vuln-patterns-languages

Language-specific vulnerability detection patterns for JavaScript/TypeScript, Python, Go, Java, Ruby, and PHP. Provides regex patterns and grep commands for common security vulnerabilities.

Jump to install

Repository: Zate/cc-plugins
Last source activity: December 16, 2025 at 03:33
Detected SKILL.md language: English
Stars: 9
Forks: 2

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Zate/cc-plugins --skill vuln-patterns-languages

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

SKILL.md

Source instructions · Read-only preview

name	vuln-patterns-languages
description	Language-specific vulnerability detection patterns for JavaScript/TypeScript, Python, Go, Java, Ruby, and PHP. Provides regex patterns and grep commands for common security vulnerabilities.

Vulnerability Patterns: Language-Specific

Detection patterns organized by programming language.

When to Use This Skill

Language-targeted scans - When auditing specific tech stacks
Code review - Finding vulnerabilities in PRs
Building auditor agents - Patterns for domain auditors

When NOT to Use This Skill

Universal patterns - Use vuln-patterns-core skill
Full audits - Use domain auditor agents
Remediation - Use remediation-* skills

JavaScript/TypeScript Patterns

Dangerous eval()

Detection Pattern:

# eval with variables
eval\s*\([^)]*[a-zA-Z_]+[^)]*\)

# Function constructor
new\s+Function\s*\([^)]*[a-zA-Z_]+

# setTimeout/setInterval with string
(setTimeout|setInterval)\s*\([^,)]*['"`]

Grep Commands:

grep -rn --include="*.{js,ts}" -E "eval\s*\(" .
grep -rn --include="*.{js,ts}" -E "new\s+Function\s*\(" .
grep -rn --include="*.{js,ts}" -E "(setTimeout|setInterval)\s*\(['\"\`]" .

Severity: Critical ASVS: V1.5.1 - Safe deserialization CWE: CWE-94 (Code Injection)

XSS via DOM Manipulation

Detection Pattern:

# innerHTML assignment
\.innerHTML\s*=(?!\s*['"]<[^>]+>[^<]*</[^>]+>['"])

# document.write
document\.write\s*\(

# insertAdjacentHTML
\.insertAdjacentHTML\s*\(

# React dangerouslySetInnerHTML
dangerouslySetInnerHTML

Grep Commands:

grep -rn --include="*.{js,ts,jsx,tsx}" "\.innerHTML\s*=" .
grep -rn --include="*.{js,ts,jsx,tsx}" "document\.write" .
grep -rn --include="*.{js,ts,jsx,tsx}" "dangerouslySetInnerHTML" .

Severity: High ASVS: V3.3.1 - XSS prevention CWE: CWE-79 (Cross-site Scripting)

Prototype Pollution

Detection Pattern:

# Direct __proto__ access
__proto__

# Object merge without validation
Object\.assign\s*\([^)]*,[^)]*\)
\.\.\.(?!props)[a-zA-Z_]+

# Bracket notation with variable
\[[a-zA-Z_]+\]\s*=

Grep Commands:

grep -rn --include="*.{js,ts}" "__proto__" .
grep -rn --include="*.{js,ts}" "constructor\s*\[" .

Severity: High ASVS: V1.5.1 - Safe deserialization CWE: CWE-1321 (Prototype Pollution)

Insecure Randomness

Detection Pattern:

Math\.random\s*\(\)

Context: Only flag when used for security purposes (tokens, keys, IDs)

Grep Commands:

grep -rn --include="*.{js,ts}" "Math\.random" .

Severity: Medium (context-dependent) ASVS: V11.3.1 - CSPRNG for security values CWE: CWE-330 (Insufficient Randomness)

Missing Security Headers (Express)

Detection Pattern:

# Express without helmet
app\s*=\s*express\s*\(\)(?!.*helmet)

Grep Commands:

grep -rn --include="*.{js,ts}" "express()" . | grep -v helmet
grep -rn --include="*.{js,ts}" "helmet" .

Severity: Medium ASVS: V3.4.1 - Security headers CWE: CWE-693 (Protection Mechanism Failure)

Python Patterns

Unsafe Deserialization

Detection Pattern:

# Pickle with untrusted data
pickle\.(loads?|load)\s*\(

# YAML unsafe load
yaml\.(load|unsafe_load)\s*\([^)]*(?!Loader\s*=\s*yaml\.SafeLoader)

# Marshal load
marshal\.loads?\s*\(

Grep Commands:

grep -rn --include="*.py" "pickle\.load" .
grep -rn --include="*.py" "yaml\.load" . | grep -v "SafeLoader\|safe_load"
grep -rn --include="*.py" "marshal\.load" .

Severity: Critical ASVS: V1.5.1 - Safe deserialization CWE: CWE-502 (Deserialization of Untrusted Data)

Weak Cryptography

Detection Pattern:

# MD5/SHA1 for security
hashlib\.(md5|sha1)\s*\(

# DES/RC4
DES\.|RC4\.|Blowfish\.

# ECB mode
\.MODE_ECB

Grep Commands:

grep -rn --include="*.py" "hashlib\.md5\|hashlib\.sha1" .
grep -rn --include="*.py" "MODE_ECB" .
grep -rn --include="*.py" -E "DES\.|RC4\." .

Severity: High ASVS: V11.5.2 - No MD5/SHA1 CWE: CWE-327 (Broken Crypto Algorithm)

Insecure Random

Detection Pattern:

# random module for security
random\.(choice|randint|random|randrange|sample)\s*\(

Context: Flag when used for tokens, keys, session IDs

Grep Commands:

grep -rn --include="*.py" -E "random\.(choice|randint|random|randrange)" . | grep -i "token\|key\|session\|secret\|password"

Severity: High ASVS: V11.3.1 - CSPRNG CWE: CWE-338 (Weak PRNG)

Hardcoded Flask Secret Key

Detection Pattern:

SECRET_KEY\s*=\s*['"][^'"]+['"]
app\.secret_key\s*=\s*['"][^'"]+['"]

Grep Commands:

grep -rn --include="*.py" "SECRET_KEY\s*=\s*['\"]" .
grep -rn --include="*.py" "secret_key\s*=\s*['\"]" .

Severity: High ASVS: V13.3.1 - Secrets management CWE: CWE-798 (Hardcoded Credentials)

Debug Mode in Production

Detection Pattern:

DEBUG\s*=\s*True
app\.run\s*\([^)]*debug\s*=\s*True
FLASK_DEBUG\s*=\s*['"]?1

Grep Commands:

grep -rn --include="*.py" "DEBUG\s*=\s*True" .
grep -rn --include="*.py" "debug\s*=\s*True" .

Severity: High ASVS: V13.2.1 - Debug disabled in production CWE: CWE-489 (Active Debug Code)

TLS Verification Disabled

Detection Pattern:

verify\s*=\s*False
REQUESTS_CA_BUNDLE\s*=\s*['"]?$
urllib3\.disable_warnings

Grep Commands:

grep -rn --include="*.py" "verify\s*=\s*False" .
grep -rn --include="*.py" "disable_warnings" .

Severity: High ASVS: V12.3.1 - Certificate validation CWE: CWE-295 (Improper Certificate Validation)

Go Patterns

SQL Injection

Detection Pattern:

# fmt.Sprintf in queries
fmt\.Sprintf\s*\([^)]*SELECT
db\.(Query|Exec)\s*\([^)]*\+

# String concatenation
"SELECT.*"\s*\+

Grep Commands:

grep -rn --include="*.go" -E "fmt\.Sprintf.*SELECT|fmt\.Sprintf.*INSERT" .
grep -rn --include="*.go" -E "db\.(Query|Exec)\s*\(.*\+" .

Severity: Critical ASVS: V1.2.1 - Parameterized queries CWE: CWE-89 (SQL Injection)

Weak Cryptography

Detection Pattern:

crypto/md5
crypto/sha1
crypto/des
crypto/rc4

Grep Commands:

grep -rn --include="*.go" "crypto/md5\|crypto/sha1\|crypto/des\|crypto/rc4" .

Severity: High ASVS: V11.5.2 - No deprecated algorithms CWE: CWE-327 (Broken Crypto)

Insecure TLS Config

Detection Pattern:

InsecureSkipVerify\s*:\s*true
MinVersion\s*:\s*tls\.VersionSSL
MinVersion\s*:\s*tls\.VersionTLS10

Grep Commands:

grep -rn --include="*.go" "InsecureSkipVerify.*true" .
grep -rn --include="*.go" "MinVersion.*SSL\|MinVersion.*TLS10\|MinVersion.*TLS11" .

Severity: High ASVS: V12.2.1 - TLS 1.2+ CWE: CWE-295 (Certificate Validation)

Java Patterns

SQL Injection

Detection Pattern:

# String concatenation
Statement\s+\w+\s*=.*createStatement
executeQuery\s*\([^?]*\+
"SELECT.*"\s*\+

# PreparedStatement misuse
prepareStatement\s*\([^?]*\+

Grep Commands:

grep -rn --include="*.java" "createStatement" .
grep -rn --include="*.java" -E "executeQuery\s*\(.*\+" .
grep -rn --include="*.java" -E "\"SELECT.*\"\s*\+" .

Severity: Critical ASVS: V1.2.1 - Parameterized queries CWE: CWE-89 (SQL Injection)

Unsafe Deserialization

Detection Pattern:

ObjectInputStream
readObject\s*\(\)
XMLDecoder
XStream(?!.*allowTypes)

Grep Commands:

grep -rn --include="*.java" "ObjectInputStream\|readObject()" .
grep -rn --include="*.java" "XMLDecoder" .

Severity: Critical ASVS: V1.5.1 - Safe deserialization CWE: CWE-502 (Deserialization)

XXE Vulnerability

Detection Pattern:

DocumentBuilderFactory(?!.*setFeature.*FEATURE_SECURE)
SAXParserFactory(?!.*setFeature)
XMLInputFactory(?!.*setProperty.*SUPPORT_DTD)

Grep Commands:

grep -rn --include="*.java" "DocumentBuilderFactory\|SAXParserFactory\|XMLInputFactory" .

Severity: High ASVS: V1.5.1 - XML processing CWE: CWE-611 (XXE)

Weak Cryptography

Detection Pattern:

MessageDigest\.getInstance\s*\(\s*["']MD5
MessageDigest\.getInstance\s*\(\s*["']SHA-?1
Cipher\.getInstance\s*\(\s*["']DES
Cipher\.getInstance\s*\(\s*["'].*ECB

Grep Commands:

grep -rn --include="*.java" -E "MessageDigest\.getInstance.*MD5|MessageDigest\.getInstance.*SHA.?1" .
grep -rn --include="*.java" "Cipher\.getInstance.*DES\|Cipher\.getInstance.*ECB" .

Severity: High ASVS: V11.5.2 - Secure algorithms CWE: CWE-327 (Broken Crypto)

Ruby Patterns

Command Injection

Detection Pattern:

`[^`]*#{
system\s*\([^)]*#{
exec\s*\([^)]*#{
%x\{[^}]*#{

Grep Commands:

grep -rn --include="*.rb" -E "\`.*#\{" .
grep -rn --include="*.rb" -E "system\s*\(.*#\{" .
grep -rn --include="*.rb" "%x{" .

Severity: Critical ASVS: V1.2.3 - Command injection CWE: CWE-78 (OS Command Injection)

SQL Injection (Rails)

Detection Pattern:

\.where\s*\([^)]*#{
\.find_by_sql\s*\([^)]*#{
\.execute\s*\([^)]*#{
\.order\s*\([^)]*#{

Grep Commands:

grep -rn --include="*.rb" -E "\.where\s*\(.*#\{" .
grep -rn --include="*.rb" "find_by_sql" .

Severity: Critical ASVS: V1.2.1 - Parameterized queries CWE: CWE-89 (SQL Injection)

Mass Assignment

Detection Pattern:

attr_accessible\s*:
params\.permit!
\.update_attributes?\s*\(params

Grep Commands:

grep -rn --include="*.rb" "params\.permit!" .
grep -rn --include="*.rb" "update_attributes.*params" .

Severity: High ASVS: V2.2.1 - Input validation CWE: CWE-915 (Mass Assignment)

PHP Patterns

SQL Injection

Detection Pattern:

mysql_query\s*\(
mysqli_query\s*\([^,]+,\s*["'][^?]
\$_(?:GET|POST|REQUEST)\s*\[.*\]\s*\.

Grep Commands:

grep -rn --include="*.php" "mysql_query\|mysqli_query" .
grep -rn --include="*.php" '\$_(GET|POST|REQUEST).*\.' .

Severity: Critical ASVS: V1.2.1 - Parameterized queries CWE: CWE-89 (SQL Injection)

Command Injection

Detection Pattern:

(system|exec|shell_exec|passthru|popen|proc_open)\s*\(\s*\$
`\$

Grep Commands:

grep -rn --include="*.php" -E "(system|exec|shell_exec|passthru)\s*\(\s*\\\$" .

Severity: Critical ASVS: V1.2.3 - Command injection CWE: CWE-78 (OS Command Injection)

Unsafe Deserialization

Detection Pattern:

unserialize\s*\(\s*\$

Grep Commands:

grep -rn --include="*.php" "unserialize\s*(\s*\$" .

Severity: Critical ASVS: V1.5.1 - Safe deserialization CWE: CWE-502 (Deserialization)

File Inclusion

Detection Pattern:

(include|require|include_once|require_once)\s*\(\s*\$

Grep Commands:

grep -rn --include="*.php" -E "(include|require)(_once)?\s*\(\s*\\\$" .

Severity: Critical ASVS: V5.3.1 - File security CWE: CWE-98 (File Inclusion)

Quick Reference by Language

Language	Critical Issues	High Issues
JS/TS	eval(), XSS	Prototype pollution
Python	pickle, yaml.load	MD5/SHA1, random
Go	fmt.Sprintf SQL	InsecureSkipVerify
Java	ObjectInputStream, SQL	XXE, MD5/SHA1
Ruby	backticks, SQL	Mass assignment
PHP	unserialize, include	mysql_query

Vulnerability Patterns: Language-Specific

Detection patterns organized by programming language.

When to Use This Skill

Language-targeted scans - When auditing specific tech stacks
Code review - Finding vulnerabilities in PRs
Building auditor agents - Patterns for domain auditors

When NOT to Use This Skill

Universal patterns - Use vuln-patterns-core skill
Full audits - Use domain auditor agents
Remediation - Use remediation-* skills

JavaScript/TypeScript Patterns

Dangerous eval()

Detection Pattern:

# eval with variables
eval\s*\([^)]*[a-zA-Z_]+[^)]*\)

# Function constructor
new\s+Function\s*\([^)]*[a-zA-Z_]+

# setTimeout/setInterval with string
(setTimeout|setInterval)\s*\([^,)]*['"`]

Grep Commands:

grep -rn --include="*.{js,ts}" -E "eval\s*\(" .
grep -rn --include="*.{js,ts}" -E "new\s+Function\s*\(" .
grep -rn --include="*.{js,ts}" -E "(setTimeout|setInterval)\s*\(['\"\`]" .

Severity: Critical ASVS: V1.5.1 - Safe deserialization CWE: CWE-94 (Code Injection)

XSS via DOM Manipulation

Detection Pattern:

# innerHTML assignment
\.innerHTML\s*=(?!\s*['"]<[^>]+>[^<]*</[^>]+>['"])

# document.write
document\.write\s*\(

# insertAdjacentHTML
\.insertAdjacentHTML\s*\(

# React dangerouslySetInnerHTML
dangerouslySetInnerHTML

Grep Commands:

grep -rn --include="*.{js,ts,jsx,tsx}" "\.innerHTML\s*=" .
grep -rn --include="*.{js,ts,jsx,tsx}" "document\.write" .
grep -rn --include="*.{js,ts,jsx,tsx}" "dangerouslySetInnerHTML" .

Severity: High ASVS: V3.3.1 - XSS prevention CWE: CWE-79 (Cross-site Scripting)

Prototype Pollution

Detection Pattern:

# Direct __proto__ access
__proto__

# Object merge without validation
Object\.assign\s*\([^)]*,[^)]*\)
\.\.\.(?!props)[a-zA-Z_]+

# Bracket notation with variable
\[[a-zA-Z_]+\]\s*=

Grep Commands:

grep -rn --include="*.{js,ts}" "__proto__" .
grep -rn --include="*.{js,ts}" "constructor\s*\[" .

Severity: High ASVS: V1.5.1 - Safe deserialization CWE: CWE-1321 (Prototype Pollution)

Insecure Randomness

Detection Pattern:

Math\.random\s*\(\)

Context: Only flag when used for security purposes (tokens, keys, IDs)

Grep Commands:

grep -rn --include="*.{js,ts}" "Math\.random" .

Severity: Medium (context-dependent) ASVS: V11.3.1 - CSPRNG for security values CWE: CWE-330 (Insufficient Randomness)

Missing Security Headers (Express)

Detection Pattern:

# Express without helmet
app\s*=\s*express\s*\(\)(?!.*helmet)

Grep Commands:

grep -rn --include="*.{js,ts}" "express()" . | grep -v helmet
grep -rn --include="*.{js,ts}" "helmet" .

Severity: Medium ASVS: V3.4.1 - Security headers CWE: CWE-693 (Protection Mechanism Failure)

Python Patterns

Unsafe Deserialization

Detection Pattern:

# Pickle with untrusted data
pickle\.(loads?|load)\s*\(

# YAML unsafe load
yaml\.(load|unsafe_load)\s*\([^)]*(?!Loader\s*=\s*yaml\.SafeLoader)

# Marshal load
marshal\.loads?\s*\(

Grep Commands:

grep -rn --include="*.py" "pickle\.load" .
grep -rn --include="*.py" "yaml\.load" . | grep -v "SafeLoader\|safe_load"
grep -rn --include="*.py" "marshal\.load" .

Severity: Critical ASVS: V1.5.1 - Safe deserialization CWE: CWE-502 (Deserialization of Untrusted Data)

Weak Cryptography

Detection Pattern:

# MD5/SHA1 for security
hashlib\.(md5|sha1)\s*\(

# DES/RC4
DES\.|RC4\.|Blowfish\.

# ECB mode
\.MODE_ECB

Grep Commands:

grep -rn --include="*.py" "hashlib\.md5\|hashlib\.sha1" .
grep -rn --include="*.py" "MODE_ECB" .
grep -rn --include="*.py" -E "DES\.|RC4\." .

Severity: High ASVS: V11.5.2 - No MD5/SHA1 CWE: CWE-327 (Broken Crypto Algorithm)

Insecure Random

Detection Pattern:

# random module for security
random\.(choice|randint|random|randrange|sample)\s*\(

Context: Flag when used for tokens, keys, session IDs

Grep Commands:

grep -rn --include="*.py" -E "random\.(choice|randint|random|randrange)" . | grep -i "token\|key\|session\|secret\|password"

Severity: High ASVS: V11.3.1 - CSPRNG CWE: CWE-338 (Weak PRNG)

Hardcoded Flask Secret Key

Detection Pattern:

SECRET_KEY\s*=\s*['"][^'"]+['"]
app\.secret_key\s*=\s*['"][^'"]+['"]

Grep Commands:

grep -rn --include="*.py" "SECRET_KEY\s*=\s*['\"]" .
grep -rn --include="*.py" "secret_key\s*=\s*['\"]" .

Severity: High ASVS: V13.3.1 - Secrets management CWE: CWE-798 (Hardcoded Credentials)

Debug Mode in Production

Detection Pattern:

DEBUG\s*=\s*True
app\.run\s*\([^)]*debug\s*=\s*True
FLASK_DEBUG\s*=\s*['"]?1

Grep Commands:

grep -rn --include="*.py" "DEBUG\s*=\s*True" .
grep -rn --include="*.py" "debug\s*=\s*True" .

Severity: High ASVS: V13.2.1 - Debug disabled in production CWE: CWE-489 (Active Debug Code)

TLS Verification Disabled

Detection Pattern:

verify\s*=\s*False
REQUESTS_CA_BUNDLE\s*=\s*['"]?$
urllib3\.disable_warnings

Grep Commands:

grep -rn --include="*.py" "verify\s*=\s*False" .
grep -rn --include="*.py" "disable_warnings" .

Severity: High ASVS: V12.3.1 - Certificate validation CWE: CWE-295 (Improper Certificate Validation)

Go Patterns

SQL Injection

Detection Pattern:

# fmt.Sprintf in queries
fmt\.Sprintf\s*\([^)]*SELECT
db\.(Query|Exec)\s*\([^)]*\+

# String concatenation
"SELECT.*"\s*\+

Grep Commands:

grep -rn --include="*.go" -E "fmt\.Sprintf.*SELECT|fmt\.Sprintf.*INSERT" .
grep -rn --include="*.go" -E "db\.(Query|Exec)\s*\(.*\+" .

Severity: Critical ASVS: V1.2.1 - Parameterized queries CWE: CWE-89 (SQL Injection)

Weak Cryptography

Detection Pattern:

crypto/md5
crypto/sha1
crypto/des
crypto/rc4

Grep Commands:

grep -rn --include="*.go" "crypto/md5\|crypto/sha1\|crypto/des\|crypto/rc4" .

Severity: High ASVS: V11.5.2 - No deprecated algorithms CWE: CWE-327 (Broken Crypto)

Insecure TLS Config

Detection Pattern:

InsecureSkipVerify\s*:\s*true
MinVersion\s*:\s*tls\.VersionSSL
MinVersion\s*:\s*tls\.VersionTLS10

Grep Commands:

grep -rn --include="*.go" "InsecureSkipVerify.*true" .
grep -rn --include="*.go" "MinVersion.*SSL\|MinVersion.*TLS10\|MinVersion.*TLS11" .

Severity: High ASVS: V12.2.1 - TLS 1.2+ CWE: CWE-295 (Certificate Validation)

Java Patterns

SQL Injection

Detection Pattern:

# String concatenation
Statement\s+\w+\s*=.*createStatement
executeQuery\s*\([^?]*\+
"SELECT.*"\s*\+

# PreparedStatement misuse
prepareStatement\s*\([^?]*\+

Grep Commands:

grep -rn --include="*.java" "createStatement" .
grep -rn --include="*.java" -E "executeQuery\s*\(.*\+" .
grep -rn --include="*.java" -E "\"SELECT.*\"\s*\+" .

Severity: Critical ASVS: V1.2.1 - Parameterized queries CWE: CWE-89 (SQL Injection)

Unsafe Deserialization

Detection Pattern:

ObjectInputStream
readObject\s*\(\)
XMLDecoder
XStream(?!.*allowTypes)

Grep Commands:

grep -rn --include="*.java" "ObjectInputStream\|readObject()" .
grep -rn --include="*.java" "XMLDecoder" .

Severity: Critical ASVS: V1.5.1 - Safe deserialization CWE: CWE-502 (Deserialization)

XXE Vulnerability

Detection Pattern:

DocumentBuilderFactory(?!.*setFeature.*FEATURE_SECURE)
SAXParserFactory(?!.*setFeature)
XMLInputFactory(?!.*setProperty.*SUPPORT_DTD)

Grep Commands:

grep -rn --include="*.java" "DocumentBuilderFactory\|SAXParserFactory\|XMLInputFactory" .

Severity: High ASVS: V1.5.1 - XML processing CWE: CWE-611 (XXE)

Weak Cryptography

Detection Pattern:

MessageDigest\.getInstance\s*\(\s*["']MD5
MessageDigest\.getInstance\s*\(\s*["']SHA-?1
Cipher\.getInstance\s*\(\s*["']DES
Cipher\.getInstance\s*\(\s*["'].*ECB

Grep Commands:

grep -rn --include="*.java" -E "MessageDigest\.getInstance.*MD5|MessageDigest\.getInstance.*SHA.?1" .
grep -rn --include="*.java" "Cipher\.getInstance.*DES\|Cipher\.getInstance.*ECB" .

Severity: High ASVS: V11.5.2 - Secure algorithms CWE: CWE-327 (Broken Crypto)

Ruby Patterns

Command Injection

Detection Pattern:

`[^`]*#{
system\s*\([^)]*#{
exec\s*\([^)]*#{
%x\{[^}]*#{

Grep Commands:

grep -rn --include="*.rb" -E "\`.*#\{" .
grep -rn --include="*.rb" -E "system\s*\(.*#\{" .
grep -rn --include="*.rb" "%x{" .

Severity: Critical ASVS: V1.2.3 - Command injection CWE: CWE-78 (OS Command Injection)

SQL Injection (Rails)

Detection Pattern:

\.where\s*\([^)]*#{
\.find_by_sql\s*\([^)]*#{
\.execute\s*\([^)]*#{
\.order\s*\([^)]*#{

Grep Commands:

grep -rn --include="*.rb" -E "\.where\s*\(.*#\{" .
grep -rn --include="*.rb" "find_by_sql" .

Severity: Critical ASVS: V1.2.1 - Parameterized queries CWE: CWE-89 (SQL Injection)

Mass Assignment

Detection Pattern:

attr_accessible\s*:
params\.permit!
\.update_attributes?\s*\(params

Grep Commands:

grep -rn --include="*.rb" "params\.permit!" .
grep -rn --include="*.rb" "update_attributes.*params" .

Severity: High ASVS: V2.2.1 - Input validation CWE: CWE-915 (Mass Assignment)

PHP Patterns

SQL Injection

Detection Pattern:

mysql_query\s*\(
mysqli_query\s*\([^,]+,\s*["'][^?]
\$_(?:GET|POST|REQUEST)\s*\[.*\]\s*\.

Grep Commands:

grep -rn --include="*.php" "mysql_query\|mysqli_query" .
grep -rn --include="*.php" '\$_(GET|POST|REQUEST).*\.' .

Severity: Critical ASVS: V1.2.1 - Parameterized queries CWE: CWE-89 (SQL Injection)

Command Injection

Detection Pattern:

(system|exec|shell_exec|passthru|popen|proc_open)\s*\(\s*\$
`\$

Grep Commands:

grep -rn --include="*.php" -E "(system|exec|shell_exec|passthru)\s*\(\s*\\\$" .

Severity: Critical ASVS: V1.2.3 - Command injection CWE: CWE-78 (OS Command Injection)

Unsafe Deserialization

Detection Pattern:

unserialize\s*\(\s*\$

Grep Commands:

grep -rn --include="*.php" "unserialize\s*(\s*\$" .

Severity: Critical ASVS: V1.5.1 - Safe deserialization CWE: CWE-502 (Deserialization)

File Inclusion

Detection Pattern:

(include|require|include_once|require_once)\s*\(\s*\$

Grep Commands:

grep -rn --include="*.php" -E "(include|require)(_once)?\s*\(\s*\\\$" .

Severity: Critical ASVS: V5.3.1 - File security CWE: CWE-98 (File Inclusion)

Quick Reference by Language

Language	Critical Issues	High Issues
JS/TS	eval(), XSS	Prototype pollution
Python	pickle, yaml.load	MD5/SHA1, random
Go	fmt.Sprintf SQL	InsecureSkipVerify
Java	ObjectInputStream, SQL	XXE, MD5/SHA1
Ruby	backticks, SQL	Mass assignment
PHP	unserialize, include	mysql_query

vuln-patterns-languages

Source facts

Install options

Review the source files

More from this repository

More from this repository

Vulnerability Patterns: Language-Specific

When to Use This Skill

When NOT to Use This Skill

JavaScript/TypeScript Patterns

Dangerous eval()

XSS via DOM Manipulation

Prototype Pollution

Insecure Randomness

Missing Security Headers (Express)

Python Patterns

Unsafe Deserialization

Weak Cryptography

Insecure Random

Hardcoded Flask Secret Key

Debug Mode in Production

TLS Verification Disabled

Go Patterns

SQL Injection

Weak Cryptography

Insecure TLS Config

Java Patterns

SQL Injection

Unsafe Deserialization

XXE Vulnerability

Weak Cryptography

Ruby Patterns

Command Injection

SQL Injection (Rails)

Mass Assignment

PHP Patterns

SQL Injection

Command Injection

Unsafe Deserialization

File Inclusion

Quick Reference by Language

See Also

Vulnerability Patterns: Language-Specific

When to Use This Skill

When NOT to Use This Skill

JavaScript/TypeScript Patterns

Dangerous eval()

XSS via DOM Manipulation

Prototype Pollution

Insecure Randomness

Missing Security Headers (Express)

Python Patterns

Unsafe Deserialization

Weak Cryptography

Insecure Random

Hardcoded Flask Secret Key

Debug Mode in Production

TLS Verification Disabled

Go Patterns

SQL Injection

Weak Cryptography

Insecure TLS Config

Java Patterns

SQL Injection

Unsafe Deserialization

XXE Vulnerability

Weak Cryptography

Ruby Patterns

Command Injection

SQL Injection (Rails)

Mass Assignment

PHP Patterns

SQL Injection

Command Injection

Unsafe Deserialization

File Inclusion

Quick Reference by Language

See Also