Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
PEM/asymmetric-key material is recognized with a regex that mandates an escape-encoded line break (\r or \n) between the -----BEGIN and -----END markers. PEM parsers (e.g. the pyca/cryptography PEM loader) accept representations without LF-terminated marker lines (CR-only line endings, whitespace before '-----END', folded single-line form), so this recognize
$FUNC implements a validation/authorization gate as a denylist: an enumerated set of values returns false and the switch default branch returns true, so every unlisted, unknown, or future value is accepted as valid. If the classified value shares an integer or type namespace with privileged operations (task types, message kinds, opcodes), an attacker can sub
Incomplete builtin denylist: the '*' wildcard expansion allow-gates each builtin with an exact-name deny test only (`-name` / `-node:name`). Node lists families and subpaths as separate builtinModules entries (`fs` vs `fs/promises`, `path` vs `path/posix`, `stream` vs `stream/web`), so a family token such as `-fs` removes only `fs` and leaves the real host `
Cross-realm symbol guard $FUNC decides whether a property key is a dangerous Node internal solely by enumerating a fixed list of registered nodejs.* symbols (Symbol.for('nodejs.*')) instead of testing the reserved namespace with Symbol.keyFor(key). Registered nodejs.* symbols added by newer Node releases (e.g. nodejs.stream.disturbed / nodejs.stream.errored
Configuration is validated with only `typeof $OPT === 'object' && $OPT !== null` (or its De Morgan inverse `typeof $OPT !== 'object' || $OPT === null`), so arrays (`[]`), boxed primitives (`new String()`), and exotic instances (`new Date()`, `new Map()`) are accepted as "an explicit config object" even though they carry none of the expected option fields and
Second-factor/challenge verification uses PHP loose equality (==) between the submitted response and a $_SESSION value. The session index is only created when a challenge is actually issued, so when no challenge exists it evaluates to NULL, and a request that omits (or empties) the response parameter is also NULL/'' PHP then evaluates NULL == NULL (or '' ==
Cross-family IP address conversion using `toIPv4MappedAddress()` without verifying that the target IPv6 subnet prefix length is at least 96 bits allows IPv4-mapped subnets with short prefix lengths (such as /8) to match all IPv4 addresses. This allows unauthenticated clients to bypass IP-based access control and spoof client IP addresses.
Direct comparison of `gym_id` between user profiles can bypass multi-tenant isolation when both users have `gym_id=None`. Use `is_same_gym()` or verify neither gym ID is None before comparing.
URL normalization for path-based matching does not account for absolute-form request targets (e.g., 'http://host/path'). This allows path-scoped middleware to be bypassed when downstream routing strips the host and matches the path.
Request-part schema presence (body/headers/querystring/params/query) is tested with JavaScript truthiness instead of an explicit `undefined` check. JSON Schema (Draft 6+) defines the boolean `false` as a valid schema that rejects every instance, so a deny-all schema such as `body: false` evaluates falsy, the validation-compilation branch is skipped, no valid
Checking resource parentage or identity by testing substring presence in a Pulumi URN (e.g. `urn.includes(...)`) is susceptible to spoofing. Parse and validate the URN structure explicitly.
Naive URN prefix matching using split('$')[0] and startsWith can lead to policy validation bypasses due to crafted resource names. Parse URN type hierarchies structurally and enforce property-level value bindings.
Trust predicate `$FUNC` fails open: its only rejection path is a positive membership test against a denylist constant (`$ITEM in $DENYLIST`), followed by an unconditional `return True`. Any value not on the denylist — an unknown/new name, a path with no directory component, or a casing variant on a case-sensitive filesystem — is trusted by default. When this
Unescaped regex escape sequence '\s' in SQL string fragment. In Elixir string literals, '\s' evaluates to a single space character (0x20) instead of the SQL regex whitespace class '\\s'. This causes REGEXP_REPLACE or regex operators to match only literal spaces rather than all whitespace characters.
Multiple `osdCustom` validation rules are applied separately to the same schema instance. In Joi schema extensions, subsequent rules with the same name overwrite earlier rules rather than combining them, causing validation checks to be silently dropped. Consolidate validations into a single rule.
Hardcoded sandbox import deny-list does not block the file-access modules 'io'/'pathlib' (and 'os'). Sandboxed file access is typically enforced only by replacing builtins.open, so io.open() and pathlib.Path.* calls reach the real C-level open and bypass the sandbox, while a hand-maintained list drifts out of sync with the static analyzer's blocked-module li
Cache lookup or write in object fetch method keys cache using only table and value without scoping by query column or method identifier, which can cause cache key collisions across different query fields (e.g. ID vs authentication token).
Ineffective regex validation: this loop compiles a fixed expression instead of the range value $V, so every iteration re-checks the same hard-coded regex and the other values collected in $REGEXES are never validated. A malformed regex can be accepted and persisted and may later reach regexp.MustCompile and panic the process (denial of service). Compile the
Using a substring match to find a dictionary key can lead to insecure matching (e.g., when checking hostnames, URLs or registry names), allowing an attacker to spoof configurations by registering a similar name (like an overlapping substring). Prefer exact matches (`===`) or proper parsing.
Inverted `memcmp` comparison: `memcmp` returns 0 when buffers are equal and non-zero when they differ. Using `!!memcmp(...)` to set a match or validation flag treats mismatches as valid and matching data as invalid, which can lead to TLS certificate validation bypass.
The code incorrectly checks for an IPv6 loopback literal (e.g., checking if byte 15 is 1) before checking whether the address is an IPv4-mapped IPv6 address. Mapped IPv4 loopback addresses (like `::ffff:127.0.0.1`) also end with a 1 (from `.1`) and will prematurely match the IPv6 literal check, failing loopback validation. Ensure `IN6_IS_ADDR_V4MAPPED` is ch
Checking an `escapeshellarg` or `escapeshellcmd` escaped string with filesystem functions like `is_executable` or `file_exists` is logically flawed. The escaped string includes shell quote characters, causing the check to fail. If this failed check unexpectedly alters control flow (e.g., falling back to unescaped input), it can result in vulnerabilities like
A security decision (policy exemption or trusted-relationship check) is made with an unanchored URN string comparison. Pulumi URN segments after the `$` delimiter (type tokens and logical names) are author-controlled by the IaC author, so `x.urn.includes(<type>$)` also matches a raw resource whose *logical name* embeds the trusted type token, and `x.urn.star
Using `isSet()` to check a boolean configuration option or feature toggle checks parameter presence rather than its boolean value. If the parameter is set to 'false', `isSet()` returns true, leading to improper bypass of security controls. Use `isOptionEnabled()` or an equivalent boolean value accessor instead.
