Remote Script Piped to Shell

rule_id: iac-docker-curl-pipe-shell

description: Downloaded script piped directly into a shell interpreter.

severity: high

file: examples/sample-app/Dockerfile

line_excerpt: RUN curl -fsSL https://get.example.com/install.sh | bash   # remote script piped to shell (CWE-494)

source: sast

rule_category: vuln

owasp: A08:2021 Software and Data Integrity Failures

remediation: Pin and checksum-verify the artifact before execution.

secure_code: RUN curl -fsSLo i.sh https://x/i.sh && echo "<sha256>  i.sh" | sha256sum -c && sh i.sh

technical_impact: A compromised or MITM'd endpoint runs arbitrary code at build time.

business_impact: Supply-chain compromise of the built image.


rule_id: env-named-credential-assignment

description: Credential-named env/config variable assigned a value (.env / shell / dotenv style)

severity: medium


rule_id: basic-auth-credential

description: HTTP Basic auth credential assigned in code/config (basic_auth = "...")

line_excerpt: basic_auth = "eAxbYmFzaWM6Y3JlZHM="


rule_id: dotnet-debug-enabled

description: <compilation debug="true"> ships verbose errors, disables optimizations, and lengthens request timeouts.

secret: <compilation debug="true"

line_excerpt: <compilation debug="true"/>                    <!-- debug enabled (CWE-11) -->

name: ASP.NET Debug Compilation Enabled in Production

owasp: A05:2021 Security Misconfiguration

remediation: Set debug="false" for production deployments and enable <deployment retail="true"/> on the server.

secure_code: <compilation debug="false" targetFramework="4.8" />

technical_impact: Detailed exception pages leak source paths, versions, and stack traces, and the app is more DoS-prone.

business_impact: Reconnaissance data handed to attackers and degraded availability under load.

secret_redacted: <compilation debug="true"


rule_id: dotnet-custom-errors-off

description: <customErrors mode="Off"> returns full stack traces and framework banners to remote clients.

secret: <customErrors mode="Off"

line_excerpt: <customErrors mode="Off"/>                     <!-- stack traces exposed -->

name: ASP.NET customErrors Off (Stack Trace Disclosure)

remediation: Use mode="RemoteOnly" (or On) with a generic defaultRedirect error page in production.

secure_code: <customErrors mode="RemoteOnly" defaultRedirect="~/Error" />

technical_impact: Yellow-screen-of-death pages expose method names, file paths, connection strings, and exact patch levels.

business_impact: Internal architecture and occasionally credentials are disclosed to anonymous internet users.

secret_redacted: <customErrors mode="Off"


ASP.NET Request Validation Disabled

rule_id: dotnet-request-validation-disabled

description: validateRequest="false" or requestValidationMode="2.0" turns off the built-in XSS/markup request filter.

secret: validateRequest="false"

line_excerpt: <pages validateRequest="false"/>               <!-- request validation off (CWE-79) -->

owasp: A03:2021 Injection

remediation: Leave request validation enabled (default) and HTML-encode output; scope any exception to a single field.

secure_code:
<pages validateRequest="true" />
<httpRuntime requestValidationMode="4.5" targetFramework="4.8" />

technical_impact: The framework no longer rejects markup in query/form input, re-opening reflected and stored XSS sinks.

business_impact: Session theft and account takeover through cross-site scripting on any page that echoes user input.

secret_redacted: validateRequest="false"


Kotlin OS Command Injection

rule_id: kotlin-command-injection-exec

description: Request/intent input reaches Runtime.exec or ProcessBuilder, often via string interpolation.

severity: critical

line_excerpt: Runtime.getRuntime().exec("sh -c " + intent.getStringExtra("cmd"))  // cmd injection (CWE-78)

remediation: Pass a fixed argv list with validated arguments; never build a shell string from input.

technical_impact: Arbitrary OS command execution in the server or app process.

business_impact: Server takeover (Ktor) or device compromise (Android) via a single tainted value.


description: addJavascriptInterface exposes native methods to page JavaScript, risking RCE from loaded content.

secret: .addJavascriptInterface(

line_excerpt: webView.addJavascriptInterface(JsBridge(), "android")               // Android JS bridge (CWE-749)

name: Android WebView addJavascriptInterface Exposure

remediation: Avoid the bridge; if required, gate methods with @JavascriptInterface and load only trusted content.

secure_code: // prefer WebMessageListener with a fixed allowlisted origin

technical_impact: Malicious page JS invokes native methods, reaching the app's permissions.

business_impact: Device/app compromise and theft of user data via a hostile web page.

secret_redacted: .addJavascriptInterface(


OS Command Injection

rule_id: py-command-injection

description: Shell command built from dynamic input via os.system/subprocess/os.popen

line_excerpt: os.system("ping -c 1 " + host)                          # command injection (CWE-78)

remediation: Never build a shell string from input. Pass an argument list and avoid shell=True.

secure_code: subprocess.run(["ping", "-c", "1", host], shell=False, check=True)

technical_impact: Arbitrary command execution as the app user; full host compromise, lateral movement.

business_impact: Complete server takeover, data theft, ransomware staging, regulatory breach.


SQL Injection

rule_id: py-sql-injection

description: SQL string built with %/format/f-string/concatenation instead of parameters

secret: .execute("SELECT * FROM users WHERE

line_excerpt: cursor.execute("SELECT * FROM users WHERE name = '%s'" % host)  # SQL injection (CWE-89)

remediation: Use parameterized queries — pass values as the second argument, never interpolate.

secure_code: cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

technical_impact: Read/modify arbitrary DB rows, authentication bypass, possible RCE via stacked queries.

business_impact: Mass data breach, account takeover, data integrity loss.

secret_redacted: .execute("SELECT * FROM users WHERE


Server-Side Request Forgery (SSRF)

rule_id: py-ssrf

description: Outbound HTTP request to a URL derived from user input

line_excerpt: requests.get(request.args.get("url"), verify=False)     # SSRF + disabled TLS (CWE-918/295)

owasp: A10:2021 Server-Side Request Forgery

remediation: Allowlist destination hosts/schemes; block link-local/metadata ranges (169.254.169.254).

secure_code:
host = urlparse(url).hostname
if host not in ALLOWED_HOSTS: abort(400)

technical_impact: Access to internal services, cloud metadata credential theft.

business_impact: Cloud account takeover via stolen instance credentials.


Disabled TLS Certificate Verification

rule_id: py-insecure-tls

description: TLS verification turned off (verify=False / unverified context)

secret: verify=False

owasp: A02:2021 Cryptographic Failures

remediation: Leave verification enabled; pin/verify against a trusted CA bundle.

secure_code: requests.get(url, verify=True)         # or verify="/path/ca-bundle.pem"

vulnerable_code: requests.get(request.args.get("url"), verify=False)     # SSRF + disabled TLS (CWE-918/295)

technical_impact: Man-in-the-middle interception of "encrypted" traffic.

business_impact: Credential/session theft over hostile networks.

secret_redacted: verify=False


Path Traversal

rule_id: py-path-traversal

description: File path built from request input without normalization

secret: open(

line_excerpt: open("/data/" + request.args.get("f"))                  # path traversal (CWE-22)

owasp: A01:2021 Broken Access Control

remediation: Resolve the real path and confirm it stays within an allowed base dir.

secure_code:
base = Path("/srv/data").resolve()
target = (base / name).resolve()
if base not in target.parents: abort(403)

technical_impact: Read/write arbitrary files (/etc/passwd, source, keys).

business_impact: Source/secret disclosure, config tampering.

secret_redacted: open(


Weak Cryptographic Hash

rule_id: py-weak-hash

description: MD5/SHA1 used for security-sensitive hashing

line_excerpt: hashlib.md5(host.encode())                              # weak hash (CWE-327)

remediation: Use SHA-256+ for integrity; use bcrypt/scrypt/argon2 for passwords.

secure_code:
hashlib.sha256(data).hexdigest()
bcrypt.hashpw(pw, bcrypt.gensalt())    # passwords

technical_impact: Collision/preimage attacks; fast password cracking.

business_impact: Credential compromise, integrity bypass.


rule_id: react-dangerous-innerhtml

description: Raw HTML injected into the DOM via dangerouslySetInnerHTML

secret: dangerouslySetInnerHTML={{

line_excerpt: return <div dangerouslySetInnerHTML={{ __html: html }} />;

remediation: Render as text, or sanitize with DOMPurify before injecting.

secure_code: <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />

technical_impact: Script execution in the victim's session (XSS).

business_impact: Account takeover, session theft, defacement.

secret_redacted: dangerouslySetInnerHTML={{


rule_id: web-xss-node-response-taint

description: Request query/body/param concatenated into an HTML response body unescaped.

line_excerpt: res.send(`<h1>${req.query.q}</h1>`);                      // reflected XSS (CWE-79)

name: Reflected XSS via Express response of request input

remediation: Escape user input or render through an auto-escaping template engine.

technical_impact: Arbitrary script execution in the victim browser against the application origin.

business_impact: Credential and token theft leading to account takeover and reputational damage.


SQL Injection

rule_id: node-sql-injection

description: SQL built with string concatenation / template literals

secret: .query(`SELECT * FROM u WHERE

line_excerpt: db.query(`SELECT * FROM u WHERE id = ${req.params.id}`);  // SQL injection (CWE-89)

remediation: Use parameterized queries / bound placeholders.

secure_code: db.query("SELECT * FROM users WHERE id = ?", [userId]);

technical_impact: Full database read/write, auth bypass.

business_impact: Mass data breach and account takeover.

secret_redacted: .query(`SELECT * FROM u WHERE


OS Command Injection

rule_id: node-command-injection

description: child_process shell exec built from dynamic input

secret: exec(

line_excerpt: cp.exec('convert ' + req.query.file);                     // command injection (CWE-78)

remediation: Use execFile/spawn with an argument array and shell:false; never concatenate.

technical_impact: Arbitrary command execution on the server.

business_impact: Full host takeover and data breach.

secret_redacted: exec(


Open Redirect

rule_id: node-open-redirect

description: Redirect target taken directly from request input

line_excerpt: res.redirect(req.query.next);                             // open redirect (CWE-601)

remediation: Allowlist redirect targets or restrict to same-origin relative paths.

secure_code:
const dest = SAFE_PATHS.has(req.query.next) ? req.query.next : "/";
res.redirect(dest);

technical_impact: Phishing and OAuth token theft via attacker-controlled redirect.

business_impact: Credential/token theft, brand abuse.


rule_id: xml-secret-bearing-tag

description: Base64/high-entropy value inside a secret-bearing XML tag (SAML AttributeValue, config <value>, etc.)

severity: low