type-confusion-anti-pattern

name	type-confusion-anti-pattern
description	Security anti-pattern for type confusion vulnerabilities (CWE-843). Use when generating or reviewing code in dynamic languages that compares values, processes JSON/user input, or uses loose equality. Detects weak typing exploits and type coercion attacks.

Type Confusion Anti-Pattern

Severity: High

Summary

Programs misinterpret data types through loose comparisons, implicit coercion, or improper input handling. Attackers exploit type confusion in weakly-typed languages (JavaScript, PHP) and dynamic data structures (JSON) to bypass security checks, manipulate logic, or achieve code execution.

The Anti-Pattern

The anti-pattern is using loose equality (==) or trusting incoming data types without explicit validation.

BAD Code Example

// VULNERABLE: Loose equality comparison in authentication.

function checkAdminAccess(userId) {
    // Expected: userId is string "123".
    // Attacker input: userId is number 0.
    // JavaScript: "0" == 0 evaluates to true (type coercion).
    if (userId == 0) { // Loose equality
        return true; // Grants admin access if userId is "0" or 0.
    }
    return false;
}

// Scenario 1: userId = "0" (string) gains admin access.
// Scenario 2: userId = 0 (number) bypasses the check.