As nowadays SAAS is becoming popular way of developing and deploying the applications, and I have just started working at a company providing SaaS solution for payment authorization services.Since past few days, I have been thinking what would happen if some unsatisfied / angry developer write a malicious code (lets say deleting transaction table !)which would activate on some particular time (so that it would not be caught during testing process) and can create havoc for any time critical SAAS application. Any good SAAS offering comes with proper backup strategy and hence data restoration could be possible upto certain extent but it would seriously hamper the availibility of system and in turn the image with clients.Sometimes I think this could be controlled through code reviews but I have seen that most of the times the code reviews are not done properly and such malicious logic can be camouflaged behind some complicated string manipulations.So I am just boucing my thoughts to community for some good ideas, which could be implemented in development process to catch such malicious activities early on.P.S. : Sometimes though I am unsatisfied / angry developer but would never do such unethical things being a coding lover.
Ideas about how to prevent malicious code to go into production especially in case of SAAS environments
development process;code quality;production
You're trying to solve a human problem with technologyA better approach is to make sure that code reviews are carried out responsibly. Other developers will not want to have to bear the brunt of the original developers malicious code so will quickly flag these kind of problems. Any complex string manipulation behaviour would have to be explained in detail and should rapidly show up.Done well, a code review is pleasurable for both the author of the code and the reviewer(s). All the usual technical bug finding and documentation style requirements can be done automatically (think Findbugs, PMD, CPD etc) leaving just the interesting design and implementation discussions to take place.