vulnerability-patterns

name	vulnerability-patterns
description	Use when performing security code review — provides CWE-classified vulnerability pattern library, language-specific attack vectors, and safe code alternatives. Extends the security-analyst agent in the code-reviewer harness. Also triggers on: re-run, update, revise, supplement.
metadata	{"category":"harness","harness":"21-code-reviewer","agent_type":"general-purpose"}

Vulnerability Patterns — Security Pattern Reference

A comprehensive reference library for common vulnerability patterns, CWE classifications, and safe alternatives for the security-analyst agent.

CWE Top 25 Quick Reference

CWE	Name	Common Manifestations
CWE-79	XSS	innerHTML, eval, dangerouslySetInnerHTML
CWE-89	SQL Injection	String concatenation in queries
CWE-22	Path Traversal	User input in file paths
CWE-78	OS Command Injection	subprocess with user input
CWE-306	Missing Auth	Unauthenticated endpoints
CWE-502	Unsafe Deserialization	pickle.loads, eval(json), ObjectInputStream
CWE-798	Hardcoded Credentials	Literals matching /password
CWE-330	Insufficient Randomness	Math.random() for security, random.random()
CWE-327	Broken Crypto	MD5/SHA1 for passwords, ECB mode
CWE-434	Unrestricted File Upload	Missing type/size/content validation

Language-Specific Patterns

JavaScript / TypeScript

// ❌ XSS via innerHTML
element.innerHTML = userInput;
// ✅ Safe
element.textContent = userInput;

// ❌ Prototype pollution
obj[userKey] = userValue; // if key is "__proto__"
// ✅ Safe
if (!['__proto__', 'constructor', 'prototype'].includes(userKey)) {
  obj[userKey] = userValue;
}

// ❌ Regex DoS
new RegExp(userInput);
// ✅ Escape user input before using in regex

Python

# ❌ SQL injection
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
# ✅ Parameterized
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

# ❌ Command injection
os.system(f"ls {user_path}")
# ✅ Safe
subprocess.run(["ls", user_path], check=True)

# ❌ Unsafe deserialization
pickle.loads(user_data)
# ✅ Use json or restrict to trusted data only

Java

// ❌ SQL injection
String query = "SELECT * FROM users WHERE id = " + userId;
// ✅ PreparedStatement
PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
stmt.setInt(1, userId);

// ❌ XXE
DocumentBuilder db = DocumentBuilderFactory.newInstance().newDocumentBuilder();
// ✅ Disable external entities
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

OWASP Top 10 Checklist (2021)

#	Category	Key Checks
A01	Broken Access Control	Check all endpoints for auth, IDOR risks
A02	Cryptographic Failures	Encryption at rest/transit, weak algorithms
A03	Injection	All user input entering interpreters
A04	Insecure Design	Threat modeling, trust boundaries
A05	Security Misconfiguration	Default creds, verbose errors, open ports
A06	Vulnerable Components	Dependency versions, CVE checks
A07	Auth Failures	Session management, credential storage
A08	Integrity Failures	Deserialization, CI/CD pipeline integrity
A09	Logging Failures	Missing audit logs, logged sensitive data
A10	SSRF	User-controlled URLs, internal service access

Secure Defaults Reference

Passwords:     bcrypt (cost≥12), Argon2id, scrypt
CSRF:          SameSite=Strict cookie, CSRF token
Session IDs:   cryptographically random, ≥128 bits
JWT:           RS256/ES256 (not HS256 with shared secret)
Rate limiting: 5 attempts/15min for auth endpoints
Headers:       CSP, X-Frame-Options, HSTS, X-Content-Type-Options