second-order-injection-anti-pattern

name	second-order-injection-anti-pattern
description	Security anti-pattern for second-order injection vulnerabilities (CWE-89 variant). Use when generating or reviewing code that retrieves data from databases, caches, or storage and uses it in subsequent queries or commands. Detects trusted internal data used unsafely.

Second-Order Injection Anti-Pattern

Severity: High

Summary

Malicious payloads are stored safely in databases or logs, then executed later when retrieved and used without re-sanitization. Initial storage appears secure (properly parameterized), but subsequent retrieval and unsafe use activates the payload. Injection and execution points are separated in time and code location, making detection difficult.

The Anti-Pattern

The anti-pattern is treating database-retrieved data as safe and using it in queries or commands without re-sanitization or parameterization.

BAD Code Example

# VULNERABLE: Data is stored safely, but later retrieved and used unsafely.
import sqlite3

db = sqlite3.connect("app.db")
db.execute("CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY, name TEXT, email TEXT)")
db.execute("CREATE TABLE IF NOT EXISTS logs (id INTEGER PRIMARY KEY, action TEXT, user_email TEXT)")

# Step 1: User Registration (appears safe)
def register_user(name, email):
    # Parameterized query, safe against direct injection.
    # Attacker email: "[e-mail]' UNION SELECT password FROM users -- "
    # Safely stored as string in 'email' column.
    db.execute("INSERT INTO users (name, email) VALUES (?, ?)", (name, email))
    db.commit()


 ():
    
    cursor = db.execute(, (user_id,))
    user_email = cursor.fetchone()[]

    
    
    log_query = 

    
    
    db.execute(log_query)
    db.commit()