Security is a quality characteristic used to identify risks involving unauthorized access, misuse, alteration, disclosure, or loss. In code review, it is analyzed alongside performance and interoperability through explicit, structured prompts. section 4.2.2
A focused risk-analysis prompt can:
- Ask a software testing expert to inspect delimited code and identify risks. section 4.2.2
- Require each result to follow Risk - Quality Characteristic - Explanation. section 4.2.2
- Use few-shot examples, such as a large-integer buffer-overflow risk, to establish the expected structure. section 4.2.2
Security risk in booking code
A booking method validates dates, checks conflicts, creates a record, and posts a message. Analysis should consider security together with performance and interoperability, while treating generated risks as suggestions requiring assessment rather than unquestioned findings. section 4.2.2
###
public BookingResult createBooking(Booking bookingToCreate) throws
➥SQLException {
if(dateCheckValidator.isValid(bookingToCreate.getBookingDates())) {
if (bookingDB.checkForBookingConflict(bookingToCreate)) {
return new BookingResult(HttpStatus.CONFLICT);
} else {
CreatedBooking createdBooking =
➥bookingDB.create(bookingToCreate);
if(bookingToCreate.getEmail() != null &&
➥bookingToCreate.getPhone() != null){
MessageBuilder messageBuilder = new MessageBuilder();
Message message = messageBuilder.build(bookingToCreate);
messageRequests.postMessage(message);
}
return new BookingResult(createdBooking,
➥HttpStatus.CREATED);
}
} else {
return new BookingResult(HttpStatus.CONFLICT);
}
}
###
Inspect the booking implementation used to demonstrate structured code-risk analysis. section 4.2.2
