菜单
Security anti-pattern for type confusion vulnerabilities (CWE-843). Use when generating or reviewing code in dynamic languages that compares values, processes JSON/user input, or uses loose equality. Detects weak typing exploits and type coercion attacks.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/igbuend/grimbard --skill type-confusion-anti-pattern命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | type-confusion-anti-pattern |
| description | Security anti-pattern for type confusion vulnerabilities (CWE-843). Use when generating or reviewing code in dynamic languages that compares values, processes JSON/user input, or uses loose equality. Detects weak typing exploits and type coercion attacks. |
Severity: High
Programs misinterpret data types through loose comparisons, implicit coercion, or improper input handling. Attackers exploit type confusion in weakly-typed languages (JavaScript, PHP) and dynamic data structures (JSON) to bypass security checks, manipulate logic, or achieve code execution.
The anti-pattern is using loose equality (==) or trusting incoming data types without explicit validation.
// VULNERABLE: Loose equality comparison in authentication.
function checkAdminAccess(userId) {
// Expected: userId is string "123".
// Attacker input: userId is number 0.
// JavaScript: "0" == 0 evaluates to true (type coercion).
if (userId == 0) { // Loose equality
return true; // Grants admin access if userId is "0" or 0.
}
return false;
}
// Scenario 1: userId = "0" (string) gains admin access.
// Scenario 2: userId = 0 (number) bypasses the check.
// PHP example: "0e12345" == "0e56789" (both evaluate to 0).
// If password hash starts with "0e", attacker provides another
// hash starting with "0e" to bypass authentication.
// SECURE: Strict equality and explicit type validation.
// Option 1: Strict equality (===) checks both value AND type.
function checkAdminAccessSecure(userId) {
// "0" === 0 evaluates to false.
if (userId === 0) {
return true;
}
return false;
}
// Option 2: Explicitly validate input type.
function processProductId(productId) {
// Ensure productId is string matching expected format.
if (typeof productId !== 'string' || !/^\d+$/.test(productId)) {
throw new Error("Invalid product ID format.");
}
// Safe to use productId with known type and format.
return parseInt(productId, 10);
}
== in JavaScript or PHP code (prefer ===).$gt, $ne) by changing the input's type from a string to an object.=== instead of ==.