‬ release
‫ﻓﻘط‬ ‫وھذا‬ ،‫ﻣﻣﺗﺎز‬ ‫رﻗم‬ ‫وھذا‬ release 0.00666 ‫ال‬ ‫ﻟﮭذه‬ ‫اﻷﺳطر‬ ‫ﻟﻣﺟﻣوع‬ ‫ﺑﺎﻟﻧﺳﺑﺔ‬ ‫اﻷﺧطﺎء‬ ‫ﻛﺛﺎﻓﺔ‬ ‫أن‬ ‫ﯾﻌﻧﻲ‬ ‫وھذا‬
.‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺟودة‬ ‫ﻋن‬ ‫ﻋﺎﻣﺎ‬ ‫اﻧطﺑﺎﻋﺎ‬ ‫ﯾﻌطﻲ‬ ‫ﻣؤﺷر‬
‫ﻣن‬ ‫اﻟرﻗم‬ ‫اﻗﺗرب‬ ‫وﻛﻠﻣﺎ‬ ،‫أﺳوأ‬ ‫ﻛﺎن‬ ‫ﻛﻠﻣﺎ‬ ‫اﻟرﻗم‬ ‫ﻛﺑر‬ ‫ﻛﻠﻣﺎ‬ ‫ﻟﻛن‬ ،‫اﻷﺳوأ‬ ‫أو‬ ‫اﻷﻓﺿل‬ ‫ﻟﺗﺣدﯾد‬ ‫ﻣﺣدد‬ ‫رﻗم‬ ‫ﯾوﺟد‬ ‫ﻻ‬ :‫ﻣﻼﺣظﺔ‬
.‫أﻓﺿل‬ ‫ﻛﺎن‬ ‫ﻛﻠﻣﺎ‬ ‫اﻟﺻﻔر‬
Module LOC Number of Detected Bugs
A 1000 5
B 3000 25
C 2000 10
Totals 6000 40

:‫ﯾﻌﻧﻲ‬ KLOC ‫وال‬ ،KLOC ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫وذﻟك‬ ‫اﻷﺧطﺎء‬ ‫ﻛﺛﺎﻓﺔ‬ ‫ﺑﻣﺳﺗوى‬ ‫اﻟﺧﺎص‬ avg ‫ال‬ ‫ﺣﺳﺎب‬ ‫ﯾﻣﻛن‬ ‫ﻛﻣﺎ‬
Short for thousands (kilo) of lines of code. KLOC is a measure of the size of a
computer program
:‫ھﻲ‬ ‫ﻓﺎﻟﻧﺗﯾﺟﺔ‬ ‫اﻟﺳﺎﺑق‬ ‫ﻟﻠﻣﺛﺎل‬ ‫وﺑﺎﻟﻧﺳﺑﺔ‬
KLOC = 40 / 6 = 6.6666 for Every 1KLOC

:Cyclomatic complexity (CC)
‫وﻗﺎﺑﻠﯾﺗﮫ‬ ‫واﻟﻔﮭم‬ ‫ﻟﻼﺧﺗﺑﺎر‬ ‫اﻟﺑرﻧﺎﻣﺞ‬ ‫ﻗﺎﺑﻠﯾﺔ‬ ‫إﻟﻰ‬ ‫ﻟﻺﺷﺎرة‬ McCabe ‫ﻣن‬ (CC) ‫اﻟﺳﯾﻛﻠوﻣﻲ‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﻘﯾﺎس‬ ‫ﺗﺻﻣﯾم‬ ‫ﺗم‬
‫ﻣن‬ ‫اﻟﺳﯾﻛﻠوﻣﻲ‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﺳﺗوى‬ ‫ﺣﺳﺎب‬ ‫وﯾﻣﻛن‬ ،‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﺳﺗوى‬ ‫ﻟﺣﺳﺎب‬ ‫واﻟﺑﺳﯾطﺔ‬ ‫اﻟﺳﮭﻠﺔ‬ ‫اﻟﻣﻘﺎﯾﯾس‬ ‫ﻣن‬ ‫وھو‬ ،‫ﻟﻠﺻﯾﺎﻧﺔ‬
:‫اﻟﻣﻌﺎدﻟﺔ‬ ‫ھذه‬ ‫ﺧﻼل‬
CC = Number of decisions +1
if/else, switch, case, catch, while, do, templated ‫ﺗﻣﺛل‬ Number of decisions ‫ال‬ ‫ﺑﺣﯾث‬
‫آﺧره‬ ‫إﻟﻰ‬...class calls
:‫اﻟﺟدول‬ ‫ھذا‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫ﺗﺻﻧﯾﻔﮭﺎ‬ ‫ﯾﻣﻛن‬ ‫اﻟﺳﺎﺑﻘﺔ‬ ‫اﻟﻣﻌﺎدﻟﺔ‬ ‫ﻧﺗﯾﺟﺔ‬
Value Range Description
0-10 Stable code, acceptable complexity
11-15 Medium Risk, more complex
16-20 High Risk code, too many decisions for a unit of code.

‫وﻓﺻﻠﮭﺎ‬ ‫أﻓﺿل‬ ‫ﺑﺷﻛل‬ ‫ﻛﺗﺎﺑﺗﮭﺎ‬ ‫وإﻋﺎدة‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫أﺟزاء‬ ‫ﺑﻔﺻل‬ ‫اﻟﻘرار‬ ‫اﺗﺧﺎذ‬ ‫ﯾﺗم‬ ‫اﻟﺳﺎﺑق‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﺳﺗوى‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬
!‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﺳﺗوى‬ ‫ﻣن‬ ‫ﻟﻠﺗﻘﻠﯾل‬ ‫ﻣﺳﺗﻘﻠﺔ‬ method ‫إﻟﻰ‬
:‫اﻟﺳﺎﺑﻘﺔ‬ ‫اﻟﻌﻣﻠﯾﺔ‬ ‫ﻟﺣﺳﺎب‬ 1 ‫ﻣﺛﺎل‬
:‫ھو‬ ‫اﻟﻧﺎﺗﺞ‬ ‫ﯾﻛون‬ ‫اﻟﺳﺎﺑﻘﺔ‬ ‫اﻟﻣﻌﺎدﻟﺔ‬ ‫ﻋﻠﻰ‬ ‫وﺑﻧﺎءا‬ ‫اﻟﻣﺛﺎل‬ ‫ھذا‬ ‫ﻓﻲ‬
CC = 2 + 1 = 3
.‫ﻣﻌﻘدة‬ ‫ﻏﯾر‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫و‬ ‫ﺟﯾد‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﺳﺗوى‬ ‫إذا‬ ،10 ‫ﻣن‬ ‫أﻗل‬ 3 ‫ال‬
IF A = 10 THEN
IF B > C THEN
A = B
ELSE
A = C
ENDIF
ENDIF
Print A
Print B
Print C

:2 ‫ﻣﺛﺎل‬
CC = 2 + 1 = 3
‫ﺟﯾد‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﺳﺗوى‬ ‫إذا‬ ،10 ‫ﻣن‬ ‫أﻗل‬ 3 ‫ال‬
.‫ﻣﻌﻘدة‬ ‫ﻏﯾر‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫و‬
‫ﻟذﻟك‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﺳﺗوى‬ ‫ﻣن‬ ‫ﯾزﯾد‬ ‫ﻣﺳﺗﻘل‬ ‫ﺷرط‬ ‫ﺗﻌﺗﺑر‬ else if ‫ﻛل‬ :‫ﻣﻼﺣظﺔ‬
if/else = 1 + else if = 1 then = 2
‫وﻟك‬...‫ذﻛرﻧﺎه‬ ‫ﻣﺎ‬ ‫اﻋﺗﻣدﻧﺎ‬ ‫ﻟﻛﻧﻧﺎ‬ CC = E - N + 2 ‫اﻟﺗﻣﺛﯾل‬ ‫ھذا‬ ‫ﻣﺛﺎل‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻟﺣﺳﺎب‬ ‫ﺗﻣﺛﯾل‬ ‫ﻣن‬ ‫أﻛﺛر‬ ‫ﺗﺟد‬ ‫ﻗد‬ :‫ﻣﻼﺣظﺔ‬
...‫ﻟك‬ ‫ﻣﻧﺎﺳﺑﺔ‬ method ‫أي‬ ‫ﻋن‬ ‫اﻟﺑﺣث‬ ‫ﻓﻲ‬ ‫اﻟﺣرﯾﺔ‬
Function doSomething ()
{
if (condition1){
// statements
} else if (condition2){
// statements
} else {
// statements
}
}

:‫ﻛﺎﻵﺗﻲ‬ ‫ﺗﻛون‬ ‫اﻷﺧطﺎء‬ ‫أﺣد‬ ‫ﺗﺻﺣﯾﺢ‬ ‫ﻋﻧد‬ ‫ﺧطﺄ‬ ‫ﺣدوث‬ ‫اﺣﺗﻣﺎﻟﯾﺔ‬ ‫ﻓﺈن‬ ،‫اﻟﺗﻌﻘﯾد‬ ‫ﺑﻣﺳﺗوى‬ ‫اﻟﺧﺎص‬ ‫اﻟﺟدول‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬
Value Range Ratio
0-10 5%
20-30 20%
> 50 40%
Approaching 100 60%

‫اﻟﻣراﺟﻌﺔ‬ ‫أﺛﻧﺎء‬ ‫ﻟﮭﺎ‬ ‫اﻹﻧﺗﺑﺎه‬ ‫ﯾﺟب‬ ‫ﻣﺗوﻗﻌﺔ‬ ‫ﻏﯾر‬ ‫ﻧﻘﺎط‬
‫ﻣﺑﺎﺷرا‬ ‫ﺗﺄﺛﯾرھﺎ‬ ‫ﯾﻛن‬ ‫ﻟم‬ ‫وإن‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻋﻠﻰ‬ ‫اﻟﻌﻣل‬ ‫أﺛﻧﺎء‬ ‫ﻣﮭﻣﺎ‬ ‫ﻓﺎرﻗﺎ‬ ‫ﺗﺷﻛل‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﮭﻣﺔ‬ ‫اﻟﻧﻘﺎط‬ ‫ﻣن‬ ‫اﻟﻌدﯾد‬ ‫ذﻛرﻧﺎ‬ ‫ﻟﻘد‬
‫ﺗﻌﻣل‬ ‫ﻛﺎﻧت‬ ‫وإن‬ ‫ﻣﻌﯾﻧﺔ‬ ‫ﻟوظﯾﻔﺔ‬ ‫رﻓﺿﮭﺎ‬ ‫ﯾﻣﻛن‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫أن‬ ‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫اﻷﻣﺛﻠﺔ‬ ‫وﻣن‬ !‫ﺑذاﺗﮭﺎ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻋﻠﻰ‬
!‫ﺑﺎﻟﺷرﻛﺔ‬ ‫اﻟﺧﺎﺻﺔ‬ Privacy & Policy ‫ال‬ ‫أو‬ Terms & condition ‫ال‬ ‫ﺳﯾﺎﺳﺔ‬ ‫ﺧﺎﻟﻔت‬ ‫إن‬
‫ﻣن‬ ‫ﺗرﻓﻊ‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﻠﻔﺎت‬ ‫وأﺳﻣﺎء‬ ،‫اﻟﻧظﺎم‬ ‫ﻣﻊ‬ ‫اﻟﺗﻌﺎﻣل‬ ‫أﺛﻧﺎء‬ ‫إﺳﺗﺧداﻣﮭﺎ‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫ﻟﻠﻐﺎت‬ ‫اﻹﻧﺗﺑﺎه‬ ‫ﯾﺟب‬ ‫ﻛﻣﺎ‬
!‫اﻟﻣﻠﻔﺎت‬ ‫ھذه‬ ‫ﻟﺗﺳﻣﯾﺔ‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ ‫واﻟﻠﻐﺔ‬ ‫اﻟﺗطﺑﯾق‬ ‫ﺧﻼل‬
‫ﻧﻘﺎط‬ ‫إﺣدى‬ ‫ﻓﻲ‬ ‫ﺗﻘﺑﻊ‬ ‫ﻻ‬ ‫اﻟﻣزﯾﺔ‬ ‫ھذه‬ ‫أن‬ ‫ﻣن‬ ‫واﻟﺗﺄﻛد‬ ‫اﻟﺗطﺑﯾق‬ ‫ﻓﻲ‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ ‫اﻟﻣﻛﺎﺗب‬ ‫أو‬ ‫اﻟﺑرﻣﺟﺔ‬ ‫ﻟﻠﻐﺎت‬ ‫اﻹﻧﺗﺑﺎه‬ ‫ﯾﺟب‬ ‫ﻛﻣﺎ‬
‫أﻛﺑر‬ ‫إﻟﻰ‬ ‫واﻟوﺻول‬ ‫اﻟﺿﻌف‬ ‫ھذا‬ ‫ﺳد‬ ‫ﯾﻣﻛن‬ ‫ﻛﯾف‬ ‫اﺳﺗﺧدﻣﮭﺎ‬ ‫إﻟﻰ‬ ‫وﻧﺣﺗﺎج‬ ‫ﻛذﻟك‬ ‫ﻛﺎﻧت‬ ‫وإن‬ !‫اﻟﺑرﻣﺟﺔ‬ ‫ﺑﻠﻐﺔ‬ ‫اﻟﺧﺎﺻﺔ‬ ‫اﻟﺿﻌف‬
‫ﻓﻘم‬ ‫ﻣﺗوﻗﻌﺎ‬ ‫أﻣرا‬ ‫ﺗﺧﺎﻟف‬ ‫أن‬ ‫وﯾﻣﻛن‬ ‫ﻣﺗوﻗﻌﺔ‬ ‫ﻏﯾر‬ ‫ﻧﺗﯾﺟﺔ‬ ‫أي‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫رأﯾت‬ ‫ﻟﮭﺎ…ﻓﺈذا‬ ‫اﻟﻣوﺛوﻗﯾﺔ‬ ‫ﻣن‬ ‫ﻗدر‬
...‫اﻟرﻓض‬ ‫أو‬ ‫اﻟﻣواﻓﻘﺔ‬ ‫ﻗﺑل‬ ‫ﻗﻠﯾﻼ‬ ‫ﺑﺎﻟﺗوﻗف‬

Injections ‫ال‬
‫اﻟﺗطﺑﯾق‬ ‫ﺳﻠوك‬ ‫ﻟﺗﻌدﯾل‬ ‫اﻷواﻣر‬ ‫ﻣن‬ ‫ﺑﻣﺟﻣوﻋﺔ‬ ‫ﻣﺣﺗوى‬ ‫ﺣﻘن‬ ‫أو‬ ‫إﺿﺎﻓﺔ‬ ‫ﻣن‬ ‫ﻣﺎ‬ ‫ﻟﻣﺳﺗﺧدم‬ injection ‫ال‬ ‫ھﺟﻣﺎت‬ ‫ﺗﺳﻣﺢ‬
‫ﺗطﺑﯾق‬ ‫أي‬ ‫ﻛﺎن‬ ‫ﻣﺎ‬ ‫إذا‬ ‫اﺧﺗﺑﺎر‬ ‫ﻣن‬ Attacker ‫أي‬ ‫ﻋﻠﻰ‬ ‫وﯾﺳﮭل‬ ،‫اﻻﻧﺗﺷﺎر‬ ‫وواﺳﻊ‬ ‫ﺷﺎﺋﻊ‬ ‫اﻟﮭﺟﻣﺎت‬ ‫ﻣن‬ ‫اﻟﻧوع‬ ‫ھذا‬ .‫اﻷﺻﻠﻲ‬
‫ﻣﺛل‬ ‫ﺛﻧﺎﯾﺎھﺎ‬ ‫ﻓﻲ‬ ‫وﺗﺣﺗوي‬ ‫ﺗﺣدﯾﺛﮭﺎ‬ ‫ﯾﺗم‬ ‫ﻟم‬ ‫اﻟﺗﻲ‬ ‫اﻟﺗطﺑﯾﻘﺎت‬ ‫ﻛﻣﯾﺔ‬ ‫أن‬ ‫وﻟﺗﻌﻠم‬ ،‫ﻻ‬ ‫أم‬ ‫ﻣﻧﮫ‬ ‫ﻟﻼﺳﺗﻔﺎدة‬ ‫ﻟﻠﻣﮭﺎﺟم‬ ‫وﯾﺳﮭل‬ ‫ﺿﻌﯾف‬ ‫وﯾب‬
SQL ‫ال‬ ‫اﻹﺧﺗراﻗﺎت‬ ‫ھذه‬ ‫أﺷﮭر‬ ‫ﻣن‬ ‫واﺣدة‬ injections ‫ال‬ ‫أﻧواع‬ ‫ﻣن‬ ‫اﻟﻌدﯾد‬ ‫ھﻧﺎك‬ ،…‫ﻛﺛﯾرة‬ ‫اﻟﺛﻐرات‬ ‫ھذه‬
injections
:injection ‫ال‬ ‫أﻧواع‬
SQL, LDAP, Xpath, OS commands, XML parsers, Code injection, Email header
...‫ﺗﻠﯾﮭﺎ‬ ‫واﻟﺗﻲ‬ ‫اﻟﻘﺎدﻣﺔ‬ ‫اﻟﺷرﯾﺣﺔ‬ ‫ﻓﻲ‬ ‫ﺑﻌﺿﮭﺎ‬ ‫ﺳﻧذﻛر‬ ،‫آﺧره‬ ‫إﻟﻰ‬...injection

‫اﻟﻣﺣﺗﻣل‬ ‫اﻟﺗﺄﺛﯾر‬ ‫اﻟوﺻف‬ Injection Attack ‫ال‬ ‫ﻧوع‬
..‫اﻟﺗطﺑﯾق‬ ‫أو‬ ‫اﻟﻧظﺎم‬ ‫ﻛﺎﻣل‬ ‫ﻋﻠﻰ‬
:‫ﻣﺛﻼ‬
eval("$_GET[....];");
‫اﻟﺗﻲ‬ ‫اﻟﻠﻐﺔ‬ ‫ﻣﻊ‬ ‫ﻣﺗواﻓﻘﺔ‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫ﺣﻘن‬ ‫ﯾﺗم‬
‫إﻟﻰ‬ ‫ﻟﻠوﺻول‬ ‫ﺧﻼﻟﮭﺎ‬ ‫ﻣن‬ ‫اﻟﺗطﺑﯾق‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﺗم‬
‫ﻋﻠﻰ‬ ‫اﻟظروف‬ ‫اﺳوأ‬ ‫ﻓﻲ‬ ‫ﺗﻣﻛﻧﮫ‬ ‫ﻣﻌﯾﻧﺔ‬ ‫ﺻﻼﺣﯾﺔ‬
‫ﻛﺎﻣل‬ ‫اﻟﺳﯾرﻓر‬ ‫ﻓﻲ‬ ‫اﻟﺗﺣﻛم‬
Code injection
‫ﺷﺧﺻﯾﺔ‬ ‫اﻧﺗﺣﺎل‬ ‫ھو‬ ‫ﯾﻛون‬ ‫ﻗد‬ ‫ﺗﺄﺛﯾر‬ ‫أﺧطر‬
‫ﺑﮫ‬ ‫اﻟﺧﺎص‬ token ‫ال‬ ‫ﺳرﻗﺔ‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﻌﻣﯾل‬
‫اﻟﻘﯾﺎم‬ ‫ﻓﻲ‬ injection ‫ال‬ ‫ھذا‬ ‫اﺳﺗﻐﻼل‬ ‫أو‬ ‫ﻣﺛﺎﻻ‬
‫ﻣﺛﻼ‬ ‫ﻋﺷواﺋﯾﺔ‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫ﺗﻧﻔﯾذ‬ ‫أو‬ ‫ﺑﻌﻣﻠﯾﺎت‬
...‫ﻧﮭﺎﯾﺔ‬ ‫ﻻ‬ ‫ﻣﺎ‬ ‫إﻟﻰ‬ reload
client ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫ﺣﻘن‬ ‫ﯾﺗم‬
‫ﻣن‬ ‫اﻟﻣﺳﺗﺧدﻣﯾن‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫إﻟﻰ‬ ‫ﻟﻠوﺻول‬ side
‫ﻋﻣﻠﯾﺎت‬ ‫وأﺷﮭر‬ ،‫اﻟوﯾب‬ ‫ﺗطﺑﯾق‬ ‫اﺳﺗﺧدام‬ ‫ﺧﻼل‬
‫ﻓﻲ‬ ‫ﻻﻧﺗﺷﺎرھﺎ‬ JS ‫ال‬ ‫ﻣﺳﺗوى‬ ‫ﻋﻠﻰ‬ ‫ﺗﺗم‬ ‫اﻟﺣﻘن‬
...‫اﻟﻣواﻗﻊ‬ ‫أﻛﺛر‬
Cross-site Scripting (XSS)
‫ﺧﻼل‬ ‫ﻣن‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫وﺟﻣﻊ‬ spam ‫إرﺳﺎل‬
‫اﻹﯾﻣﯾل‬ ‫ﻣرﺳل‬ ‫ﺷﺧﺻﯾﺔ‬ ‫اﻧﺗﺣﺎل‬
‫ﺑﺎل‬ ‫اﻟﺧﺎص‬ header ‫ال‬ ‫ﺑﺣﻘن‬ ‫اﻟﻣﺧﺗرق‬ ‫ﯾﻘوم‬
email
Email Header Injection

‫اﻟﻣﺣﺗﻣل‬ ‫اﻟﺗﺄﺛﯾر‬ ‫اﻟوﺻف‬ Injection Attack ‫ال‬ ‫ﻧوع‬
‫أو‬ ‫واﺳﺗﻐﻼﻟﮭﺎ‬ ‫اﻷﻋﺿﺎء‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫إﻟﻰ‬ ‫اﻟوﺻول‬
‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﺗطﺑﯾق‬ ‫ﻋﻠﻰ‬ ‫اﻟﺻﻼﺣﯾﺎت‬ ‫وﺗﺟﺎوز‬
‫اﻟدﺧول‬ ‫ﺗﺳﺟﯾل‬ ‫أو‬ ‫ﻟﻧﻔﺳﮫ‬ ‫اﻟﺻﻼﺣﯾﺔ‬ ‫ﺗﻌدﯾل‬
...‫اﻵﺧرﯾن‬ ‫اﻷﻋﺿﺎء‬ ‫ﺑﺣﺳﺎﺑﺎت‬
‫ال‬ ‫ﺑﺑﻌض‬ ‫ﺑروﺗوﻛول‬ LDAP ‫ال‬ ‫ﺣﻘن‬
‫ﻟﺗﻌدﯾل‬ ‫ﺗﻧﻔﯾذھﺎ‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ command
...‫ﺻﻼﺣﯾﺔ‬ ‫إﻋطﺎء‬ ‫أو‬ tree ‫ال‬ ‫ﻓﻲ‬ ‫اﻟﻣﺣﺗوى‬
LDAP Injection
‫ﺑﺄﺳوء‬ ‫ﻛﺎﻣﻼ‬ ‫اﻟﻧظﺎم‬ ‫ﻓﻲ‬ ‫اﻟﺗﺣﻛم‬ ‫ﻟﻠﻣﮭﺎﺟم‬ ‫ﯾﻣﻛن‬
:PHP ‫اﻷﺣوال…ﻣﺛﺎل‬
system("rm $file");
،OS ‫ال‬ ‫ﻋﻠﻰ‬ ‫ﻟﺗﻧﻔﯾذھﺎ‬ command ‫ﺣﻘن‬ ‫ﯾﺗم‬
‫أﻧﮭﺎ‬ code injection ‫ال‬ ‫ﻋن‬ ‫ھذه‬ ‫وﺗﺧﺗﻠف‬
‫ال‬ ‫طرﯾق‬ ‫ﻋن‬ ‫وﻟﯾس‬ OS ‫ال‬ ‫طرﯾق‬ ‫ﻋن‬ ‫ﺗﻧﻔذ‬
(command ‫ﻟل‬ ‫…)ﻛﺗﻧﻔﯾذ‬application
OS Command Injection
‫اﻟﻣﮭﺎﺟم‬ ‫اﺣﺗراف‬ ‫ﻣدى‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎﺋﺎ‬ ‫ﺟدا‬ ‫ﻛﺑﯾر‬ ‫اﻟﺗﺄﺛﯾر‬
‫ﻛﺎﻣﻼ‬ ‫ﺑﺎﻟﻧظﺎم‬ ‫ﻟﻠﺗﺣﻛم‬ ‫وﺻوﻻ‬
SQL Statement ‫ﺑﺣﻘن‬ ‫اﻟﻣﮭﺎﺟم‬ ‫ھﻧﺎ‬ ‫ﯾﻘوم‬ SQL Injection

Client Side - Security Guide (Hints)
●
‫ﺗﺳﻠﺳل‬ ‫أو‬ ‫اﻟﻣﺷروع‬ ‫ﺗﺻﻣﯾم‬ ‫طرﯾﻘﺔ‬ ‫ﻓﻲ‬ ‫ﻣﻌﯾﻧﺔ‬ ‫ﻣﺷﻛﻠﺔ‬ ‫ھﻧﺎك‬ ‫أن‬ ‫ﻓﺎﻋﻠم‬ ‫اﺳﺗﺧدﻣﺗﮭﺎ‬ ‫ﻓﺈن‬ ،‫ﻧﮭﺎﺋﯾﺎ‬ eval ‫ﺗﺳﺗﺧدم‬ ‫ﻻ‬
...‫اﻟﻣرﺣﻠﺔ‬ ‫ﻟﮭذه‬ ‫ﺗﺻل‬ ‫ﺟﻌﻠﺗك‬ ‫اﻟﺗﻲ‬ ‫اﻹﺟراءات‬
●
innerHtml ‫ﻣن‬ ‫ﺑدﻻ‬ createTextNode ‫أو‬ innerText ‫ال‬ ‫اﺳﺗﺧدم‬
●
‫إﺟراء‬ ‫أي‬ ‫اﺗﺧﺎذ‬ ‫ﻗﺑل‬ ‫دوﻣﺎ‬ JSON response ‫ال‬ ‫ﻣﻊ‬ JSON.parse ‫ال‬ ‫اﺳﺗﺧدم‬
●
‫ال‬ ‫ﻣﺛل‬ ‫ﻋﻧﺻر‬ ‫ﺑﺄي‬ ‫اﻟﺧﺎص‬ ‫اﻟﻣﺣﺗوى‬ ‫إﻟﻰ‬ Untrusted Data ‫أي‬ ‫إﺿﺎﻓﺔ‬ ‫ﻗﺑل‬ Html Encode ‫ﻋﻣل‬ ‫ﯾﺟب‬
:‫ﻣﺛﺎل‬ ،‫اﻟﺦ‬...div, p, h1
●
‫ال‬ ‫داﺧل‬ ‫أو‬ css ‫أو‬ ‫ﺳﻛرﺑت‬ ‫ﺟﺎﻓﺎ‬ ‫ﻣﺗﻐﯾر‬ ‫داﺧل‬ ‫وﺿﻌﮭﺎ‬ ‫ﺳﯾﺗم‬ ‫ﻣوﺛوﻗﺔ‬ ‫ﻏﯾر‬ ‫ﻗﯾﻣﺔ‬ ‫ﻷي‬ encode ‫ﻋﻣل‬ ‫ﯾﺟب‬
.‫آﺧره‬ ‫إﻟﻰ‬...alert, href, width ‫ال‬ ‫ﻣﺛل‬ common attribute
●
‫ال‬ ‫ﺧطر‬ ‫ﻣن‬ ‫ﺳﯾﻘﻠل‬ ‫ھذا‬ ،‫ﺳﻛرﺑت‬ ‫اﻟﺟﺎﻓﺎ‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫إﻟﯾﮭﺎ‬ ‫اﻟوﺻول‬ ‫ﻣﻧﻊ‬ ‫ﯾﺟب‬ cookie ‫ﻷي‬ HTTPOnly ‫ﺑﺈﺿﺎﻓﺔ‬ ‫ﻗم‬
.XSS Attack
& ==> & < ==> < > ==> > " ==> " ' ==> '

●
Man-In-The-Middle ‫ﻣن‬ ‫اﻻﺧﺗراق‬ ‫ﻣﺣﺎوﻟﺔ‬ ‫ﻟﻣﻧﻊ‬ ‫وذﻟك‬ ‫ﺳوﻛﯾت‬ ‫ﻟﻠوﯾب‬ ws ‫ال‬ ‫ﻣن‬ ‫ﺑدﻻ‬ wss ‫ال‬ ‫ﺑﺎﺳﺗﺧدام‬ ‫ﻗم‬
●
.‫اﺧﺗراﻗﮭﺎ‬ ‫ﻹﻣﻛﺎﻧﯾﺔ‬ ‫وذﻟك‬ web socket ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﻣﺗﺻﻔﺢ‬ ‫إﻟﻰ‬ ‫ﺗﺻل‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﺟﻣﯾﻊ‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
●
.local storage ‫ال‬ ‫ﻋﻠﻰ‬ ‫أھﻣﯾﺔ‬ ‫وذات‬ ‫ﺣﺳﺎﺳﺔ‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫ﺑﺣﻔظ‬ ‫ﺗﻘم‬ ‫ﻻ‬
●
‫ال‬ ‫داﺧل‬ tap ‫ال‬ ‫أو‬ window ‫ال‬ ‫اﻏﻼق‬ ‫ﺑﻌد‬ ‫وﺳﺗﻧﺗﮭﻲ‬ ‫واﺣدة‬ ‫ﻣرة‬ ‫اﺳﺗﺧداﻣﮭﺎ‬ ‫ﺳﯾﺗم‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫ﺑﺣﻔظ‬ ‫ﺗﻘم‬ ‫ﻻ‬
.‫ذﻟك‬ ‫ﻣن‬ ‫ﺑدﻻ‬ session storage ‫ال‬ ‫اﺳﺗﺧدم‬ ،!local storage
●
‫ﻗم‬ ‫ﻣﻌﺎﻟﺟﺗﮭﺎ‬ ‫ﻋﻧد‬ ‫ﻟذﻟك‬ ،‫ﺗﻌدﯾﻠﮭﺎ‬ ‫إﻣﻛﺎﻧﯾﺔ‬ ‫ﺑﺳﺑب‬ ‫ﻣوﺛوﻗﺔ‬ ‫ﺑﯾﺎﻧﺎت‬ ‫أﻧﮭﺎ‬ ‫ﻋﻠﻰ‬ localstorage ‫ال‬ ‫ﻣﻊ‬ ‫ﺑﺎﻟﺗﻌﺎﻣل‬ ‫ﺗﻘم‬ ‫ﻻ‬
.‫آﻣﻧﺔ‬ ‫ﺑطرﯾﻘﺔ‬ ‫ﺑﻣﻌﺎﻟﺟﺗﮭﺎ‬
●
invalid ‫أي‬ ‫ﯾﻣﻧﻊ‬ ‫ﻟﻠﻧﺻوص‬ encode ‫ال‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫وھﻲ‬ Normalization validate
character

●
file size ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬ ‫ﻛﻣﺎ‬ ،file type and ext ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬ file upload ‫ال‬ ‫ﻋﻧد‬
●
‫إﻟﻛﺗروﻧﯾﺎ‬ ‫ﺑرﯾدا‬ ‫ﺗﻌطﻲ‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫ﻣﻣﻛﻧﺔ‬ ‫ﺻﯾﻎ‬ ‫ﻋدة‬ ‫ھﻧﺎك‬ ،‫ﺻﺣﯾﺣﺔ‬ ‫ﺑطرﯾﻘﺔ‬ ‫اﻹﻟﻛﺗروﻧﻲ‬ ‫اﻟﺑرﯾد‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
‫ﺟوﺟل‬ ‫ﻣﺛل‬ ‫ﺑﮭﺎ‬ ‫ﯾﺳﻣﺣون‬ ‫اﻟﺧدﻣﺔ‬ ‫ﻣزودﯾن‬ ‫)ﺑﻌض‬ email+subaddress@email.com ‫ﻣﺛل‬ ‫ﺻﺣﯾﺣﺎ‬
‫أن‬ ‫ھﻲ‬ ‫اﻹﻟﻛﺗروﻧﻲ‬ ‫اﻟﺑرﯾد‬ ‫ﻣن‬ ‫ﻟﻠﺗﺣﻘق‬ ‫اﺳﺗﺧداﻣﮭﺎ‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻟﻘواﻋد‬ ‫ﻣن‬ ،(‫ﻣﺎﯾﻛروﺳوﻓت‬ ‫ﻣﺛل‬ ‫ﯾﻣﻧﻌﮭﺎ‬ ‫وﺑﻌﺿﮭم‬
‫ال‬ ‫ﻣﺛل‬ dangers char ‫أي‬ ‫ﻋﻠﻰ‬ ‫ﯾﺣﺗوي‬ ‫ﻻ‬ ‫أن‬ ‫وﯾﺟب‬ ،@ ‫ﺑﯾﻧﮭم‬ ‫ﯾﻔﺻل‬ ‫ﻣﻘطﻌﯾن‬ ‫ﻣن‬ ‫اﻹﻟﻛﺗروﻧﻲ‬ ‫اﻟﺑرﯾد‬ ‫ﯾﻛون‬
‫أو‬ . ‫أو‬ - ‫وﺟود‬ ‫وﯾﻣﻛن‬ ،‫ﻓﻘط‬ ‫أﺣرف‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻹﻟﻛﺗروﻧﻲ‬ ‫اﻟﺑرﯾد‬ ‫ﻓﻲ‬ ‫اﻟدوﻣﯾن‬ ‫واﺳم‬ ،single quote
.254 ‫اﻟﺛﺎﻧﻲ‬ ‫واﻟﻣﻘطﻊ‬ ،‫ﺣرف‬ 63 ‫ﻋن‬ ‫اﻷول‬ ‫اﻟﻣﻘطﻊ‬ ‫ﯾزﯾد‬ ‫ﻻ‬ ‫أن‬ ‫وﯾﺟب‬ ،‫أرﻗﺎم‬
●
!local storage ‫ال‬ ‫داﺧل‬ session id ‫ال‬ ‫ﺑﺣﻔظ‬ ‫ﺗﻘم‬ ‫ﻻ‬

Ref

،‫ﺻﺎﺣﺒﻬﺎ‬ ‫ﻋﻠﻴﻬﺎ‬ ‫ﻐﺒﻂ‬ ُ
‫ﻳ‬ ‫ﻧﻌﻤﺔ‬ ‫اﻟﺨﻄﺄ‬ ‫ﻋﻨﺪ‬ ‫اﻟﺘﺮاﺟﻊ‬ ‫أن‬ ْ
‫ﺘﻌﻠﻢ‬ ْ‫ﻓﻠ‬
‫واﻟﻘﻮل‬ ‫وﻧﺸﺮه‬ ‫ﺗﺒﺮﻳﺮه‬ ‫ﻣﺤﺎوﻟﺔ‬ ‫ﺛﻢ‬ ‫اﻟﺨﻄﺄ‬ ‫ﻋﻠﻰ‬ ‫اﻹﺻﺮار‬ ‫أن‬ ْ
‫ﺘﻌﻠﻢ‬ ْ‫وﻟ‬
‫إﻟﻰ‬ ‫وﺗﺐ‬ ‫ﻓﺎﺳﺘﻐﻔﺮ‬ ‫أﺧﻄﺄت‬ ‫ﻓﺈن‬ ،‫ذاﺗﻪ‬ ‫اﻟﺨﻄﺄ‬ ‫ﻣﻦ‬ ‫أﻋﻈﻢ‬ ‫ﺑﺼﺤﺘﻪ‬
.‫ﺗﺠﺎﻫﺮ‬ ‫وﻻ‬ ‫ﺗﻜﺎﺑﺮ‬ ‫وﻻ‬ ‫ﺗﺼﺮ‬ ‫وﻻ‬ ،‫ﷲ‬
‫اﻟﻘﺎﻋﺪة‬ ‫وﻫﺬه‬ !‫ﻣﻘﺎﻣﻪ‬ ‫وﻋﻼ‬ ‫وﺗﻌﻠﻢ‬ ‫أﻓﻠﺢ‬ ،‫ﻫﺬه‬ ‫أدرك‬ ‫ﻓﻤﻦ‬
!‫واﻟﺪﻧﻴﺎ‬ ‫اﻟﺪﻳﻦ‬ ‫أﻣﻮر‬ ‫ﺗﺸﻤﻞ‬

HTTP Strict Transport Security (HSTS)
‫ﺑﺎل‬ ‫اﻟﺧﺎﺻﺔ‬ connection ‫ﺑﺎل‬ ‫اﻟﺗﺣﻛم‬ ‫وطرﯾﻘﺔ‬ ‫ﺑﮭﺎ‬ ‫اﻹﺗﺻﺎل‬ ‫وطرﯾﻘﺔ‬ ‫اﻹﻟﻛﺗروﻧﯾﺔ‬ ‫اﻟﻣواﻗﻊ‬ ‫إﻟﻰ‬ ‫اﻟوﺻول‬ ‫آﻟﯾﺔ‬ ‫إن‬
‫ھذا‬ ،‫اﻟﻣواﻗﻊ‬ ‫وھذه‬ ‫اﻟﻣﺳﺗﺧدﻣﯾن‬ ‫ﻛل‬ ‫ﺑﯾن‬ ‫واﻹﺗﺻﺎل‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫أﻣن‬ ‫ﻋﻠﻰ‬ ‫ﻟﻠﺣﻔﺎظ‬ ‫ﺟدا‬ ‫ﻣﮭﻣﺔ‬ ‫آﻟﯾﺔ‬ ‫ﻣﻌﯾﻧﺔ‬ ‫ﻣواﻗﻊ‬ ‫ﻋﻠﻰ‬ users
‫ﺿﻣن‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫أي‬ ‫ﻧﻘل‬ ‫أﺛﻧﺎء‬ ‫ﺻﺎرﻣﺔ‬ ‫إﺟراءات‬ ‫اﺗﺧﺎذ‬ ‫ﺿرورة‬ ‫إﻟﻰ‬ ‫ﯾﺷﯾر‬ ‫وھو‬ HSTS ‫ال‬ ‫ﻣﺻطﻠﺢ‬ ‫ﻹﻧﺷﺎء‬ ‫ﻗﺎد‬ ‫اﻷﻣر‬
،web server conﬁguration ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫إﻋدادھﺎ‬ ‫وﯾﺗم‬ ‫اﻹﻧﺗرﻧت‬ ‫ﻣﺗﺻﻔﺣﺎت‬ ‫ﻋﻠﻰ‬ ‫ﺗطﺑق‬ ‫واﺿﺣﺔ‬ ‫ﺳﯾﺎﺳﺔ‬
‫وﺳﻧﺗطرق‬ ،web server conﬁguration ‫وﻟل‬ ‫ﻟﻠﻣﺗﺻﻔﺣﺎت‬ ‫اﻹﻓﺗراﺿﻲ‬ ‫اﻟﺧﯾﺎر‬ ‫ھﻲ‬ ‫اﻟﺳﯾﺎﺳﺎت‬ ‫ھذه‬ ‫ﻣن‬ ‫اﻟﻌدﯾد‬
‫ﺑﺳﺑﺑﮭﺎ‬ ‫ﻧراھﺎ‬ ‫اﻟﺗﻲ‬ ‫اﻷﺳﺋﻠﺔ‬ ‫ﻣﻌظم‬ ‫ﺗﻛون‬ ‫واﻟﺗﻲ‬ ‫داﺋﻣﺎ‬ ‫ﻣﻌﮭﺎ‬ ‫وﻧﺗﻌﺎﻣل‬ ‫ﻧراھﺎ‬ ‫ﻗد‬ ‫اﻟﺗﻲ‬ Security Headers ‫ال‬ ‫ﻟﺑﻌض‬ ‫ھﻧﺎ‬
(‫ﻓﻘط‬ 3 ‫)ﺳﻧذﻛر‬...!"‫ﻣﻌﮭﺎ‬ ‫آﻣﻧﺔ‬ ‫ﺑطرﯾﻘﺔ‬ ‫اﻟﻌﻣل‬ ‫ﯾﻣﻛن‬ ‫ﻛﯾف‬ ‫ﻣن‬ ‫ﺑدﻻ‬ ‫ھذه‬ ‫اﻷﻣﺎن‬ ‫ﻣﯾزة‬ ‫ﺗﻌطﯾل‬ ‫ﯾﻣﻛن‬ ‫"ﻛﯾف‬

●
‫إﻣﻛﺎﻧﯾﺔ‬ ‫ﺗﻌطﯾل‬ ‫ﯾﺗم‬ header ‫ال‬ ‫ھذا‬ ‫ﺧﻼل‬ ‫ﻣن‬ :Strict-Transport-Security (STS header ﬁeld)
‫ﺗطﺑﯾﻘﺎت‬ ‫ﻣن‬ ‫ﺗﻘﻊ‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻷﺧطﺎء‬ ‫ﻟﺗﻘﻠﯾل‬ ‫ﻣﮭﻣﺎ‬ ‫ﻧظﺎﻣﺎ‬ ‫ﻛوﻧﮫ‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،HTTPS ‫ال‬ ‫دون‬ ‫ﻣن‬ ‫اﻹﺗﺻﺎل‬
..‫ﻣﻌﯾن‬ session ‫ﺿﻣن‬ cookies ‫ال‬ ‫ﻣﺛل‬ ‫ﻟﻠﻣﮭﺎﺟﻣﯾن‬ ‫اﻟﻣﮭﻣﺔ‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ ‫ﺑﻌض‬ ‫ﺗﺗﺳرب‬ ‫ﻗد‬ ‫ﺑﺳﺑﺑﮭﺎ‬ ‫واﻟﺗﻲ‬ ‫اﻟوﯾب‬
:‫ﻣﺛﺎل‬
●
‫ﻣن‬ ‫اﻟوﯾب‬ ‫ﻟﺗطﺑﯾﻘﺎت‬ ‫أﻓﺿل‬ ‫ﺣﻣﺎﯾﺔ‬ ‫ﻟﺗﻘدﯾم‬ ‫اﻟطرق‬ ‫أھم‬ ‫ﻣن‬ ‫واﺣد‬ header ‫ال‬ ‫ھذا‬ ‫ﯾﻌد‬ :X-Frame-Options
‫ﺗﻘوم‬ ،Clickjacking ‫ال‬ ‫ﻟﻣﻧﻊ‬ web browser ‫وال‬ host ‫ال‬ ‫ﺑﯾن‬ ‫اﻹﺗﺻﺎل‬ ‫ﺗﺿﺑط‬ policy ‫إﻧﺷﺎء‬ ‫ﺧﻼل‬
:‫ﻣﺛﺎل‬...‫ﻻ‬ ‫أم‬ (‫أﺧرى‬ ‫)ﻣواﻗﻊ‬ ‫ﺻﻔﺣﺎت‬ ‫ﻓﻲ‬ ‫ﺑﺎﻟﻌرض‬ ‫ﻟﮫ‬ ‫ﯾﺳﻣﺢ‬ frame ‫ال‬ ‫ھذا‬ ‫ﻛﺎن‬ ‫إذا‬ ‫ﻣﺎ‬ ‫ﺑﺗﺣدﯾد‬ policy ‫ال‬ ‫ھذه‬
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
X-Frame-Options: deny
‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﻣﺳﺗﺧدﻣﯾن‬ ‫ﻟﺧداع‬ ‫اﻟﻣﮭﺎﺟﻣﯾن‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ ‫اﻟﺗﻛﺗﯾﻛﺎت‬ ‫أﺣد‬ ‫وھو‬ "UI redress attack" ‫ب‬ ‫أﯾﺿﺎ‬ ‫وﯾﺳﻣﻰ‬ Clickjacking :‫ﻣﻼﺣظﺔ‬
‫ﻣن‬ ‫ﯾرﯾده‬ ‫ﻻ‬ ‫ﺷﻲء‬ ‫ﻋﻠﻰ‬ ‫ﺑﺎﻟﺿﻐط‬ ‫ﯾﻘوم‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ﻣن‬ ‫ﺗﺟﻌل‬ (transparent) ‫ﻣﺧﺗﻠﻔﺔ‬ ‫ووﺻول‬ ‫ﺷﻔﺎﻓﯾﺔ‬ ‫ﺑدرﺟﺎت‬ (layers) ‫اﻟطﺑﻘﺎت‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫إﻧﺷﺎء‬
‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫اﻷﻣﺛﻠﺔ‬ ‫أﺷﮭر‬ ‫وﻣن‬ ،‫اﻟﺧﺎﺻﺔ‬ ‫ﺻﻔﺣﺎﺗﮫ‬ ‫أو‬ ‫ﺑﺎﻟﻣﮭﺎﺟم‬ ‫اﻟﺧﺎص‬ ‫اﻟﺗطﺑﯾق‬ ‫إﻟﻰ‬ ‫ﺗﺣوﯾﻠك‬ ‫وظﯾﻔﺗﮭﺎ‬ ‫اﻟﻧﻘرات‬ ‫ھذه‬ ‫ﺗﻛون‬ ‫ﻣﺎ‬ ‫وﻋﺎدة‬ ،‫اﻟطﺑﻘﺎت‬ ‫ﺑﮭذه‬ ‫اﻟﺗﺣﻛم‬ ‫ﺧﻼل‬
...‫ﻣﻌﯾن‬ ‫ﺑﻌﻣل‬ ‫ﯾﻘوم‬ ‫اﻟﺿﻐط‬ ‫وﻋﻧد‬ "‫ﺧﺿراء‬ ‫ﻓﯾزا‬ ‫ﻟﺗرﺑﺢ‬ ‫ھﻧﺎ‬ ‫"إﺿﻐط‬ ‫ﺗﺧﺑرك‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣواﻗﻊ‬ ‫ﻓﻲ‬ ‫اﻹﻋﻼﻧﺎت‬

●
user ‫ال‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫ﻓﻲ‬ ‫ﻟﻠﺗﺣﻛم‬ ‫ﻟﻶدﻣن‬ ‫ﺻﻼﺣﯾﺔ‬ header ‫ال‬ ‫ھذا‬ ‫ﯾﻌطﻲ‬ :Content-Security-Policy
‫إﺿﺎﻓﺔ‬ ‫ﻋﻧد‬ ،‫اﻟﻣﺳﺗﺧدﻣﯾن‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫اﻟﻣطﻠوﺑﺔ‬ ‫اﻟﺻﻔﺣﺎت‬ ‫إﻟﻰ‬ ‫ﻟﻠوﺻول‬ ‫اﻟﻣﻧﺎﺳﺑﺔ‬ ‫اﻟﻘواﻋد‬ ‫ووﺿﻊ‬ ‫إﻟﯾﮫ‬ ‫اﻟﻘﺎدﻣﺔ‬ agent
‫ﻋﻧد‬ ،XSS ‫ال‬ ‫ھﺟﻣﺎت‬ ‫ﻣن‬ ‫اﻟﺣﻣﺎﯾﺔ‬ ‫اﻷﻣر‬ ‫ھذا‬ ‫ﺳﯾﻌزز‬ server origins and script endpoint ‫ال‬
‫ﻣﺛل‬ ‫اﻟﺻﻔﺣﺎت‬ ‫ھذه‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫ﻋرض‬ ‫ﻋﻧد‬ ‫ﻛﺑﯾر‬ ‫ﺑﺷﻛل‬ ‫ﺳﺗﺗﺄﺛر‬ ‫اﻟﻣﺗﺻﻔﺣﺎت‬ ‫ﻓﺈن‬ ‫اﻵدﻣن‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫اﻷﻣور‬ ‫ﺑﮭذه‬ ‫اﻟﻘﯾﺎم‬
:‫ﻣﺛﺎل‬ ‫اﻻﻓﺗراﺿﻲ‬ ‫اﻟﺷﻛل‬ ‫ﻓﻲ‬ ‫ﻣﻔﻌﻠﺔ‬ ‫ﻏﯾر‬ ‫ﺳﺗﻛون‬ ‫اﻟﺧﺎﺻﯾﺔ‬ ‫ﻓﮭذه‬ ،inline js ‫ال‬ ‫وﻋرض‬ ‫ﺟﻠب‬ ‫طرﯾﻘﺔ‬
‫أي‬ ‫ﺗﻧﻔﯾذ‬ ‫ﻣن‬ ‫ﻧﻔﺳك‬ ‫ﺗﺣﻣﻲ‬ ‫ﻓﺄﻧت‬ ‫اﻟطرﯾﻘﺔ‬ ‫ھذه‬ ‫ﺧﻼل‬ ‫ﻣن‬
‫ذﻟك‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬ ،‫اﻟﮭﺟﻣﺎت‬ ‫طرﯾق‬ ‫ﻋن‬ ‫ﻟﻠﺻﻔﺣﺔ‬ ‫ﺗﺿﻣﯾﻧﮫ‬ ‫ﺗم‬ JS
‫اﻟﺦ‬...clear ‫وھو‬ cache ‫ﻋﻣل‬ ‫ﺗﺳﺗطﯾﻊ‬ ‫ﻷﻧك‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻟﻛﺗﺎﺑﺔ‬ ‫اﻷﻣﺛل‬ ‫اﻷﺳﻠوب‬ ‫ھو‬ ‫ﻓﮭذا‬

<script>
function doAmazingThings() {
alert('YOU AM AMAZING!');
}
</script>
<button onclick='doAmazingThings();'>Am I
amazing?</button>

<script src='amazing.js'></script>
<button id='amazing'>Am I amazing?</button>

authentication ‫ﺑﺎل‬ ‫اﻟﻣﺗﻌﻠﻘﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻗواﻋد‬
●
‫ﻟل‬ ‫اﻟﺳﻣﺎح‬ ‫ﻓﻲ‬ ‫ﺳﯾﺎﺳﺗﻛم‬ ‫ﻓﻲ‬ ‫ﻛﺎن‬ ‫ﻓﺈن‬ ،TLS ‫ل‬ ‫ﺧﺎﺿﻊ‬ ‫اﻟدﺧول‬ ‫ﺗﺳﺟﯾل‬ ‫ﻋﻣﻠﯾﺔ‬ ‫ﻋن‬ ‫اﻟﻣﺳؤول‬ form ‫ال‬ ‫ﺑﺄن‬ ‫ﺗﺄﻛد‬
،HTTPS ‫اﻟرﯾﻛوﺳت‬ ‫ﺑﮭذا‬ ‫اﻟﺧﺎص‬ action ‫ال‬ ‫ﺟﻌل‬ ‫ﻓﻌﻠﯾك‬ ،‫واﺳﺗﺧداﻣﮭﺎ‬ ‫اﻟﺻﻔﺣﺔ‬ ‫إﻟﻰ‬ ‫اﻟوﺻول‬ ‫ﻣن‬ HTTP
‫ﻛﺎﻓﻲ‬ ‫ﻏﯾر‬ ‫ﻟوﺣده‬ ‫اﻷﻣر‬ ‫ھذا‬ ‫أن‬ ‫وﻣﻊ‬ ،Man-in-middle ‫اﻟﻣﺣﺗﻣﻠﺔ‬ ‫اﻟﮭﺟﻣﺎت‬ ‫ﻣن‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ھذا‬ ‫ﻟﺗﺣﻣﻲ‬ ‫وذﻟك‬
form ‫ال‬ ‫ﺗﻐﯾﯾر‬ ‫ﯾﻣﻛﻧﮫ‬ ‫اﻟﻣﺧﺗرق‬ ‫ﻷن‬ ،...‫ﻓﻘط‬ ‫اﻷﻣر‬ ‫ﯾﺻﻌب‬ ‫أو‬ ‫ﯾﺧﻔف‬ ‫ھذا‬ ‫أن‬ ‫إﻻ‬ HTTP ‫ﻧﻔﺳﮭﺎ‬ ‫اﻟﺻﻔﺣﺔ‬ ‫ﻷن‬
.submission url
●
‫ﻛﺗب‬ ‫إذا‬ ‫ﯾﺧﺗﻠف‬ ‫ﻻ‬ ‫أن‬ ‫ﺟﯾب‬ email ‫ال‬ ‫ﻓﻣﺛﻼ‬ ،case-insensitive ‫اﻟﻣﺳﺗﺧدم‬ ‫اﺳم‬ ‫أن‬ ‫ﻣن‬ ‫دوﻣﺎ‬ ‫ﺗﺄﻛد‬
A@b.com ‫ﻋن‬ a@b.com
●
‫ﻣﻌﻠوﻣﺎت‬ ‫ﺗﻘدم‬ ‫وﻻ‬ ‫اﻟﺧطﺄ‬ ‫ﻣﻛﺎن‬ ‫ﻋن‬ ‫ﺗﻌﺑر‬ ‫ﻻ‬ ‫اﻟﻔﺎﺷﻠﺔ‬ ‫اﻟدﺧول‬ ‫ﺑﻣﺣﺎوﻻت‬ ‫ﺗﺗﻌﻠق‬ ‫اﻟﺗﻲ‬ ‫اﻷﺧطﺎء‬ ‫رﺳﺎﺋل‬ ‫أن‬ ‫ﻣن‬ ‫ﺗﺄﻛد‬
‫ﻛﻠﻣﺔ‬ ‫أن‬ ‫اﻟﻣﺧﺗرق‬ ‫ﻓﺳﯾﻌﻠم‬ ،‫ﺻﺣﯾﺢ‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫اﺳم‬ ‫ﺑﺄن‬ ‫ﺗﻔﯾد‬ ‫رﺳﺎﻟﺔ‬ ‫طﺑﺎﻋﺔ‬ ‫ﺗم‬ ‫إذا‬ :‫ﻣﺛﻼ‬ ،‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫اﻟﻣﺧﺗرق‬ ‫ﺗﺳﺎﻋد‬
‫اﻟﻣرور‬ ‫ﻛﻠﻣﺔ‬ ‫أو‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫)اﺳم‬ :‫ھﻧﺎ‬ ‫واﻟﺻﺣﯾﺢ‬ ،‫اﻟﻣرور‬ ‫ﻛﻠﻣﺔ‬ ‫ﻋﻠﻰ‬ ‫ﺟﮭده‬ ‫ﺳﯾرﻛز‬ ‫وﺑﮭذا‬ ‫اﻟﺧﺎطﺋﺔ‬ ‫ھﻲ‬ ‫اﻟﻣرور‬
(‫ﺧﺎطﺋﺔ‬

●
10 ‫ﻋن‬ ‫اﻟﻣرور‬ ‫ﻛﻠﻣﺔ‬ ‫ﺗﻘل‬ ‫ﻻ‬ ‫أن‬ ‫ﻋﻠﻰ‬ ‫اﻟﺣرص‬ ‫ﯾﺟب‬ ‫ﻓﻣﺛﻼ‬ ،‫اﻟﻣرور‬ ‫ﺑﻛﻠﻣﺎت‬ ‫اﻟﺧﺎﺻﺔ‬ ‫ﺑﺎﻟﻘواﻋد‬ ‫اﻻھﺗﻣﺎم‬ ‫ﯾﺟب‬
‫ﻛﻠﻣﺔ‬ ‫ﻟﻛﺗﺎﺑﺔ‬ ‫اﻟﻘواﻋد‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫وﺿﻊ‬ ‫ﯾﻔﺿل‬ ‫أﻧﮫ‬ ‫ﻛﻣﺎ‬ ،‫واﻻﺧﺗراق‬ ‫ﻟﻠﺗﺧﻣﯾن‬ ‫ﺳﮭﻠﺔ‬ ‫ﻛﻠﻣﺔ‬ ‫ﺳﺗﻌد‬ ‫ﻷﻧﮭﺎ‬ ،‫ﺧﺎﻧﺎت‬
‫آﺧره‬ ‫إﻟﻰ‬...‫ﺧﺎﺻﺔ‬ ‫ورﻣوز‬ ‫أرﻗﺎم‬ ،small ‫وأﺣرف‬ Capital ‫أﺣرف‬ ‫وﺟود‬ ‫ﻣﺛل‬ ‫اﻟﻣرور‬
●
‫ﻣﺎ‬ ‫ﻣﺳﺗﺧدم‬ ‫ﺗﻣﻧﻊ‬ ‫اﻟﺗﻲ‬ ‫اﻟﻘواﻋد‬ ‫ﻣن‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫وﺿﻊ‬ ‫ﻓﻌﻠﯾﻧﺎ‬ "brute force attacks" ‫ھﺟﻣﺎت‬ ‫ﻣن‬ ‫أﻧﻔﺳﻧﺎ‬ ‫ﻟﻧﺣﻣﻲ‬
‫ﻗﺎم‬ ‫اذا‬ ‫ﻣﺛﻼ‬ ،‫ﻓﺎﺷﻠﺔ‬ ‫ﻣﺣﺎوﻻت‬ ‫ﺑﻌدة‬ ‫اﻟﻘﯾﺎم‬ ‫ﺑﻌد‬ ‫ﻣﻌﯾﻧﺔ‬ ‫زﻣﻧﯾﺔ‬ ‫ﺑﻔواﺻل‬ ‫أو‬ ‫ﻣﻌﯾﻧﺔ‬ ‫زﻣﻧﯾﺔ‬ ‫ﻟﻣدة‬ ‫ﻟﺣﺳﺎﺑﮫ‬ ‫اﻟدﺧول‬ ‫ﺗﺳﺟﯾل‬ ‫ﻣن‬
‫أو‬ ‫دﻗﺎﺋق‬ 5 ‫ﻟﻣدة‬ ‫اﻟﻣﺣﺎوﻟﺔ‬ ‫ﻣن‬ ‫ﺑﻣﻧﻌﮫ‬ ‫ﻓﺎﺷﻠﺔ‬ ‫وﻛﺎﻧت‬ ‫ﻣﺗﺗﺎﻟﯾﺔ‬ ‫ﻣرات‬ ‫ﻟﺧﻣس‬ ‫اﻟدﺧول‬ ‫ﺗﺳﺟﯾل‬ ‫ﺑﻣﺣﺎوﻟﺔ‬ ‫ﺑﻛﺗﺎﺑﺔ‬ ‫اﻟﻣﺳﺗﺧدم‬
‫وھﻛذا‬...‫ﺛﺎﻧﯾﺔ‬ 20 ‫ﺑﻌدھﺎ‬ ،‫ﺛواﻧﻲ‬ 10 ‫ﻣﺛﻼ‬ ،‫ﻓﺎﺷﻠﺔ‬ ‫ﻣﺣﺎوﻟﺔ‬ ‫ﻛل‬ ‫ﺑﻌد‬ ‫ﻣﺟددا‬ ‫ﻟﻠﻣﺣﺎوﻟﺔ‬ ‫طردﯾﺔ‬ ‫ﺑزﯾﺎدة‬ ‫ﻣﺛﻼ‬

●
‫آﻣﻧﺎ‬ ‫ﯾﻌد‬ ‫ﻻ‬ md5 ‫ال‬ ‫ﻓﻣﺛﻼ‬ ،‫اﻟﻣرور‬ ‫ﻛﻠﻣﺎت‬ ‫ﻟﺣﻔظ‬ ‫واﻟﻣﻧﺎﺳب‬ ‫اﻵﻣن‬ ‫اﻟﺗﺷﻔﯾر‬ ‫ﻧظﺎم‬ ‫اﺳﺗﺧدام‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ﯾﺟب‬
!‫ﻟﻼﺳﺗﺧدام‬
●
‫ﺗطﺑﯾﻘﺎت‬ ‫ﻣﺛل‬ ‫ﻟﻠﻣﺳﺗﺧدﻣﯾن‬ ‫واﻟﻣﺎﻟﯾﺔ‬ ‫اﻟﺣﺳﺎﺳﺔ‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ ‫ﻣﻊ‬ ‫ﻟﻠﺗﻌﺎﻣل‬ ‫إﺿﺎﻓﯾﺔ‬ ‫ﺣﻣﺎﯾﺔ‬ ‫وآﻟﯾﺔ‬ ‫طرﯾﻘﺔ‬ ‫ﺗﻘدﯾم‬ ‫ﯾﻔﺿل‬
…‫اﻷﻣوال‬ ‫إرﺳﺎل‬ ‫ﻗﺑل‬ ‫ﻟﻠﮭﺎﺗف‬ ‫ﻧﺻﯾﺔ‬ ‫رﺳﺎﻟﺔ‬ ‫إرﺳﺎل‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﺑﻧوك‬
●
‫ﺑﺷﻛل‬ ‫ﻣرورھم‬ ‫ﻛﻠﻣﺎت‬ ‫ﺗﻐﯾﯾر‬ ‫ﻋﻠﻰ‬ ‫اﻷﻧظﻣﺔ‬ ‫ھذه‬ ‫ﻣﺳﺗﺧدﻣﻲ‬ ‫أو‬ ‫اﻟﻣوظﻔﯾن‬ ‫ﯾﺟﺑر‬ ‫ﻧظﺎم‬ ‫وﺿﻊ‬ ‫ﯾﻔﺿل‬ ‫اﻟداﺧﻠﯾﺔ‬ ‫ﻟﻸﻧظﻣﺔ‬
‫ﻗدﯾﻣﺔ‬ ‫ﻣرور‬ ‫ﻛﻠﻣﺎت‬ ‫اﺳﺗﺧدام‬ ‫ﻣن‬ ‫وﻣﻧﻌﮭم‬ ‫اﻟﻧظﺎم‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫دوري‬
●
backdoor ‫ال‬ ‫ﻣن‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺗك‬ ‫أﺛﻧﺎء‬ ‫اﻧﺗﺑﮫ‬

INSECURE DIRECT OBJECT REFERENCE
‫ﻣن‬ ‫اﻟﻌدﯾد‬ ‫ﻓﯾﮭﺎ‬ ‫ﯾﻘﻊ‬ ‫واﻟﺗﻲ‬ ‫اﻟﺷﺎﺋﻌﺔ‬ ‫اﻟﺛﻐرات‬ ‫ﻣن‬ ‫واﺣدة‬ Insecure Direct Object Reference ‫ال‬ ‫ﺗﻌﺗﺑر‬
‫ﻟﮫ‬ ‫ﯾﺣق‬ ‫ﻻ‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫إﻟﻰ‬ ‫اﻟوﺻول‬ ‫ﻣن‬ ‫ﻟﻠﻣﮭﺎﺟم‬ ‫ﺗﺗﯾﺢ‬ ‫ﺑﺎﺧﺗﺻﺎر‬ ‫اﻟﺛﻐرة‬ ‫ھذه‬ ،‫اﻟوﯾب‬ ‫ﺗطﺑﯾﻘﺎت‬ ‫ﻋﻠﻰ‬ ‫اﻟﻌﻣل‬ ‫أﺛﻧﺎء‬ ‫اﻟﻣﺑرﻣﺟﯾن‬
،‫آﺧره‬ ‫واﻟﻣﻠﻔﺎت…إﻟﻰ‬ database records ‫وال‬ URL ‫إﻟﻰ‬ ‫اﻟوﺻول‬ ‫طرﯾق‬ ‫ﻋن‬ ‫ﺣذﻓﮭﺎ‬ ‫أو‬ ‫ﺗﻌدﯾﻠﮭﺎ‬ ‫أو‬ ‫إﻟﯾﮫ‬ ‫اﻟوﺻول‬
HTTP ‫ال‬ ‫ﺧﻼل‬ ‫وﻣن‬ ،URL param ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﯾﺗم‬ ‫اﻟذي‬ SQL Injection ‫ال‬ ‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫اﻷﻣﺛﻠﺔ‬ ‫أﺷﮭر‬ ‫وﻣن‬
‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫اﻟﺷﮭﯾرة‬ ‫اﻷﻣﺛﻠﺔ‬ ‫وﻣن‬ ،post request ‫ال‬ ‫ﺗﻐﯾﯾر‬ ‫ﻣن‬ ‫اﻟﻣﮭﺎﺟم‬ ‫ﺧﻼﻟﮭﺎ‬ ‫ﻣن‬ ‫ﯾﻣﻛن‬ ‫واﻟﺗﻲ‬ POST requests
‫ﯾﺎھو‬ ‫ﻣوﻗﻊ‬ ‫ﻓﻲ‬ ‫رأﻓت‬ ‫إﺑراھﯾم‬ ‫اﻛﺗﺷﻔﮫ‬ ‫ﻣﺎ‬
15 ‫ﺣذف‬ ‫ﻹﻣﻛﺎﻧﯾﺔ‬ ‫ﺑﺎﻟﻧﮭﺎﯾﺔ‬ ‫وﺗوﺻل‬ ،‫آﺧرﯾن‬ ‫ﻷﻧﺎس‬ ‫ﺗﻌﻠﯾﻘﺎت‬ ‫ﺣذف‬ ‫ﻣن‬ ‫ﻣﻛﻧﮫ‬ ‫واﻟذي‬ ﬁd, cid ‫ال‬ ‫ﺗﻌدﯾل‬ ‫ﻣن‬ ‫ﺗﻣﻛن‬ ‫ﺣﯾث‬
‫أن‬ ‫ﻣراﺟﻌﺗﮭﺎ‬ ‫أو‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫ﻷي‬ ‫ﻛﺗﺎﺑﺗك‬ ‫ﻋﻧد‬ ‫ﺗﺄﻛد‬ ،‫ﻟذﻟك‬ !‫ﺑﺗﻌﺑﺋﺗﮭﺎ‬ ‫ﻗﺎﻣوا‬ users ‫ل‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ ‫ﻣن‬ record ‫ﻣﻠﯾون‬
6 ‫ل‬ ‫اﻟرﻗم‬ ‫ﺑﺗﻐﯾر‬ ‫ﻗﺎم‬ ‫ﻟو‬ 5 ‫رﻗم‬ ‫اﻟﯾوزر‬ ‫وأن‬ ،‫اﻟوﺻول‬ ‫ﯾﺳﺗطﯾﻊ‬ ‫ﻣن‬ ‫ﻓﻘط‬ ‫ھو‬ ‫اﻟﻣﻧﺎﺳﺑﺔ‬ ‫اﻟﺻﻼﺣﯾﺔ‬ ‫ﯾﻣﻠك‬ ‫اﻟذي‬ ‫اﻟﻣﺳﺗﺧدم‬
‫ذﻟك‬ ‫ﻣن‬ ‫ﻣﻧﻌﮫ‬ ‫ﻓﯾﺟب‬
prop=addressbook&ﬁd=367443&crumb=Q4.PSLBfBe.&cid=1236547890&cmd= delete_comment

INSECURE DIRECT OBJECT REFERENCE
‫ﻗﺑل‬ ‫إرﺳﺎﻟﮭﺎ‬ ‫ﯾﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻣن‬ ‫واﻟﺗﺄﻛد‬ ‫اﻟوﺻول‬ ‫ﺑﮭذا‬ ‫ﯾﺳﻣﺢ‬ ‫ﻻ‬ ‫ﺑﺄﻧﮫ‬ business ﬂow ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ﯾﺟب‬ ‫ﻛﻣﺎ‬
‫ﻋن‬ ‫اﻟﺗﺣﻘق‬ ‫ھذا‬ ‫ﯾﻛون‬ ‫أن‬ ‫وﯾﺟب‬ ،database query ‫ال‬ ‫ﻣﺛل‬ ‫اﻟوﯾب‬ ‫ﺗطﺑﯾق‬ ‫ﻓﻲ‬ object ‫أي‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫ﻣﻌﺎﻟﺟﺗﮭﺎ‬
.‫ﻣﻌﻠوم‬ ‫ھو‬ ‫ﻛﻣﺎ‬ ‫اﻟﻣﺧﺗرﻗﯾن‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫ﺗﺟﺎوزه‬ ‫ﯾﻣﻛن‬ client side ‫ال‬ ‫ﻷن‬ server side ‫ال‬ ‫طرﯾق‬

Authorization ‫ال‬ ‫ﻣﻊ‬ ‫ﻟﻠﺗﻌﺎﻣل‬ ‫ﻣﮭﻣﺔ‬ ‫ﻣﺑﺎدئ‬
‫ﻣﻠزم‬ ‫أﻧت‬ ‫ﻣﺛﻼ‬ ‫اﻟدﺧول‬ ‫ﺗﺳﺟﯾل‬ ‫ﻓﺑﻌد‬ ،!Authentication ‫ال‬ ‫ﻋن‬ ‫أھﻣﯾﺔ‬ ‫ﺗﻘل‬ ‫وﻻ‬ ‫ﺟدا‬ ‫ﻣﮭﻣﺔ‬ Authorization ‫ال‬
‫أو‬ ‫ﺑﺎﻟﺣذف‬ ‫ﻣﺛﻼ‬ ‫اﻟﺧﺎﺻﺔ‬ ‫اﻟﺻﻼﺣﯾﺔ‬ ‫ﻟدﯾﮫ‬ ‫وھل‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ / ‫اﻟﺻﻔﺣﺔ‬ ‫ﻟﮭذه‬ ‫اﻟوﺻول‬ ‫ﻟﮫ‬ ‫ﯾﺣق‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ھذا‬ ‫أن‬ ‫ﻣن‬ ‫ﺑﺎﻟﺗﺣﻘق‬
‫آﺧره‬ ‫إﻟﻰ‬...‫اﻟﻌرض‬ ‫أو‬ ‫اﻹﺿﺎﻓﺔ‬
‫وﻣن‬ ،‫اﻟﺻﺣﯾﺢ‬ ‫اﻟﻣﻛﺎن‬ ‫ﻓﻲ‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬ authorization ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﺑﺄن‬ ‫اﻟﺗﺄﻛد‬ ‫ﯾﺟب‬ ‫ذﻛر‬ ‫ﻣﺎ‬ ‫إﻟﻰ‬ ‫ﺑﺎﻹﺿﺎﻓﺔ‬
‫ال‬ ‫أن‬ ‫ﯾﻌﻧﻲ‬ ‫وھذا‬ !view ‫ال‬ ‫داﺧل‬ ‫اﻟﺗﺣﻘق‬ ‫ﺷرط‬ ‫وﺿﻊ‬ MVC design pattern ‫ال‬ ‫ﻓﻲ‬ ‫ﻣﺛﻼ‬ ‫اﻟﻣﺷﮭورة‬ ‫اﻷﺧطﺎء‬
!‫ﻓﻘط‬ ‫اﻟﻌرض‬ ‫ﺻﻔﺣﺔ‬ ‫ﻣن‬ ‫ﻣﻧﻌﮫ‬ ‫وﺳﯾﺗم‬ ‫ﺑداﺧﻠﮫ‬ ‫ﻣﺎ‬ ‫ﺑﺗﻧﻔﯾذ‬ ‫ﻓﺳﯾﻘوم‬ ‫اﻟﺻﺣﯾﺢ‬ action ‫إﻟﻰ‬ ‫ﺑﺎﻟوﺻول‬ ‫ﻗﺎم‬ ‫إذا‬ attackers
!‫اﻷﺧطﺎء‬ ‫ﻣن‬ ‫اﻟﻧوع‬ ‫ھذا‬ ‫ﻣن‬ ‫اﺣذر‬ ‫ﻟذﻟك‬

:‫ﯾﻠﻲ‬ ‫ﻣﻣﺎ‬ ‫اﻟﺗﺄﻛد‬ ‫ﻋﻠﯾك‬ ‫ﯾﺟب‬ Authorization ‫ﺛﻧﺎﯾﺎھﺎ‬ ‫ﻓﻲ‬ ‫ﺗﺣﺗوي‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺗك‬ ‫ﻋﻧد‬ ،‫ﻟذﻟك‬
●
‫ﺑﺎﻟﺷﻛل‬ ‫ﻓﯾﮫ‬ ‫ﯾﺗم‬ ‫ذﻟك‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬ ‫ﻟﻠوﺻول‬ ‫ﺻﻼﺣﯾﺔ‬ ‫إﻟﻰ‬ ‫ﯾﺣﺗﺎج‬ action/endpoint/function ‫ﻛل‬
‫ﻣوﺟود‬ ‫اﻟﺗﺣﻘق‬ ‫وأن‬ ،‫اﻟﺻﺣﯾﺢ‬
●
‫ﻛل‬ ‫ﻓﻲ‬ ‫وﺗﻛرارا‬ ‫ﻣرارا‬ ‫اﻟﺗﺣﻘق‬ ‫ﺷﯾﻔرة‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﻻ‬ ،‫وﻓﻌﺎل‬ ‫ﻣرﻛزي‬ ‫ﺑﺷﻛل‬ ‫ﺗﺗم‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﺗﺣﻘق‬ ‫ﻋﻣﻠﯾﺔ‬
…‫طرق‬ ‫ﻋدة‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ذﻟك‬ ‫ﻋن‬ ‫اﻻﺳﺗﻌﺎﺿﺔ‬ ‫وﯾﻣﻛن‬ ،method ‫ﻛل‬ ‫وﻓﻲ‬ function
●
Not Authorize ‫ﯾﻌﻧﻲ‬ ‫واﻟذي‬ ،403 ‫اﻟﺧطﺄ‬ ‫إرﺟﺎع‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬ ،‫ﺑﮫ‬ ‫ﻣﺻرح‬ ‫اﻟﻐﯾر‬ ‫اﻟوﺻول‬ ‫ﺣﺎﻟﺔ‬ ‫ﻓﻲ‬
●
‫ﻣﺛﻼ‬ ،client side ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﻋﻠﯾﮭﺎ‬ ‫وﺗؤﺛر‬ ‫ﺑﺎﻟﺻﻼﺣﯾﺔ‬ ‫ﺗﺗﻌﻠق‬ ‫ﺑرﻣﺟﯾﺔ‬ ‫ﺷﯾﻔرة‬ ‫أي‬ ‫ﺑوﺟود‬ ‫ﺗﺳﻣﺢ‬ ‫أن‬ ‫إﯾﺎك‬
.hidden ﬁeld ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﺻﻼﺣﯾﺔ‬ ‫إرﺳﺎل‬

●
‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﻓﯾﺟب‬ ،‫ﻣﺣدد‬ ‫ﻏرض‬ ‫ﻹﺗﻣﺎم‬ ‫ﻣﺗﻌددة‬ ‫وظﺎﺋف‬ ‫أو‬ ‫ﻣﺗﻌددة‬ ‫ﺻﻔﺣﺎت‬ ‫وﺟودة‬ ‫ﺣﺎﻟﺔ‬ ‫ﻓﻲ‬
‫اﻟﻣوﻗﻊ‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫اﻟﺷراء‬ ‫ﺻﻔﺣﺎت‬ ‫ﻣﺛﻼ‬ ‫ھذا‬ ‫وﻣن‬ ،‫اﻟﺧطوات‬ ‫ھذه‬ ‫ﻣن‬ ‫ﺧطوة‬ ‫ﻛل‬ ‫ﻓﻲ‬ authorization
…profile.php, fillCard.php, payment.php، confirmPament.php ‫ﻣﺛﻼ‬ ‫اﻹﻟﻛﺗروﻧﻲ‬
●
‫ھذا‬ ‫ﺗم‬ ‫إن‬ ،‫ﻣﺣددة‬ ‫ﺻﻔﺣﺎت‬ ‫ﻋﻠﻰ‬ ‫ﯾﺗم‬ ‫واﻻﺳﺗﺛﻧﺎء‬ ‫اﻟﺻﻔﺣﺎت‬ ‫ﻟﻛل‬ ‫اﻟوﺻول‬ ‫ﻣﻧﻊ‬ ‫ھﻲ‬ ‫اﻟﻌﺎﻣﺔ‬ ‫اﻟﻘﺎﻋدة‬ ‫ﺗﻛون‬ ‫ﻋﺎدة‬
‫وﺗﺧﺻﯾص‬ ‫ﻟﻠﻛل‬ ‫اﻟﺳﻣﺎح‬ ‫وھﻲ‬ ‫اﻟﻘﺎﻋدة‬ ‫ﻋﻛس‬ ‫ﻣن‬ ‫ﺑدﻻ‬ ،‫اﻟﻣﻣﻛﻧﺔ‬ ‫اﻷﺧطﺎء‬ ‫ﻛﻣﯾﺔ‬ ‫ﻣن‬ ‫ﺳﯾﺧﻔف‬ ‫ﻓﮭذا‬ ‫اﻷﺳﻠوب‬
…‫اﻟﺑﻌض‬
●
‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬ configuration ‫ال‬ ‫داﺧل‬ ‫ﻣوﺟودة‬ ‫و‬ test ‫ال‬ ‫ﻷﻏراض‬ ‫ﺗﺳﺗﺧدم‬ ‫ﺣﺳﺎﺑﺎت‬ ‫أي‬ ‫ﺑﺄن‬ ‫ﺗﺗﺄﻛد‬ ‫أن‬ ‫ﯾﺟب‬
.‫اﺳﺗﻐﻼﻟﮭﺎ‬ ‫ﯾﺗم‬ ‫ﻻ‬ ‫ﺣﺗﻰ‬ ‫ﺣذﻓﮭﺎ‬

E ernal Resource VULNERABILITI
‫اﻟوﻗت‬ ‫ﻟﺗﻘﻠﯾل‬ Third-part ‫اﻟﺳﻛرﺑﺗﺎت‬ ‫ﻣن‬ ‫اﻟﻌدﯾد‬ ‫ﺑﺎﺳﺗﺧدام‬ ‫ﺗﻘوم‬ ‫اﻟﺷرﻛﺎت‬ ‫ﻣن‬ ‫واﻟﻌدﯾد‬ ‫اﻟﻣطورﯾن‬ ‫ﻣن‬ ‫اﻟﻌدﯾد‬
‫اﻷﻣر‬ ‫ھذا‬ ،‫ﻟﻛن‬ ،‫وأﻓﺿل‬ ‫أﻛﺑر‬ ‫ﺑﺷﻛل‬ tested ‫وﺳﻛرﺑت‬ ‫أﻛﺑر‬ ‫ﻣوﺛوﻗﯾﺔ‬ ‫ﻋﻠﻰ‬ ‫واﻟﺣﺻول‬ ‫اﻟﻣﺷروع‬ ‫ﻛﺗﺎﺑﺔ‬ ‫أﺛﻧﺎء‬ ‫اﻟﻣﺳﺗﺧدم‬
...‫ﺑﮭﺎ‬ ‫ﯾﻠﺣق‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫أو‬ ‫اﻟﻣﻛﺗﺑﺔ‬ ‫ھذه‬ ‫ﺑﮭﺎ‬ ‫ﺗﻘوم‬ ‫اﻟﺗﻲ‬ ‫اﻟوظﺎﺋف‬ ‫ﻓﻲ‬ ‫ﻣﺷﺎﻛل‬ ‫وﺟود‬ ‫إﺣﺗﻣﺎﻟﯾﺔ‬ ‫ﻣن‬ ‫ﯾزﯾد‬
‫وزاد‬ ‫اﻟﺷرﻛﺔ‬ ‫ﻓﻲ‬ ‫اﻟﻣﺷﺎرﯾﻊ‬ ‫ﻋدد‬ ‫زاد‬ ‫ﻛﻠﻣﺎ‬ ‫وطﺑﻌﺎ‬ ،...‫اﻟﺗﻔﺎﺻﯾل‬ ‫ﺑﮭذه‬ ‫وﯾﮭﺗم‬ ‫ﯾراﺟﻊ‬ ‫أن‬ code reviews ‫ال‬ ‫ﻋﻠﻰ‬ ،‫ﻟذﻟك‬
،‫ﺗﻧﺎﺳﺑﮭﺎ‬ ‫واﻟﺗﻲ‬ ‫ﺑﮭﺎ‬ ‫اﻟﺧﺎﺻﺔ‬ ‫اﻟﺳﯾﺎﺳﺔ‬ ‫ﺣﺟﻣﮭﺎ‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬ ‫اﻟﺷرﻛﺔ‬ ‫ﺗﺿﻊ‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﻟذﻟك‬ ،‫ذﻟك‬ ‫ﺻﻌوﺑﺔ‬ ‫زادت‬ ‫اﻟﻣﺷروع‬ ‫ﺣﺟم‬
external ‫أي‬ ‫اﻟﺳﯾﺎق‬ ‫أﺛﻧﺎء‬ ‫اﻟﻣﻛﺗﺑﺔ‬ ‫ﻓﻲ‬ ‫ﯾﻘﺻد‬ :‫)ﻣﻼﺣظﺔ‬ :‫اﻻﻋﺗﺑﺎر‬ ‫ﺑﻌﯾن‬ ‫أﺧذھﺎ‬ ‫ﯾﻣﻛن‬ ‫اﻟﺗﻲ‬ ‫اﻟﻧﻘﺎط‬ ‫أھم‬ ‫ﺑﻌض‬ ‫ﻧذﻛر‬ ‫واﻵن‬
(‫إﻟﺦ‬...framework, library, script ‫ﻣﺛل‬ resource
●
!‫ﺗﺳﺗﺧدﻣﮫ‬ ‫ﺗﻌد‬ ‫ﻟو‬ ‫أو‬ ‫ﺗﺣﺗﺎﺟﮫ‬ ‫ﻟم‬ ‫ﻣﺎ‬ ‫ﺑﺣذف‬ ‫وﻗم‬ ،‫ﺧﺎرﺟﯾﺔ‬ ‫ﻣﻛﺎﺗب‬ ‫ﻣن‬ ‫ﺗﺣﺗﺎﺟﮫ‬ ‫ﻣﺎ‬ ‫ﻓﻘط‬ ‫اﺳﺗﺧدم‬

E ernal Resource VULNERABILITI
●
‫ﻣﺎ‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫وﻋدد‬ ‫ـ‬ ‫ﻣﺳﺗﺧدﻣﯾﮭﺎ‬ ‫وﻋدد‬ ‫ﺑﮭﺎ‬ ‫ﺗﺗﻌﻠق‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫وﻛﻣﯾﺔ‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ ‫اﻟﻣﻛﺗﺑﺔ‬ ‫ﻣوﺛوﻗﯾﺔ‬ ‫ﻣن‬ ‫ﺗﺄﻛد‬
.‫وﻧوﻋﯾﺗﮭﺎ‬ ‫إﻏﻼﻗﮭﺎ‬ ‫ﯾﺗم‬ ‫وﻟم‬ open ‫زاﻟت‬
●
،‫اﻟﻧﮭﺎﺋﯾﺔ‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﺣﺟم‬ ‫ﻣن‬ ‫ﺳﯾﻘﻠل‬ ‫ذﻟك‬ ‫ﻷن‬ ،‫ﻓﻘط‬ ‫اﻟﻣﻛﺗﺑﺔ‬ ‫ﻣن‬ ‫ﺗﺣﺗﺎﺟﮭﺎ‬ ‫اﻟﺗﻲ‬ ‫اﻟوظﺎﺋف‬ ‫ﺗﺿﻣﯾن‬ ‫ﻣن‬ ‫ﺗﺄﻛد‬
‫ﺳﻛرﺑت‬ ‫ﺑﺎﻟﺟﺎﻓﺎ‬ ‫ﻓﻣﺛﻼ‬ ،‫ﻧﺳﺗﺧدﻣﮭﺎ‬ ‫ﻟن‬ ‫اﻟﺗﻲ‬ ‫اﻷﺟزاء‬ ‫ﻓﻲ‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﻣن‬ ‫وﯾﻘﻠل‬ ،‫اﻟﻣﻣﻛﻧﺔ‬ ‫اﻷﺧطﺎء‬ ‫ﻋدد‬ ‫وﯾﻘﻠل‬
.‫ﻓﻘط‬ ‫اﻟﻣﻠف‬ ‫ھذا‬ ‫ﺗﺣﻣﯾل‬ ‫أو‬ ‫ﻛﺎﻣﻠﺔ‬ ‫ﻣﻛﺗﺑﺔ‬ ‫أﺻل‬ ‫ﻣن‬ ‫واﺣد‬ ‫ﺳﻛرﺑت‬ ‫ﺟﺎﻓﺎ‬ ‫ﻣﻠف‬ ‫ﺗﺿﻣﯾن‬ ‫ﯾﻣﻛﻧك‬
●
‫ﺑﻣﺗﺎﺑﻌﺔ‬ ‫ﺑﺷرﻛﺔ‬ ‫اﻟﺧﺎﺻﺔ‬ ‫اﻟﺳﯾﺎﺳﺔ‬ ‫ﺳﺗﺳﻣﺢ‬ ‫وھل‬ ،‫ﺑﺎﺳﺗﺧداﻣﮭﺎ‬ ‫ﺗرﻏب‬ ‫اﻟﺗﻲ‬ ‫ﺑﺎﻟﻣﻛﺗﺑﺔ‬ ‫اﻟﺧﺎص‬ ‫اﻹﺻدار‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ﯾﺟب‬
.‫اﻹﺻدار‬ ‫ھذا‬ ‫ﻋﻠﻰ‬ ‫اﻟوﻗوف‬ ‫أم‬ ‫اﻟﻣﺳﺗﻘﺑﻠﯾﺔ‬ ‫اﻟﺗﺣدﯾﺛﺎت‬
●
.‫ﺑذﻟك‬ ‫ﯾﺳﻣﺢ‬ ‫ﻻ‬ ‫وﻣﺎ‬ ‫ﺧﺎرﺟﯾﺔ‬ ‫ﻛﻣﻛﺗﺑﺔ‬ ‫ﺑﺎﺳﺗﺧداﻣﮫ‬ ‫ﯾﺳﻣﺢ‬ ‫ﻣﺎ‬ ‫ﺗﺣدﯾد‬ ‫اﻟﺷرﻛﺔ‬ ‫ﻋﻠﻰ‬ ‫ﯾﺟب‬
●
‫اﻟﺟزﺋﯾﺎت‬ ‫وﺳﺣب‬ ‫ﻟﻣﻌﺎﻟﺟﺔ‬ ‫ﺑﮭﺎ‬ ‫ﺧﺎﺻﺔ‬ branch ‫ﻓﺗﺢ‬ ‫ﺛم‬ ‫وﻣن‬ ‫اﻟﺧﺎرﺟﯾﺔ‬ ‫اﻟﻣﻛﺗﺑﺔ‬ ‫ﻣن‬ ‫ﻧﺳﺧﺔ‬ ‫ﺳﺣب‬ ‫ﻟﻠﺷرﻛﺔ‬ ‫ﯾﻣﻛن‬
.‫اﻷﺻﻠﯾﺔ‬ ‫ﺑﺎﻟﻣﻛﺗﺑﺔ‬ ‫ﺗﺗﺄﺛر‬ ‫أن‬ ‫ودون‬ ،‫ﻏﯾرھﺎ‬ ‫دون‬ ‫ﻓﻘط‬ ‫ﺑﮭﺎ‬ ‫ﺗﮭﺗم‬ ‫اﻟﺗﻲ‬

‫ﻗﻠﺒﻚ‬ ‫ﻓﻠﺘﺠﻌﻞ‬ ،‫ﻋﻈﻴﻤﺔ‬ ‫ﻋﻠﻴﻨﺎ‬ -‫وﺗﻌﺎﻟﻰ‬ ‫ﺳﺒﺤﺎﻧﻪ‬- ‫ﷲ‬ ‫ﻧﻌﻢ‬ ‫إن‬
‫وﻟﺘﺠﻌﻞ‬ ،‫ﻋﻠﻴﻚ‬ -‫وﺗﻌﺎﻟﻰ‬ ‫ﺳﺒﺤﺎﻧﻪ‬- ‫ﷲ‬ ‫ﺑﻔﻀﻞ‬ ‫ﻳﻌﺘﺮف‬ ‫ﺎ‬ ً
‫دوﻣ‬
‫وﻫﺐ‬ ‫ﻣﺎ‬ ‫ﻋﻠﻰ‬ -‫وﺗﻌﺎﻟﻰ‬ ‫ﺳﺒﺤﺎﻧﻪ‬- ‫ﻟﻠﻪ‬ ‫واﻟﺸﻜﺮ‬ ‫اﻟﺜﻨﺎء‬ ‫داﺋﻢ‬ ‫ﻟﺴﺎﻧﻚ‬
‫ﺑﻪ‬ ‫وﻧﻄﻖ‬ ،‫ﻗﻠﺒﻚ‬ ‫أﺧﻔﺎه‬ ‫ﻣﺎ‬ ‫ﻈﻬﺮ‬ ُ
‫ﺗ‬ ‫ﺟﻮارﺣﻚ‬ ‫وﻟﺘﺠﻌﻞ‬ ،‫وأﻋﻄﻰ‬
‫ﻣﺎ‬ ‫ﻛﻞ‬ ‫وﺗﺠﻨﺐ‬ ،‫ﷲ‬ ‫أﺣﻠﻪ‬ ‫ﻣﻤﺎ‬ ‫ﷲ‬ ‫رزﻗﻚ‬ ‫ﻣﺎ‬ ‫اﺳﺘﻌﻤﺎل‬ ‫ﻓﻲ‬ ‫ﻟﺴﺎﻧﻚ‬
.‫ﻋﻨﻪ‬ ‫ﷲ‬ ‫ﻧﻬﺎك‬

REDIRECTS ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬
‫ال‬ ‫ﻓﻲ‬ ‫ﻟدﯾك‬ ‫اﻟﺗﻲ‬ ‫اﻟﺿﻌف‬ ‫ﻧﻘطﺔ‬ ‫اﺳﺗﻐﻼل‬ ‫ﻣﺣﺎوﻟﺔ‬ ‫ھﻲ‬ attackers ‫ال‬ ‫ﯾﺳﺗﺧدﻣﮭﺎ‬ ‫واﻟﺗﻲ‬ ‫اﻟﺳﮭﻠﺔ‬ ‫اﻟطرق‬ ‫ﻣن‬ ‫واﺣدة‬
‫أن‬ ‫اﻷﻣر‬ ‫ھذا‬ ‫ﺧطورة‬ ‫ﺗﻛﻣن‬ ،‫ﺑك‬ ‫اﻟﺧﺎص‬ ‫اﻟﻣوﻗﻊ‬ ‫ﻟﻣﺳﺗﺧدﻣﻲ‬ phishing ‫ﻋﻣل‬ ‫ﻣن‬ ‫ﺳﺗﻣﻛﻧﮫ‬ ‫واﻟﺗﻲ‬ redirects ﬂow
attackers ‫ال‬ ‫ﻟﻣوﻗﻊ‬ ‫ذھب‬ ‫اﻧﮫ‬ ‫ﯾﻧﺗﺑﮫ‬ ‫أن‬ ‫دون‬ ‫ﻣن‬ ‫اﻟﺗﺻﯾد‬ ‫ھذا‬ ‫ﺿﺣﯾﺔ‬ ‫ﯾﻘﻊ‬ ‫ﻗد‬ ‫اﻟﻣﺳﺗﺧدم‬
:‫ﻣﺛﺎل‬
‫ﺧﻼل‬ ‫ﻣن‬ ‫أو‬ ‫ﻣﻣﻛﻧﺔ‬ ‫طرﯾﻘﺔ‬ ‫ﺑﺄي‬ url ‫ال‬ ‫ﻓﻲ‬ ‫اﻟراﺑط‬ ‫ﺗﻌدﯾل‬ ‫اﻟﻣﮭﺎﺟم‬ ‫اﺳﺗطﺎع‬ ‫إذا‬ ‫ﺑﺳﺎطﺔ‬ ‫ﺑﻛل‬ ‫اﻟﮭﺟﻣﺔ؟‬ ‫ھذه‬ ‫ﺗﺗم‬ ‫ﻛﯾف‬
:‫ﻓﯾﮫ‬ ‫ﻛﺎن‬ js ﬁle ‫ال‬ ‫ﻓرﺿﻧﺎ‬ ‫ﻟو‬ ‫ﻓﻣﺛﻼ‬ ،!‫أراد‬ ‫ﻣﺎ‬ ‫ﻟﮫ‬ ‫ﺳﯾﺗم‬ ‫اﻟﻣوﻗﻊ‬ ‫ﻓﻲ‬ ‫اﻟﺣﻣﺎﯾﺔ‬ ‫ﻧظم‬ ‫وﺿﻌف‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ﺟﮭل‬ ‫إﺳﺗﻐﻼل‬
...‫ﺑﺳﮭوﻟﺔ‬ ‫ﻣﺗﺎﺣﺔ‬ ‫اﻟﮭﺟﻣﺔ‬ ‫ھذه‬ ‫ﻓﺳﺗﻛون‬ ‫ﺗﺣﻘق‬ ‫دون‬ ‫وﻣن‬ window.location.href=getParam(url)
:‫اﻷﺻﻠﻲ‬ ‫اﻟراﺑط‬
http://www.mywebsite.com/redirect?URL=http://mywebsite.com/myLogin
:‫ﻟﻠراﺑط‬ ‫اﻟﻣﮭﺎﺟم‬ ‫ﺗﻌدﯾل‬ ‫ﺑﻌد‬ ‫اﻟراﺑط‬
http://www.mywebsite.com/redirect?URL=http://attackers.com/fakeLogin

REDIRECTS ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬
‫ﻋدة‬ ‫ﻓﻲ‬ ‫ﺑﮭذا‬ ‫اﻟﻘﯾﺎم‬ ‫وﯾﻣﻛن‬ ،!‫ﺻﺣﯾﺢ‬ ‫إﻟﯾﮫ‬ ‫اﻟذھﺎب‬ ‫اﻟﻣراد‬ ‫اﻟراﺑط‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ reviewer ‫ال‬ ‫ﻋﻠﻰ‬ ‫ﯾﺟب‬ ‫ﻣﺎ‬ ،‫ﻟذﻟك‬
:‫طرق‬
●
،‫ﺻﺣﯾﺢ‬ ‫ﻟﮫ‬ ‫اﻟﺗﺣوﯾل‬ ‫اﻟﻣراد‬ url ‫ﺑﺎل‬ ‫اﻟﺧﺎص‬ domain ‫ال‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ذﻟك‬ ‫وﯾﻛون‬ Whitelist
‫ﻣﺛﻼ‬ url ‫ال‬ ‫ﻓﻲ‬ ‫ﻣوﺟود‬ ‫ھو‬ ‫وﻣﺎ‬ ‫إﻟﯾﮫ‬ ‫اﻟﺗﺣوﯾل‬ ‫اﻟﻣراد‬ url ‫ال‬ ‫ﺑﯾن‬ mapping ‫ﺗﻣﺛل‬ keys ‫وﺿﻊ‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫أو‬
‫ﺗﻌﻧﻲ‬ mywebsite.com/redirect/login
mywebsite.com/redirect?URL=mywebsite.com/login.php
●
،‫اﻟﺗﺣوﯾل‬ ‫ﻋﻧد‬ ‫اﻟﺗﺷﻔﯾر‬ ‫ﻓك‬ ‫وﯾﺗم‬ ،‫ﻣﺷﻔر‬ ‫إﻟﯾﮫ‬ ‫اﻟذھﺎب‬ ‫اﻟﻣراد‬ url ‫ال‬ ‫وﺿﻊ‬ ‫ﯾﺗم‬ ‫اﻟﻌﻣﻠﯾﺔ‬ ‫ھذه‬ ‫ﺧﻼل‬ ‫ﻣن‬ :Encrypt
.‫اﻟﺗﺷﻔﯾر‬ ‫ﻟﻔك‬ ‫اﻟﻣﻧﺎﺳب‬ key ‫ال‬ ‫ﯾﺟد‬ ‫ﺣﺗﻰ‬ ‫اﻟﻌﻣﻠﯾﺔ‬ ‫اﻟﻣﺧﺗرق‬ ‫ﻋﻠﻰ‬ ‫ﺗﺻﻌب‬ ‫اﻟﻌﻣﻠﯾﺔ‬ ‫ھذه‬

Error Handling ‫ال‬
‫ﻣرﺟﻌﯾﺔ‬ ‫ﻣن‬ ‫اﻷﺧطﺎء‬ ‫ھذه‬ ‫ﺗﺷﻛﻠﮫ‬ ‫ﻟﻣﺎ‬ ،!‫اﻟﻌﻠﯾﺎ‬ ‫اﻷھﻣﯾﺔ‬ ‫ذات‬ ‫اﻟﺗﻘﻧﯾﺔ‬ ‫اﻟﻣواﺿﯾﻊ‬ ‫ﻣن‬ ‫وﻣﺗﺎﺑﻌﺗﮭﺎ‬ ‫اﻷﺧطﺎء‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫ﺗﻌﺗﺑر‬
‫ﯾﺗم‬ ‫ﻟم‬ ‫إذا‬ ‫ﻟﻛن‬ ،‫اﻟﻧظﺎم‬ ‫ﻣﺳﺗﺧدﻣﯾن‬ ‫ﻋﻧد‬ ‫ﺗظﮭر‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣﺧﺗﻠﻔﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫وﺗﺣدﯾد‬ ،‫وﻣﻌﺎﻟﺟﺗﮭﺎ‬ ‫ﻣواﻗﻌﮭﺎ‬ ‫ﻻﻛﺗﺷﺎف‬ ‫ﻟﻠﻣطورﯾن‬
‫ﻣﻌﻠوﻣﺎت‬ ‫إﻟﻰ‬ ‫ﻟﻠوﺻول‬ attackers ‫ﻟل‬ ‫وﺳﯾﻠﺔ‬ ‫اﻷﺧطﺎء‬ ‫ھذه‬ ‫ﺗﻛون‬ ‫ﻗد‬ ‫ﺻﺣﯾﺣﺔ‬ ‫طرﯾﻘﺔ‬ ‫ﻓﻲ‬ ‫ﺑﮭﺎ‬ ‫واﻟﺗﺣﻛم‬ ‫اﻷﺧطﺎء‬ ‫ﻣﻌﺎﻟﺟﺔ‬
‫اﻷﺧطﺎء‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫ﯾﺗم‬ ‫ﻣﺎ‬ ‫وﻋﺎدة‬ ،‫ﻟﻠﻣﺳﺗﺧدﻣﯾن‬ ‫أﺳﮭل‬ ‫أﻣرا‬ ‫اﻷﺧطﺎء‬ ‫ھذه‬ ‫اﺳﺗﻐﻼل‬ ‫وﺗﺟﻌل‬ ،‫ﺳﮭﻼ‬ ‫أﻣرا‬ ‫اﺧﺗراﻗك‬ ‫ﻣن‬ ‫ﺗﺟﻌل‬
:‫ھﻣﺎ‬ ‫ﺑطرﯾﻘﺗﯾن‬
.1
‫ھذه‬ ‫ﻋن‬ ‫ﻟﻠﻣﺳؤوﻟﯾن‬ notiﬁcation ‫وإرﺳﺎل‬ session ‫ال‬ ‫وإﻏﻼق‬ ،‫اﻟﺗطﺑﯾق‬ ‫أو‬ ‫ﻟﻠﻧظﺎم‬ lock ‫ﻋﻣل‬ ‫ﺧﻼل‬ ‫ﻣن‬
…‫اﻷﻧظﻣﺔ‬
.2
‫اﻟﺧطﺄ‬ ‫وإظﮭﺎر‬ ‫اﻟﺟزﺋﯾﺔ‬ ‫ھذه‬ ‫ﻋﻠﻰ‬ ‫اﻟﻌﻣل‬ ‫ﺳﯾر‬ ‫ﻣﺗﺎﺑﻌﺔ‬ ‫ﻣن‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ﻣﻧﻊ‬ ‫طرﯾق‬ ‫ﻋن‬ ‫ﺑﺎﻷﺧطﺎء‬ ‫اﻟﺗﺣﻛم‬ ‫ﺧﻼل‬ ‫ﻣن‬
...-404 ‫أو‬ 500 ‫ﻣﺛﻼ‬ ‫ﻣﻧﻔﺻﻠﺔ‬ ‫ﺻﻔﺣﺔ‬ ‫ﻓﻲ‬ ‫ﺗﻛون‬ ‫ﻣﺎ‬ ‫وﻋﺎدة‬- ‫ﻟﮫ‬ ‫اﻟﻣﻧﺎﺳب‬

‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻋﻧد‬ code reviewer ‫ال‬ ‫ﯾراﻋﯾﮭﺎ‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﻧﺻﺎﺋﺢ‬ ‫ﺑﻌض‬ ‫ھﻧﺎك‬ ،‫ﺳﺑق‬ ‫ﻣﺎ‬ ‫ﻋﻠﻰ‬ ‫ﺑﻧﺎءا‬
:(‫ﺑﻌﺿﮭﺎ‬ ‫ﻣﻧﮭﺎ‬ ‫)ﻧذﻛر‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻷﺧطﺎء‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫طرﯾﻘﺔ‬ ‫ﻣن‬ ‫واﻟﺗﺣﻘق‬
●
‫وال‬ physical) ‫ال‬ ‫ﺑﺷﻘﯾﮫ‬ Hardware ‫ال‬ ‫وھﻲ‬ ‫ﻣﺻﺎدر‬ 4 ‫ﻣن‬ ‫ﺗﺄﺗﻲ‬ ‫أن‬ ‫ﯾﻣﻛن‬ ‫ﺗطﺑﯾق‬ ‫ﻷي‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻷﺧطﺎء‬
‫ﻣﺗطﻠﺑﺎت‬ ‫ﺗﺗطﺎﺑق‬ ‫ﻻ‬ ‫أو‬ ‫اﻟﺑﯾزﻧس‬ ‫ﻣﺗطﻠﺑﺎت‬ ‫ﻣﻊ‬ ‫ﺗﺗواﻓق‬ ‫ﻻ‬ ‫اﻟﺗطﺑﯾق‬ ‫)ﻧﺗﺎﺋﺞ‬ business logic ‫وال‬ (technical
prod, dev, ‫ال‬ ‫ﻣﺛل‬ env ‫ب‬ ‫اﻟﺧﺎﺻﺔ‬ ‫اﻷﺧطﺎء‬ ‫)وھﻲ‬ environment ‫وال‬ (‫اﻟﻣﺗوﻓرة‬ ‫اﻟﺗﻘﻧﯾﺔ‬ ‫ﻣﻊ‬ ‫اﻟﺑﯾزﻧس‬
dependence ‫وال‬ (‫ﺑﺎﺳﺗدﻋﺎﺋﮫ‬ ‫أو‬ env ‫ال‬ ‫ﻣﻠف‬ ‫إﻋداد‬ ‫ﻓﻲ‬ ‫ﻟﺧطﺄ‬ ‫ﻧﺗﯾﺟﺔ‬ ‫ﺗﺣﺻل‬ ‫واﻟﺗﻲ‬ ‫آﺧره‬ ‫إﻟﻰ‬...test
‫ﺑﻲ‬ ‫اﻟﺧﺎص‬ ‫اﻟﺗطﺑﯾق‬ ‫ﻋﻠﻰ‬ ‫أﺛر‬ ‫ﺧﻠل‬ ‫ﻓﯾﮭﺎ‬ ‫ﺣﺻل‬ ‫ﻓﺈن‬ ‫اﻟﺗطﺑﯾق‬ ‫وﺟودھﺎ‬ ‫ﻋﻠﻰ‬ ‫ﯾﻌﺗﻣد‬ ‫اﻟﺗﻲ‬ ‫اﻷﺧطﺎء‬ ‫ﺟﻣﯾﻊ‬ ‫ﺗﻣﺛل‬ ‫)واﻟﺗﻲ‬
‫ﻓﺈن‬ ،(‫اﻟﻌﻣل‬ ‫أﺛﻧﺎء‬ ‫ﻟﻠﻣطور‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫أﺧطﺎء‬ ‫أو‬ third part library ‫ﻣﺛل‬ ‫ﻣﺑﺎﺷر‬ ‫ﻏﯾر‬ ‫أو‬ ‫ﻣﺑﺎﺷر‬ ‫ﺑﺷﻛل‬
‫ﻣﺎھﯾﺗﮭﺎ‬ ‫ﻟﺗﺣدﯾد‬ ‫اﻟﻣﺗوﻗﻌﺔ‬ ‫اﻷﺧطﺎء‬ ‫ﻟطﺑﯾﻌﺔ‬ ‫ﺗﻧظر‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫ﻣراﺟﻌﺔ‬ ‫أن‬ ‫ﻋﻠﻣت‬ ،‫اﻷﻧواع‬ ‫ھذه‬ ‫ﻋﻠﻣت‬
...‫واﻟﻣﻧﺎﺳﺑﺔ‬ ‫اﻟﺻﺣﯾﺣﺔ‬ ‫ﺑﺎﻟطرﯾﻘﺔ‬ ‫وﻣﻌﺎﻟﺟﺗﮭﺎ‬

●
‫ﻟل‬ ‫وإرﺳﺎﻟﮭﺎ‬ ‫ﺑﺎﻷﺧطﺎء‬ ‫اﻟﺧﺎص‬ response ‫ﺑﺎل‬ ‫ﻟﻠﺗﺣﻛم‬ apache ‫ال‬ ‫ﻣﺛل‬ servers ‫ال‬ ‫اﺳﺗﺧدام‬ ‫ﯾﻣﻛن‬
:‫ﻓﻣﺛﻼ‬ ‫وﻣوﺣدة‬ ‫ﻣﻧﺎﺳﺑﺔ‬ ‫ﺑطرﯾﻘﺔ‬ client
(‫ﻣﺑﺎﺷرا‬ ‫ﺑﺎﻋﺗﺑﺎره‬ ‫ﻟﻸﺳﻠوب‬ ‫ﺗطرﻗﻧﺎ‬ ‫ﻟﻛﻧﻧﺎ‬ ‫أﺧرى‬ ‫طرق‬ ‫)ھﻧﺎك‬
●
‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﻋﻠﯾك‬ ‫وﯾﺟب‬ ،try catch ‫داﺧل‬ ‫وﺿﻌﮫ‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬ exception ‫ﯾﺻدر‬ ‫أن‬ ‫ﯾﺗوﻗﻊ‬ ‫ﺧطﺄ‬ ‫أي‬
!catch ‫ال‬ ‫داﺧل‬ ‫اﻟﻣوﺟود‬ scenario
●
‫ﺧطﺄ‬ ‫أي‬ ‫ﺗﮭﻣل‬ ‫ﻻ‬
●
sql queries ‫ال‬ ‫ﻣﺛل‬ ‫ﻣﻌﺎﻟﺟﺗﮫ‬ ‫ﺗم‬ ‫ﻟﻣﺎ‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫أي‬ ‫ﺗظﮭر‬ ‫ﻻ‬ ‫ﻣﻧﺎﺳﺑﺔ‬ ‫ﺑطرﯾﻘﺔ‬ ‫اﻷﺧطﺎء‬ ‫ﺑﻌرض‬ ‫ﻗم‬
●
12-1 ‫ﻣن‬ ‫اﻷﺷﮭر‬ ‫ﻣﺛﻼ‬ ‫إدﺧﺎﻟﮭﺎ‬ ‫اﻟﻣﺳﻣوح‬ ‫اﻟﻘﯾم‬ ‫ﻣﺟﻣوﻋﺔ‬ ‫ﺿﻣن‬ ‫وأﻧﮭﺎ‬ ‫إدﺧﺎﻟﮭﺎ‬ ‫ﯾﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﻌﻧﺎﺻر‬ ‫ﺟﻣﯾﻊ‬ ‫ﻣن‬ ‫ﺗﺣﻘق‬
‫واﻟﺣرﻛﺎت‬ user ‫ال‬ ‫ھذا‬ ‫ﻣﺗﺎﺑﻌﺔ‬ ‫أﻣر‬ ‫ﯾﺟﻌل‬ ‫ﻣﻛﺎن‬ ‫ﻓﻲ‬ ‫ﺑﮫ‬ ‫اﻟﺧﺎص‬ log ‫ال‬ ‫وﺣﻔظ‬ ‫ﻣﻧﻌﮫ‬ ‫ﻓﯾﺟب‬ 13 ‫أﺣدھم‬ ‫أرﺳل‬ ‫إذا‬
.attacker ‫ﯾﻛون‬ ‫أن‬ ‫ﻻﺣﺗﻣﺎﻟﯾﺔ‬ ‫ﺳﮭﻼ‬ ‫أﻣرا‬ ‫ﺑﮭﺎ‬ ‫ﯾﻘوم‬ ‫اﻟﺗﻲ‬
ErrorDocument 404 /errors/not_found.html

‫اﻟﺧﻼﺻﺔ‬
checklist ‫ال‬ ‫ﺳﺗﻣﺛل‬ ‫واﻟﺗﻲ‬ ،‫ﺗطﺑﯾق‬ ‫أي‬ ‫ﻣراﺟﻌﺔ‬ ‫ﻋﻧد‬ ‫ﻣراﺟﻌﺗﮭﺎ‬ ‫ﯾﺟب‬ ‫اﻟﺗﻲ‬ ‫اﻟﻧﻘﺎط‬ ‫أھم‬ ‫ﺑﺗﻠﺧﯾص‬ ‫ﺳﻧﻘوم‬ ،‫اﻟطرح‬ ‫ھذا‬ ‫ﺑﻌد‬
-FAIL ‫وإﻣﺎ‬ PASS ‫إﻣﺎ‬ ‫اﻟﺗﺣﻘق‬ ‫ﺑﻌد‬ ‫اﻷﺳﺋﻠﺔ‬ ‫ھذه‬ ‫ﻋﻠﻰ‬ ‫اﻹﺟﺎﺑﺔ‬ :‫ﻣﻼﺣظﺔ‬- :‫ب‬ ‫ﺗﻣﺛﯾﻠﮭﺎ‬ ‫وﯾﻣﻛن‬ ،‫ﺑﻧﺎ‬ ‫اﻟﺧﺎﺻﺔ‬
:General Category :‫أوﻻ‬
●
‫ﻣﺣﺗﻣﻠﺔ؟‬ backdoor ‫أي‬ ‫ھﻧﺎك‬ ‫ﯾوﺟد‬ ‫ھل‬
●
process ‫ال‬ ‫ﺿﻣن‬ ‫ھﻲ‬ ‫وھل‬ ‫؟‬updated ‫ﺑﻧﺎ‬ ‫اﻟﺧﺎص‬ ‫اﻟﺗطﺑﯾق‬ ‫ﻓﻲ‬ ‫اﻟﻣﺳﺗﺧدﻣﺔ‬ external library ‫ال‬ ‫ھل‬
‫ﺗﺣدﯾﺛﮭﺎ؟‬ ‫ﺗﺿﻣن‬ ‫اﻟﺗﻲ‬
●
.protected api ‫ال‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﻣﮭﻣﺔ‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫ﻋﻠﻰ‬ ‫ﯾﺣﺗوي‬ Class ‫أي‬ ‫إﻟﻰ‬ ‫اﻟوﺻول‬
●
‫ال‬ ‫ﻓﻲ‬ ‫طوﯾﻠﺔ‬ ‫وﻟﻣدة‬ plan text ‫ﺷﻛل‬ ‫ﻋﻠﻰ‬ ‫ﺗﺧزﯾﻧﮭﺎ‬ ‫ﯾﺗم‬ ‫ﻻ‬ ‫أن‬ ‫ﯾﺟب‬ ‫اﻷﻣﺎن‬ ‫ﻣﻌﻠوﻣﺎت‬ ‫ﺑﺄن‬ ‫اﻟﺗﺄﻛد‬ ‫ﯾﺟب‬
.memory

●
(‫اﻷﺷﮭر‬ ‫)ﻣﺛﺎل‬ range ‫ال‬ ‫ﺿﻣن‬ Array ‫ال‬ ‫ﻣﺣﺗوﯾﺎت‬ ‫ﺟﻣﯾﻊ‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
●
‫ﻣﺣﻠﮫ؟‬ ‫ﻓﻲ‬ ‫اﺳﺗﺧداﻣﮭﺎ‬ ‫وھل‬ ‫ذﻟك؟‬ ‫ﯾﻠزم‬ ‫وھل‬ ،‫ﺟﻠﺑﮭﺎ‬ ‫ﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﺣﺳﺎﺳﺔ‬ ‫اﻟﻣﻌﻠوﻣﺎت‬ ‫ﺟﻣﯾﻊ‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ﯾﺟب‬
:Business Logic and Design :‫ﺛﺎﻧﯾﺎ‬
●
‫ﻣﺳﺗﺧدﻣﺔ؟‬ ‫وﻏﯾر‬ ‫ﻣوﺟودة‬ conﬁguration ‫أي‬ ‫ھﻧﺎك‬ ‫ھل‬
●
‫ال‬ ‫ﻓﮭل‬ ،business logic ‫ﺑﺎل‬ ‫ﯾﺗﻌﻠق‬ ﬂow ‫ﺳﺗﺣدد‬ request parameters ‫ال‬ ‫ﻛﺎﻧت‬ ‫إذا‬
‫ﺑذﻟك؟‬ ‫ﻟﮫ‬ ‫وﺗﺳﻣﺢ‬ ‫ﺻﺣﯾﺣﺔ؟‬ ‫إﻟﯾﮭﺎ‬ ‫ﺳﯾﺻل‬ ‫اﻟﺗﻲ‬ actions ‫وال‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ھذا‬ ‫ﺻﻼﺣﯾﺎت‬ ‫ﺑﯾن‬ mapping
●
‫وﺿﻣن‬ object instance ‫ال‬ ‫ﻣﻊ‬ ‫ﺗﺗواﻓق‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ﻗﺑل‬ ‫ﻣن‬ ‫إرﺳﺎﻟﮭﺎ‬ ‫ﺗم‬ ‫اﻟﺗﻲ‬ ‫اﻟﻣدﺧﻼت‬ ‫ﻣن‬ ‫اﻟﺗﺄﻛد‬ ‫ﯾﺟب‬
‫ﺷﻛل‬ ‫ﻋﻠﻰ‬ price ‫ﺑﺈرﺳﺎل‬ ‫ﻣﺛﻼ‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ﻗﺎم‬ ‫ﻓﺈذا‬ ،param ‫ال‬ ‫ھذا‬ ‫وﻣن‬ ،‫اﻟﺗﻐﯾﯾر‬ ‫أو‬ ‫ﻟﻠﺗﻌدﯾل‬ ‫اﻟﻣﺳﻣوﺣﺔ‬ ‫اﻟﻘواﻋد‬
‫ﻟﻣﻧﻊ‬ ‫اﻹﻓﺗراﺿﯾﺔ‬ object ‫ال‬ ‫ﻗﯾﻣﺔ‬ ‫ﻟﺗﺑﻘﻰ‬ ‫ﻣﻌﺎﻟﺟﺗﮭﺎ‬ ‫ﻓﯾﺟب‬ ‫ﺗم‬ ‫وإن‬ ،‫ﻟﮭﺎ‬ binding ‫ﻋﻣل‬ ‫ﯾﺗم‬ ‫ﻻ‬ ‫أن‬ ‫ﯾﺟب‬ param
!‫ﺗﻐﯾﯾر‬ ‫أي‬

●
‫ﺧﻼﻟﮫ‬ ‫ﻣن‬ ‫ﯾﻣﻛن‬ param ‫أو‬ ‫ﻟﻣﻛﺎن‬ ‫وﺟود‬ ‫وﻻ‬ ‫اﻟﺻﺣﯾﺢ‬ ‫ﺑﺎﻟﺷﻛل‬ ‫ﻣﻧﻔذة‬ ‫اﻟﺗﺣﻘق‬ ‫ﻋﻣﻠﯾﺔ‬ ‫أن‬ ‫ﻣن‬ ‫ﺗﺗﺣﻘق‬ ‫أن‬ ‫ﯾﺟب‬
.backdoor ‫ﺗﻛوﯾن‬
●
‫وﻻ‬ ‫ﺿرورﯾﺔ‬ web root directory ‫ال‬ ‫ﻓﻲ‬ ‫اﻟﻣوﺟودة‬ ‫واﻟﻣﺟﻠدات‬ ‫اﻟﻣﻠﻔﺎت‬ ‫ﺟﻣﯾﻊ‬ ‫أن‬ ‫ﻣن‬ ‫ﺗﺗﺣﻘق‬ ‫أن‬ ‫ﯾﺟب‬
.‫ﻻﺣﻘﺎ‬ ‫ﻟﻠﺗطﺑﯾق‬ ‫ﻣﺧﺎطر‬ ‫ﯾﺷﻛل‬ ‫ﻗد‬ ‫ﻣﺎ‬ ‫ﯾوﺟد‬
●
.Access All ‫ﺻﻼﺣﯾﺔ‬ ‫ﯾﻌطﻲ‬ conﬁguration ‫أي‬ ‫وﺟود‬ ‫ﻋدم‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
●
ﬂat database ‫ال‬ ‫ﯾﺳﺗﺧدم‬ ‫ﻻ‬ ‫اﻟﻧظﺎم‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
●
‫ال‬ ‫وﺟﻣﯾﻊ‬ inputs ‫ال‬ ‫ﺟﻣﯾﻊ‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫وﺑﺈﻣﻛﺎﻧﮫ‬ validation centralized ‫ال‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
‫وأﯾن؟‬ ‫ﻓﻠﻣﺎذا‬ ‫اﺳﺗﺛﻧﺎء‬ ‫ھﻧﺎك‬ ‫ﻛﺎن‬ ‫وإن‬ ،requests
●
‫وإن‬ ،‫وﺻوﻟﮭﺎ‬ ‫ﯾﻣﻧﻊ‬ special characters ‫ال‬ ‫ﯾﻌﺎﻟﺞ‬ validation centralized ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
‫وأﯾن؟‬ ‫وﻟﻣﺎذا‬ ‫ﻣﺳﺑﻘﺎ‬ ‫ﺗﺣدﯾدھﺎ‬ ‫ﻓﯾﺟب‬ ‫اﺳﺗﺛﻧﺎءات‬ ‫ھﻧﺎك‬ ‫ﻛﺎن‬

●
‫ﻣﻌﯾن؟‬ ‫ﻟﺳﺑب‬ ‫أو‬ ‫ﻣﻌﯾﻧﺔ‬ ‫ﻣرﺣﻠﺔ‬ ‫ﻋﻧد‬ validation ‫ال‬ ‫ﺗﻣﻧﻊ‬ ﬂow ‫ال‬ ‫ﻓﻲ‬ ‫ﺟزﺋﯾﺔ‬ ‫أي‬ ‫ﯾوﺟد‬ ‫ھل‬
●
‫ﻟﻠوﺻول‬ connection ‫ﺑﺈﻧﺷﺎء‬ ‫ﯾﺳﻣﺢ‬ ‫أو‬ ‫اﻟﺗﺷﻐﯾل‬ ‫ﻧظﺎم‬ ‫ﻋﻠﻰ‬ (commands) ‫أواﻣر‬ ‫ﺑﺗﻧﻔﯾذ‬ ‫ﯾﺳﻣﺢ‬ ‫اﻟﻧظﺎم‬ ‫ھل‬
‫اﻟﺧﺎرج؟‬ ‫ﻣن‬ ‫إﻟﯾﮫ‬
●
‫اﻟﻣﺳﺗﺧدم؟‬ ‫اﺣﺗﯾﺎﺟﺎت‬ ‫وﺗﻠﺑﻲ‬ ‫ﯾﻣﻛن‬ ‫ﻣﺎ‬ ‫أﻗل‬ ‫ھﻲ‬ ‫ﻟﻠﻣﺳﺗﺧدﻣﯾن‬ ‫اﻟﻣﻌطﺎة‬ privileges ‫ال‬ ‫ھل‬
●
‫ﺑﺳﻼﺳﺔ؟‬ ‫اﻷﺧطﺎء‬ ‫ﻣﻊ‬ ‫ﻟﻠﺗﻌﺎﻣل‬ ‫ﺗﺻﻣﯾﻣﮭﺎ‬ ‫ﺗم‬ ‫اﻟﺑرﻣﺟﯾﺔ‬ ‫اﻟﺷﯾﻔرة‬ ‫أو‬ ‫اﻟﺗطﺑﯾق‬ ‫ھل‬
:Authorization :‫ﺛﺎﻟﺛﺎ‬
●
‫ﺻﺣﯾﺢ؟‬ ‫ﺑﺷﻛل‬ authorization ‫وال‬ authentication ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺗم‬ ‫ھل‬
●
‫؟‬request ‫ال‬ ‫ﺗﻧﻔﯾذ‬ ‫ﻋن‬ ‫اﻟﺗطﺑﯾق‬ ‫ﯾﺗوﻗف‬ ‫ھل‬ ،‫اﻟﺗﺣﻘق‬ ‫ﻋﻧد‬ fail ‫أي‬ ‫وﺟود‬ ‫ﺣﺎل‬ ‫ﻓﻲ‬
●
.authorization ‫ال‬ ‫ﻓﻲ‬ backdoor ‫أي‬ ‫وﺟود‬ ‫ﻋدم‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬

●
‫ﺑﺎﻟﺷﻛل‬ web root directory ‫ﻋﻠﻰ‬ ‫اﻟﻣوﺟودة‬ ‫واﻟﻣﻠﻔﺎت‬ ‫اﻟﻔوﻟدرات‬ ‫ﻣﺳﺗوى‬ ‫ﻋﻠﻰ‬ ‫اﻟﺻﻼﺣﯾﺎت‬ ‫ﺗوزﯾﻊ‬ ‫ﺗم‬ ‫ھل‬
‫اﻟﺻﺣﯾﺢ؟‬
●
‫؟‬user input ‫ال‬ ‫ﻋﻠﻰ‬ validation ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﻗﺑل‬ ‫اﻷﻣﻧﯾﺔ‬ ‫اﻟﻣﺷﺎﻛل‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺗم‬ ‫ھل‬
●
‫اﻟﺻﺣﯾﺢ؟‬ ‫اﻟﺷﻛل‬ ‫ﻓﻲ‬ ‫ﻣﻧﮭﺎ‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺗم‬ ‫وھل‬ ‫اﻟﻣرور؟‬ ‫ﻟﻛﻠﻣﺔ‬ ‫اﻟﺗﻌﻘﯾد‬ ‫ﻣﺳﺗوى‬ ‫ﻟزﯾﺎدة‬ ‫ﻗواﻋد‬ ‫وﺿﻊ‬ ‫ﺗم‬ ‫ھل‬
●
...console ‫ال‬ ‫أو‬ logs ‫ال‬ ‫ﻣﺛل‬ ‫ﻣﻛﺎن‬ ‫أي‬ ‫ﻓﻲ‬ ‫ﺑﻛﺗﺎﺑﺗﮫ‬ ‫ﻓﻲ‬ ‫اﻟﻣﺳﺗﺧدم‬ ‫ﻗﺎم‬ ‫اﻟذي‬ password ‫ال‬ ‫ﻛﺗﺎﺑﺔ‬ ‫ﯾﺗم‬ ‫ھل‬
‫إﻟﺦ؟‬
●
‫ﻋﻣﻠﮭﺎ؟‬ ‫آﻟﯾﺔ‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﺗم‬ ‫وھل‬ ‫؟‬password expiration ‫ھﻧﺎك‬ ‫ھل‬
●
‫؟‬anti-spooﬁng measure ‫ال‬ ‫ﺗطﺑﯾق‬ ‫ﺗم‬ ‫ھل‬

:Session Management :‫راﺑﻌﺎ‬
●
‫آﻣن؟‬ session ‫ﺗﺿﻣن‬ ‫ھل‬ ،‫اﻟﺗطﺑﯾق‬ ‫ﺗﺻﻣﯾم‬ ‫طرﯾﻘﺔ‬
●
‫اﻷﻣﺎﻛن؟‬ ‫ﺟﻣﯾﻊ‬ ‫ﻓﻲ‬ session ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺗم‬ ‫وھل‬ ‫ﻣﻛﺎن؟‬ ‫ﻣن‬ ‫أﻛﺛر‬ ‫ﻓﻲ‬ session ‫ال‬ ‫ﻣﺷﺎرﻛﺔ‬ ‫ﯾﺗم‬ ‫ھل‬
●
!‫؟‬parameter ‫ﺧﻼل‬ ‫ﻣن‬ ‫إرﺳﺎﻟﮫ‬ ‫ﺗم‬ session ‫أي‬ ‫وﺟود‬ ‫ﻋدم‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
●
‫ﻗﺻﯾر‬ session cookie ‫ال‬ ‫ﺻﻼﺣﯾﺔ‬ ‫وﻗت‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬
●
session cookie encrypted ‫ال‬ ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬
●
session ‫ﺑﺎل‬ ‫اﻟﻣوﺟودة‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
●
complex ‫ﯾﻛون‬ ‫أن‬ ‫ﯾﺟب‬ session id ‫ال‬
●
.session in-activity timeout ‫ال‬ ‫ﺗطﺑﯾق‬ ‫ﯾﺟب‬

:Cryptography :‫ﺧﺎﻣﺳﺎ‬
●
‫؟‬encrypted format ‫ﺷﻛل‬ ‫ﻋﻠﻰ‬ ‫اﻟﻣرور‬ ‫ﻛﻠﻣﺔ‬ ‫ﺣﻔظ‬ ‫ﺗم‬ ‫ھل‬
●
‫؟‬encrypted format ‫ﺷﻛل‬ ‫ﻋﻠﻰ‬ database credential ‫ال‬ ‫ﺣﻔظ‬ ‫ﺗم‬ ‫ھل‬
●
‫؟‬Https, SSL ‫؟‬encrypted channel ‫ﺣﻼل‬ ‫ﻣن‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫إرﺳﺎل‬ ‫ﯾﺗم‬ ‫ھل‬
●
(https form action) ‫؟‬encrypted form ‫ﺧﻼل‬ ‫ﻣن‬ ‫واﻟﺣﺳﺎﺳﺔ‬ ‫اﻟﻣﮭﻣﺔ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﺟﻣﯾﻊ‬ ‫إرﺳﺎل‬ ‫ﯾﺗم‬ ‫ھل‬
●
‫اﻟﻘوﯾﺔ‬ ‫اﻟﺧوارزﻣﯾﺎت‬ ‫إﺣدى‬ ‫ﯾﺳﺗﺧدم‬ ‫أﻧﮫ‬ ‫أم‬ ‫؟‬custom encryption scheme ‫اﻟﻧظﺎم‬ ‫ﯾﺳﺗﺧدم‬ ‫ھل‬
‫واﻟﻣوﺛوﻗﺔ؟‬
●
‫ﺑﺄول؟‬ ‫أوﻻ‬ ‫اﻟﺧوارزﻣﯾﺎت‬ ‫ﺗﺣدﯾث‬ ‫ﺿﻣﺎن‬ ‫ﯾﺗم‬ ‫وھل‬ ‫اﻟﺗﺷﻔﯾر؟‬ ‫ﻧظﺎم‬ ‫إﺻدارات‬ ‫آﺧر‬ ‫إﺳﺗﺧدام‬ ‫ﯾﺗم‬ ‫ھل‬
●
(‫طرﯾﻘﺔ‬ ‫أﺳوأ‬ ‫أو‬ ‫أﺳوأ‬ ‫ﻣن‬ ‫)ﺗﻌد‬ ‫اﻟﻛود؟‬ ‫داﺧل‬ Cryptography ‫ﺑﺎل‬ ‫اﻟﺧﺎص‬ key ‫ال‬ ‫وﺿﻊ‬ ‫ﺗم‬ ‫ھل‬

:Logging and Auditing :‫ﺳﺎدﺳﺎ‬
●
‫؟‬log ‫ال‬ ‫داﺧل‬ sensitive data ‫أي‬ ‫ﺣﻔظ‬ ‫ﯾﺗم‬ ‫ھل‬
●
‫؟‬logs ‫ال‬ ‫داﺧل‬ connection ‫ﻟل‬ ‫واﻟﻔﺎﺷﻠﺔ‬ ‫اﻟﻧﺎﺟﺣﺔ‬ ‫اﻟﻣﺣﺎوﻻت‬ ‫ﺗﺳﺟﯾل‬ ‫ﯾﺗم‬ ‫ھل‬
●
‫ﺳﻠوك‬ ‫وﺟود‬ ‫ﻋﻠﻰ‬ ‫ﯾدل‬ ‫ھذا‬ ‫وھل‬ ،logs ‫ال‬ ‫ﺑﻘراءة‬ ‫ﺗﻘوم‬ ‫اﻟﻌﻣل‬ ‫ﻗﯾد‬ ‫ﺗراھﺎ‬ process ‫أي‬ ‫ھﻧﺎك‬ ‫ھل‬
‫؟‬unintended/malicious
:Input Validation :‫ﺳﺎﺑﻌﺎ‬
●
‫ﻟﻠﺗﺣﻘق‬ ‫اﻟﻣﻧﺎﺳﺑﺔ‬ ‫اﻟﻘواﻋد‬ ‫وﺿﻊ‬ ‫ﺗم‬ ‫وھل‬ ‫اﻟﻣﺳﺗﺧدم؟‬ ‫ﺧﻼل‬ ‫ﻣن‬ ‫ﺗﺻل‬ ‫اﻟﻲ‬ input ‫ال‬ "‫"ﺟﻣﯾﻊ‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺗم‬ ‫ھل‬
type, length, format, range ‫ﻣﺛل‬ ‫اﻟﺻﺣﯾﺢ؟‬ ‫ﺑﺎﻟﺷﻛل‬ ‫وﺗﻧﻔﯾذھﺎ‬

:User Management and Authentication :‫ﺛﺎﻣﻧﺎ‬
●
Super Admin => All، Sales => ‫ﻣﺛﻼ‬ ،‫ﻣوﺛﻘﺔ‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬ ‫ﻣﺳﺗﺧدم‬ ‫ﺑﻛل‬ ‫اﻟﺧﺎﺻﺔ‬ ‫اﻟﺻﻼﺣﯾﺎت‬
.‫إﻟﺦ‬...orders
●
cookie secure and http only ‫ال‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬
●
cookie encrypted ‫ال‬ ‫ﺗﻛون‬ ‫أن‬ ‫ﯾﺟب‬
●
!‫ﺗﻘﻧﯾﺔ‬ ‫ﻛﺎرﺛﺔ‬ ‫ﻓﮭذه‬ HTTP GET ‫ﺧﻼل‬ ‫ﻣن‬ ‫إرﺳﺎﻟﮭﺎ‬ ‫ﺗم‬ ‫إذا‬ authentication credentials ‫ال‬
●
‫ال‬ ‫ﻋﻧد‬ ‫ﻟﻠﻣﺳﺗﺧدم‬ ‫إدراﺟﮭﺎ‬ ‫ﯾﺗم‬ ‫ﻣﺳﺗﺧدم‬ ‫ﺑﻛل‬ ‫اﻟﺧﺎﺻﺔ‬ role ‫وال‬ ‫ﺗﻌطﻰ‬ ‫اﻟﺗﻲ‬ ‫اﻟﺻﻼﺣﯾﺎت‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬
‫وواﺿﺢ‬ ‫ﺻﺣﯾﺢ‬ ‫ﺑﺷﻛل‬ authentication
●
!‫ذﻟك‬ ‫ﻋﻠﻰ‬ ‫ﻟﻠﺗﺣﺎﯾل‬ ‫طرﯾﻘﺔ‬ ‫ھﻧﺎك‬ ‫ﯾوﺟد‬ ‫وﻻ‬ ‫ﺻﺣﯾﺢ‬ ‫ﺑﺷﻛل‬ ‫ﯾﺗم‬ authentication ‫ال‬ ‫أن‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺟب‬

:Data Management :‫ﺗﺎﺳﻌﺎ‬
●
.server ‫ال‬ ‫ﻣﺳﺗوى‬ ‫ﻋﻠﻰ‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬
●
request ‫ﻛل‬ ‫ﻓﻲ‬ headers ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﯾﺗم‬ ‫أن‬ ‫ﯾﺟب‬
●
،untrusted tags ‫ﻋﻠﻰ‬ ‫ﺗﺣﺗوي‬ ‫ھل‬ ،‫إﺟراء‬ ‫أي‬ ‫اﺗﺧﺎذ‬ ‫ﻗﺑل‬ ‫اﻟﺑﯾﺎﻧﺎت‬ ‫ﻣﻌﺎﻟﺟﺔ‬ ‫ﺑﻌد‬ output ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬
‫؟‬encoding tag ‫ال‬ ‫ﻣن‬ ‫اﻟﺗﺣﻘق‬ ‫ﺗم‬ ‫وھل‬

،‫اﻷﻓﻌﺎل‬ ‫ﺐ‬ ْ
‫ﻴ‬ َ
‫ﻃ‬ ‫ﻣﻦ‬ ‫ﻫﻮ‬ ‫إﺣﺴﺎﻧﻪ‬ ‫ﻋﻠﻰ‬ ‫اﻟﻤﺤﺴﻦ‬ ‫ﺷﻜﺮ‬ ‫أن‬ ْ
‫ﺘﻌﻠﻢ‬ ْ‫ﻓﻠ‬
‫ﻋﻠﻰ‬ ‫اﻟﻤﺤﺴﻦ‬ ‫واﺷﻜﺮ‬ ،‫ﷲ‬ ‫ﻓﺎﺣﻤﺪ‬ ،‫أﺣﺪﻫﻢ‬ ‫إﻟﻴﻚ‬ ‫أﺣﺴﻦ‬ ‫ﻓﺈن‬
.‫إﺣﺴﺎﻧﻪ‬

‫اﻟﻌﺎﻟﻤﻴﻦ‬ ‫رب‬ ‫ﻟﻠﻪ‬ ‫اﻟﺤﻤﺪ‬ ‫أن‬ ‫دﻋﻮاﻧﺎ‬ ‫وآﺧﺮ‬
‫أﺑوﺣﻣﯾد‬ ‫ﺣﻛﻣت‬ ‫أﻧﯾس‬
Email Github Stackoverﬂow Slideshare

Coding review guide مراجعة الشيفرة البرمجية

More Related Content

Similar to Coding review guide مراجعة الشيفرة البرمجية (20)

More from anees abu-hmaid (20)

Recently uploaded (20)

Coding review guide مراجعة الشيفرة البرمجية