KRITIS/NIS2-compliant security review based on CWE vulnerabilities and attack patterns.

Apply this checklist when changes involve:

• Cryptographic operations
• Authentication / Authorization
• Network communication
• Database access
• External API calls
• File uploads
• User input

(* FORBIDDEN - Timing attack possible *)
function VerifyToken(const AToken, AExpected: string): Boolean;
begin
  Result := AToken = AExpected;  (* Aborts on first difference! *)
end;
 
(* CORRECT - Constant time *)
function VerifyToken(const AToken, AExpected: string): Boolean;
var
  I: Integer;
  Diff: Byte;
begin
  if Length(AToken) <> Length(AExpected) then
    Exit(False);
 
  Diff := 0;
  for I := 1 to Length(AToken) do
    Diff := Diff or (Ord(AToken[I]) xor Ord(AExpected[I]));
 
  Result := Diff = 0;
end;

procedure ProcessSecret(const ASecret: string);
var
  LocalCopy: string;
begin
  LocalCopy := ASecret;
  try
    (* Processing *)
    DoSomethingWith(LocalCopy);
  finally
    (* Clear secret - not just release! *)
    FillChar(LocalCopy[1], Length(LocalCopy) * SizeOf(Char), 0);
    LocalCopy := '';
  end;
end;

(* FORBIDDEN - SQL Injection possible *)
procedure GetUser(const AUsername: string);
begin
  Query.SQL.Text := 'SELECT * FROM users WHERE name = ''' + AUsername + '''';
  Query.Open;
end;
 
(* CORRECT - Parameterized *)
procedure GetUser(const AUsername: string);
begin
  Query.SQL.Text := 'SELECT * FROM users WHERE name = :username';
  Query.ParamByName('username').AsString := AUsername;
  Query.Open;
end;

(* FORBIDDEN - Too much information *)
procedure HandleError(E: Exception);
begin
  ShowMessage('Error in C:\Users\Admin\App\src\Database.pas:142: ' + E.Message);
end;
 
(* CORRECT - Log internally, sanitize externally *)
procedure HandleError(E: Exception);
begin
  (* Log full details internally *)
  Logger.Error('Database error at %s: %s', [E.ClassName, E.Message]);
 
  (* Externally only sanitized message *)
  raise EUserError.Create(rsDatabaseOperationFailed);
end;

[ ] Nonce reuse prevented
[ ] Timing attacks mitigated (constant time)
[ ] Replay attacks blocked
[ ] Key enumeration prevented (random IDs)

[ ] Buffer overflow prevented (size limits)
[ ] Integer overflow prevented
[ ] Malformed input handled
[ ] SQL injection prevented

[ ] Resource exhaustion prevented (rate limiting)
[ ] Lock poisoning handled
[ ] Memory exhaustion prevented

[ ] Error messages sanitized
[ ] Secrets cleared after use (zeroization)
[ ] No sensitive data in logs

• Quality Assurance Overview
• Security Guidelines (general)
• Core Checklist
• Debugging