@provally
CVE and 1-day SAST rule packs maintained by Provally from validated vulnerability analysis artifacts.
A URL object is instantiated to validate the path, but the host is not verified. Attackers can supply protocol-relative paths (e.g., `//evil.com`) which resolve against the current base URL and pass protocol-only checks. If the unvalidated path is then used for navigation, it results in an Open Redirect.
Detected a TypeORM query using an unscoped OR condition to fetch potentially private or sensitive records globally. In TypeORM, an array in `where` is interpreted as an OR condition. Providing an object restricted only to the type (e.g., `{ type: 'personal' }`) or using a `.where().orWhere()` chain lacking explicit `AND` constraints fails tenant separation,
Reconstructing a relative URL directly from `URL.pathname` without sanitizing leading slashes can lead to Open Redirect vulnerabilities. When parsing user input with a dummy base, inputs like `/.//evil.com` normalize to a pathname of `//evil.com`. If this is used in a navigation or redirect, it is treated as a protocol-relative URL to an external domain. Col
Direct assignment of joined array content to innerHTML or outerHTML bypasses HTML encoding and can lead to Cross-Site Scripting (XSS). If the array contains untrusted or user-controlled input, such as unescaped component slots, an attacker can execute arbitrary scripts via implicitly closed tags. Use textContent instead to safely encode the data as plain tex
An incomplete blocklist of unsafe modules for pickle deserialization was found. The blocklist misses stdlib modules such as `uuid`, `pkgutil`, `imaplib`, or insufficiently blocks `cProfile` and `profile`. Attackers can exploit these unblocked functions to bypass the scanner and achieve arbitrary code execution.
A function return value is compared directly against an expected value without first verifying for negative error codes. This may lead to unexpected execution of error-handling cleanup paths, potentially triggering double-frees when unhandled error codes mimic unexpected data bytes.
A session was retrieved by ID and restored/bound without checking ownership. This logic allows a session hijacking attack if an attacker supplies a victim's session ID. Verify that the session owner matches the currently authenticated user before performing the binding.
The code relies on blocklisting specific HTML tags or attributes (such as `[onerror]` or `[href^=javascript]`) to sanitize untrusted input. This approach is inherently incomplete and easily bypassed by attackers using different executable constructs (e.g., `srcdoc`, `formaction`, data URIs). To properly sanitize HTML, use a well-tested library like DOMPurify
HTML content is assigned to the report object model without sanitization. This directly causes Stored XSS when the Allure report is generated and viewed on the frontend. Ensure the content is passed through an HTML sanitizer such as `HtmlSanitizerUtils.sanitizeHtml()` before assignment.
A value interpolated into an LDAP search filter or username string was escaped using a function meant for LDAP Distinguished Names (DNs), such as EscapeLDAPValue, rather than a function meant for LDAP search filters like ldap.EscapeFilter. This allows LDAP injection if the input contains filter metacharacters like '*', '(', ')', '\', or '\x00'. Use ldap.Esca
User-controlled input is decoded with `decodeURI` or `decodeURIComponent` and flows into a path construction or filesystem operation. Encoded traversal sequences (like `%2e%2e%2f`) can bypass initial checking logic, leading to directory traversal or arbitrary file access once decoded. Ensure that paths are validated *after* decoding, for instance by checking
Recreating a session token without explicitly deleting the previous session from the token store can result in insufficient session expiration. Orphaned session identifiers may remain fully privileged, allowing session hijacking. Ensure the old session is deleted (e.g., typically via `$TOKEN.del()`) before generating and assigning a new one.
A fail-open condition was detected where an exception during identifier enquoting, escaping, or validation results in the method returning the raw, unescaped input. This logic bypasses the intended escaping mechanism and leads to secondary Injection vulnerabilities (e.g., SQL Injection) if the attacker provides malicious input designed specifically to trigge
The function tokenizes an HTML string and writes all resulting text tokens to a buffer in a loop that only exits on EOF or error. Without an early-exit mechanism (such as short-circuiting via an iterator or length check), excessively large HTML payloads can lead to Denial of Service (DoS) due to CPU and memory exhaustion. Consider replacing rigid loops with
A plain object `{}` is used as a dictionary map for objects from an array, with a key derived directly from the object's properties. If the key is controlled by an attacker (e.g., `__proto__`), this can lead to Prototype Pollution. Use `Object.create(null)` to safely store items without inheriting from `Object.prototype`.
Constructing paths directly from unvalidated dynamic properties (such as `.host` and `.path` from URIs) or appending arguments after a cryptographic hash in `path.join()` allows directory traversal. This nullifies the isolation of the predictable hash component and allows writing files to arbitrary locations. Always resolve external input safely using `path.
Missing strict validation of extracted filename. Verify that the extracted filename exactly matches the original input name to prevent silently ignoring path components.
Unintended OR condition in TypeORM `where` or `orWhere` statement. The query combines a user-specific constraint with a generic `type` check, resulting in an OR logic that inadvertently scopes access to all records matching the generic type. This leads to BOLA and improper access control.
A TypeORM query uses an array for the `where` clause (creating an OR condition) but the `{ type: 'personal' }` filter is missing a user or tenant constraint. This exposes all personal projects across the platform regardless of the user.
Detected a TypeORM query using an OR condition to combine a global property check with a user ID constraint. Using an array in the `where` option or chaining `.orWhere()` creates an OR condition. If the global property was intended to scope the user's data rather than grant global access to that type, this results in broken access control. Verify the logic s
Insecure OR query exposing all personal projects due to array syntax in TypeORM `where`.
A weak lexical guard against path traversal was detected. Splitting a path string and checking for literal '..' components can be bypassed by URL-encoded sequences, normalization differences, or symlink traversal. Prefer using secure path resolution methods like `os.path.abspath(path).startswith(required_root)` or `pathlib.Path.resolve()` to safely validate
The JWT signing function defaults to a symmetric algorithm (like 'HS256') and subsequently places it in the token header, but fails to check if the provided private key is an asymmetric JSON Web Key (JWK) containing its own structured 'alg' (algorithm) property. This allows for algorithm confusion attacks where an asymmetric key is mistakenly processed as a
A JWT signing function fails to extract `alg` and `kid` from a JWK private key object. This may lead to algorithm confusion vulnerabilities if a default symmetric algorithm is used for an asymmetric key.
