Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A fail-open condition was detected where an exception during identifier enquoting, escaping, or validation results in the method returning the raw, unescaped input. This logic bypasses the intended escaping mechanism and leads to secondary Injection vulnerabilities (e.g., SQL Injection) if the attacker provides malicious input designed specifically to trigge
Unchecked type assertion to a cryptographic key type (e.g., `*rsa.PublicKey`). If the interface contains a different type (for instance, an ECDSA key returned by an external JWKS endpoint instead of RSA), the assertion will panic and cause a Denial of Service. Use the `value, ok := ...` idiom to safely assert types.
Silently skipping malformed PAX extensions by using `filter_map(|f| f.ok())` can conceal parsing errors and lead to parser differentials. This behavior can be exploited if a subsequent component interprets the skipped malformed extension differently. Propagate the error using `?` or handle it explicitly instead of suppressing it.
Using `assert` for critical data validation or state checks (such as end-of-file boundaries, stream validation, or field presence) is unsafe. When Python is executed with optimizations enabled (`-O` or `PYTHONOPTIMIZE=1`), all `assert` statements are stripped. This allows malformed data to bypass checks entirely, potentially leading to infinite loops or Deni
