Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Recreating a session token without explicitly deleting the previous session from the token store can result in insufficient session expiration. Orphaned session identifiers may remain fully privileged, allowing session hijacking. Ensure the old session is deleted (e.g., typically via `$TOKEN.del()`) before generating and assigning a new one.
Missing `secure: true` on Phoenix session cookie or remember-me cookie options. Cookies sent over unencrypted HTTP can be intercepted by an active network attacker. Ensure production configurations set `secure: true`.
File operations within this class rely on a static path validation method rather than an instance-bound workspace isolation check. This can lead to directory traversal or arbitrary file manipulation. Migrate the method to an instance method taking `self` and ensure paths are resolved safely using an isolated workspace context.
Validation of tarfile extraction was observed to lack checks for symbolic links. Calling `.extractall()` after iterating through `.getmembers()` without verifying `.issym()` or `.islnk()` may allow symlink escape attacks (CWE-61). Attackers can bypass directory boundaries by deploying malicious symlinks inside the archive, routing subsequent extractions outs
When rescoping or mapping a new session context from an existing token, the original token's expiration time is not explicitly preserved. Failing to propagate the `expires_at` property can allow an attacker to indefinitely extend session lifetimes by repeatedly rescoping tokens before their explicit expiration.
$LOGGER.$FATAL(...) inside a goroutine calls os.Exit(1) after logging, which immediately terminates the entire process — even when the goroutine contains a defer/recover handler. This turns any transient error (e.g., an unreachable callback URI) into a process-level crash that cannot be caught by the caller. Replace with a non-fatal method such as Errorf or
Tarfile extraction iterates over archive members (often to mitigate CVE-2007-4559) but fails to validate symlinks using `issym()`, `islnk()`, `linkname`, or `type`. This allows symlink escape attacks where a malicious archive creates symlinks pointing outside the extraction directory.
Inverted bounds assertion before AES_unwrap_key: the guard `OUT.len() + 8 <= IN.len()` is reversed. AES key unwrap (RFC 3394) writes `IN.len() - 8` bytes into `OUT`, so the correct invariant is `OUT.len() + 8 >= IN.len()` (equivalently `OUT.len() >= IN.len() - 8`). The reversed comparison admits undersized output buffers and causes an out-of-bounds write fro
Using `assert` for string validation before usage is vulnerable to a bypass because Python strips assert statements from bytecode when executed with optimizations (`-O`). Attackers can supply inputs that bypass string-prefix boundaries, potentially leading to arbitrary code execution, unintended module loading, or path traversal. Replace the `assert` stateme
OIDC configurations do not enforce session invalidation on token expiration. This allows an authenticated session to persist indefinitely. Configure `logoutWhenIdTokenIsExpired(true)` on the `OpenIdConfiguration.Builder`.
flatpak_run_app() is defined without GArray *bind_fds / GArray *ro_bind_fds parameters. Without them, the Flatpak portal must forward sandbox-expose paths as raw path strings to bubblewrap --bind, which follows symlinks at mount time. A sandboxed app can plant a symlink inside its writable instance directory pointing to any host path and supply it as a sandb
Using `panic!` inside libp2p `ConnectionHandler` negotiation events (`FullyNegotiatedInbound`, `FullyNegotiatedOutbound`) exposes the application to remote Denial of Service (DoS) attacks. An attacker can intentionally negotiate duplicate streams or unexpected states to trigger the panic and crash the node. Handle invalid states gracefully by returning an er
Creating a file in a shared temporary directory with a predictable name and without `os.O_EXCL` allows local attackers to mount a symlink attack. If an attacker pre-creates a symlink at the predictable path, opening or creating the file will follow the symlink and overwrite the target file. Use `os.CreateTemp` to safely create temporary files, or provide `os
Archive extraction via `tarfile.extractall` iterates over members and attempts safety validation but misses symlink target validation. This allows a bypass via malicious symbolic links pointing outside the extraction directory. Verify all members using `issym()` and `islnk()`.
Validation of `tarfile` members via `getmembers()` before calling `extractall()` or `extract()` lacks checks for symbolic or hard links (`issym()` or `islnk()`). Path traversal checks on entry names are insufficient because attackers can first extract a symlink and then route subsequent extracted files through it to arbitrarily escape the destination directo
Using `.expect()` or `.unwrap()` on the result of a checked arithmetic operation (e.g., `checked_add`, `checked_sub`) causes a runtime panic on overflow/underflow. When processing untrusted input, this leads to Denial of Service (DoS) due to reachable assertions. Handle the error gracefully using `.ok_or(...)?` or a `match` statement.
Evaluating XPath expressions using `elementpath` default parsers (XPath2Parser, XPath3Parser, etc.) is unsafe because they support dangerous functions such as `unparsed-text()`, `doc()`, and `environment-variable()`. An attacker can use these functions to read arbitrary files or leak environment variables. Evaluate untrusted XPath using a custom parser with
Creating a temporary file without specifying a `dir` and then moving it with `shutil.move` can lead to an arbitrary file overwrite. If the temporary directory is on a different filesystem than the destination, `shutil.move` falls back to a copy operation, which insecurely follows symbolic links at the destination path. Provide the `dir` argument so the tempo
This function validates a password-reset / token record by comparing `$RESET.key` for plain equality without verifying the record's age or using a constant-time comparison. Reset tokens that never expire allow account takeover when an attacker obtains a previously issued (unused) reset email — e.g., from a leaked mailbox archive (CWE-613). Enforce an expirat
Time-of-Check to Time-of-Use (TOCTOU) vulnerability detected. Calling `stat()` and then `chmod()` on the same path without `follow_symlinks=False` allows an attacker to swap a file or directory with a symbolic link between the two calls. This can lead to arbitrary file permission alteration or privilege escalation. Ensure you pass `follow_symlinks=False` to
Using `assert` for critical data validation or state checks (such as end-of-file boundaries, stream validation, or field presence) is unsafe. When Python is executed with optimizations enabled (`-O` or `PYTHONOPTIMIZE=1`), all `assert` statements are stripped. This allows malformed data to bypass checks entirely, potentially leading to infinite loops or Deni
The code asserts that two object fields are null (indicating an uninitialized or free state), and then subsequently assigns to one of them. If the execution path reaching this assertion can be triggered multiple times via external input, the assertion will fail and crash the application (Denial of Service). Replace this assertion with proper conditional logi
File upload handler reads $_FILES and persists it via move_uploaded_file() without validating the file extension against a strict allowlist. MIME-type checks are insufficient: PHP source files match text/plain, and mime_content_type() silently does nothing on installations without the fileinfo extension. If the uploads directory is web-accessible, an attacke
`Process::myself()` from the `procfs` crate performs component-by-component path resolution of `/proc/self` without anchoring to a pre-opened directory file descriptor. In environments with shared mount namespaces (container runtimes, sandbox code), an attacker can race the traversal by bind-mounting over an intermediate path component between a validation c
