skills/semgrep__skills
1
0
Fork 0
mirror of https://github.com/semgrep/skills.git synced 2026-09-20 14:21:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into pnpm-cooldown

Browse Source
This commit is contained in:
Leif
2026-04-25 03:09:14 +01:00
committed by GitHub
parent 5f56ac765a 814baa2b2c
commit 8d24921981
6 changed files with 353 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/skill-build/test-cases-code-security.json
+102 -62
View File
@@ -11,9 +11,9 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure JWT Authentication", "ruleTitle": "Secure JWT Authentication",
"type": "good", "type": "good",
"code": "const jwt = require('jsonwebtoken');\n\nfunction getUserData(token, secretKey) {\n jwt.verify(token, secretKey);\n const decoded = jwt.decode(token, true);\n if (decoded.isAdmin) {\n return getAdminData();\n }\n}", "code": "const jwt = require('jsonwebtoken');\n\nfunction getUserData(token, secretKey) {\n const decoded = jwt.verify(token, secretKey);\n if (decoded.isAdmin) {\n return getAdminData();\n }\n}",
"language": "javascript", "language": "javascript",
"description": "JavaScript jsonwebtoken - verify before decode" "description": "JavaScript jsonwebtoken - use verify which returns decoded payload"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -195,9 +195,9 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Code Injection", "ruleTitle": "Prevent Code Injection",
"type": "good", "type": "good",
"code": "eval(\"x = 1; x = x + 2\")\n\nblah = \"import requests; r = requests.get('https://example.com')\"\neval(blah)", "code": "import ast\n\ndef safe_parse(user_expr):\n # ast.literal_eval only allows literals (strings, numbers, tuples, lists, dicts, booleans, None)\n return ast.literal_eval(user_expr)\n\n# For math expressions, use a purpose-built parser instead of eval",
"language": "python", "language": "python",
"description": "Python - static eval with hardcoded strings" "description": "Python - avoid eval entirely, use safe alternatives"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -211,9 +211,9 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Code Injection", "ruleTitle": "Prevent Code Injection",
"type": "good", "type": "good",
"code": "eval('var x = \"static strings are okay\";');\n\nconst constVar = \"function staticStrings() { return 'static strings are okay';}\";\neval(constVar);", "code": "// Instead of eval for JSON parsing:\nconst data = JSON.parse(jsonString);\n\n// Instead of eval for dynamic property access:\nconst value = obj[propertyName];\n\n// Instead of eval for math: use a sandboxed expression parser",
"language": "javascript", "language": "javascript",
"description": "JavaScript - static eval strings" "description": "JavaScript - avoid eval, use safe alternatives"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -251,17 +251,17 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Code Injection", "ruleTitle": "Prevent Code Injection",
"type": "bad", "type": "bad",
"code": "exec($user_input);\npassthru($user_input);\n$output = shell_exec($user_input);\n$output = system($user_input, $retval);\n\n$username = $_COOKIE['username'];\nexec(\"wto -n \\\"$username\\\" -g\", $ret);", "code": "$code = $_GET['code'];\neval($code);\n\n$input = $_POST['input'];\nassert($input); // assert() evaluates strings as code in PHP < 8.0",
"language": "php", "language": "php",
"description": "PHP - dangerous exec functions with user input" "description": "PHP - code injection via eval/assert"
}, },
{ {
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Code Injection", "ruleTitle": "Prevent Code Injection",
"type": "good", "type": "good",
"code": "exec('whoami');\n\n$fullpath = $_POST['fullpath'];\n$filesize = trim(shell_exec('stat -c %s ' . escapeshellarg($fullpath)));", "code": "// Instead of eval for dynamic config, use a data format:\n$config = json_decode(file_get_contents('config.json'), true);\n\n// Instead of eval for templates, use a template engine (Twig, Blade)",
"language": "php", "language": "php",
"description": "PHP - static commands with escapeshellarg" "description": "PHP - avoid eval, use structured alternatives"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -383,6 +383,14 @@
"language": "python", "language": "python",
"description": "INCORRECT example for Code Correctness" "description": "INCORRECT example for Code Correctness"
}, },
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "try:\n raise ValueError()\nfinally:\n cleanup() # Cleanup runs, exception still propagates",
"language": "python",
"description": "CORRECT - Let the exception propagate; use finally only for cleanup example for Code Correctness"
},
{ {
"ruleId": "", "ruleId": "",
"ruleTitle": "Code Correctness", "ruleTitle": "Code Correctness",
@@ -455,6 +463,14 @@
"language": "go", "language": "go",
"description": "INCORRECT example for Code Correctness" "description": "INCORRECT example for Code Correctness"
}, },
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "parsed, err := strconv.ParseInt(\"2147483648\", 10, 32)\nif err != nil {\n // handles out-of-range and invalid syntax\n log.Fatal(err)\n}\nvalue := int32(parsed)",
"language": "go",
"description": "CORRECT example for Code Correctness"
},
{ {
"ruleId": "", "ruleId": "",
"ruleTitle": "Code Correctness", "ruleTitle": "Code Correctness",
@@ -499,7 +515,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Code Correctness", "ruleTitle": "Code Correctness",
"type": "good", "type": "good",
"code": "long l = strtol(buf, NULL, 10);", "code": "char *endptr;\nerrno = 0;\nlong l = strtol(buf, &endptr, 10);\nif (errno != 0 || endptr == buf || *endptr != '\\0') {\n // handle conversion error\n}",
"language": "c", "language": "c",
"description": "CORRECT example for Code Correctness" "description": "CORRECT example for Code Correctness"
}, },
@@ -555,17 +571,25 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery", "ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "bad", "type": "bad",
"code": "var express = require('express')\nvar bodyParser = require('body-parser')\n\nvar app = express()\n\napp.post('/process', bodyParser.urlencoded({ extended: false }), function(req, res) {\n res.send('data is being processed')\n})", "code": "const express = require('express')\nconst bodyParser = require('body-parser')\n\nconst app = express()\n\napp.post('/process', bodyParser.urlencoded({ extended: false }), function(req, res) {\n res.send('data is being processed')\n})",
"language": "javascript", "language": "javascript",
"description": "Express app without csurf middleware" "description": "Express app without CSRF protection"
}, },
{ {
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery", "ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "good", "type": "good",
"code": "var csrf = require('csurf')\nvar express = require('express')\n\nvar app = express()\napp.use(csrf({ cookie: true }))", "code": "const express = require('express')\nconst cookieParser = require('cookie-parser')\nconst { doubleCsrf } = require('csrf-csrf')\n\nconst { doubleCsrfProtection, generateToken } = doubleCsrf({\n getSecret: () => process.env.CSRF_SECRET,\n cookieName: '__Host-psifi.x-csrf-token',\n cookieOptions: { sameSite: 'strict', secure: true },\n})\n\nconst app = express()\napp.use(cookieParser())\napp.use(doubleCsrfProtection)\n\n// Generate a token for forms/SPA clients\napp.get('/csrf-token', (req, res) => {\n res.json({ token: generateToken(req, res) })\n})",
"language": "javascript", "language": "javascript",
"description": "include csurf middleware" "description": "Correct — Option A: csrf-csrf (Double-Submit Cookie pattern) example for Prevent Cross-Site Request Forgery"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "good",
"code": "const express = require('express')\nconst { csrfSync } = require('csrf-sync')\n\nconst { csrfSynchronisedProtection, generateToken } = csrfSync()\n\nconst app = express()\napp.use(csrfSynchronisedProtection)",
"language": "javascript",
"description": "Correct — Option B: csrf-sync (Synchronizer Token pattern) example for Prevent Cross-Site Request Forgery"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -603,7 +627,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Docker Configurations", "ruleTitle": "Secure Docker Configurations",
"type": "bad", "type": "bad",
"code": "FROM busybox\nRUN apt-get update && apt-get install -y some-package\nUSER appuser\nUSER root", "code": "FROM debian:bookworm\nRUN apt-get update && apt-get install -y some-package\nUSER appuser\nUSER root",
"language": "dockerfile", "language": "dockerfile",
"description": "Incorrect example for Secure Docker Configurations" "description": "Incorrect example for Secure Docker Configurations"
}, },
@@ -611,7 +635,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Docker Configurations", "ruleTitle": "Secure Docker Configurations",
"type": "good", "type": "good",
"code": "FROM busybox\nUSER root\nRUN apt-get update && apt-get install -y some-package\nUSER appuser", "code": "FROM debian:bookworm\nUSER root\nRUN apt-get update && apt-get install -y some-package\nUSER appuser",
"language": "dockerfile", "language": "dockerfile",
"description": "Correct example for Secure Docker Configurations" "description": "Correct example for Secure Docker Configurations"
}, },
@@ -675,9 +699,9 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Docker Configurations", "ruleTitle": "Secure Docker Configurations",
"type": "good", "type": "good",
"code": "version: \"3.9\"\nservices:\n worker:\n image: my-worker-image:1.0\n volumes:\n - /tmp/data:/tmp/data", "code": "version: \"3.9\"\nservices:\n worker:\n image: my-worker-image:1.0\n volumes:\n - worker-data:/app/data\nvolumes:\n worker-data:",
"language": "yaml", "language": "yaml",
"description": "Correct example for Secure Docker Configurations" "description": "use a named volume instead of host mounts"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -803,9 +827,9 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography", "ruleTitle": "Avoid Insecure Cryptography",
"type": "good", "type": "good",
"code": "const crypto = require(\"crypto\");\n\nfunction hashPassword(pwtext) {\n return crypto.createHash(\"sha256\").update(pwtext).digest(\"hex\");\n}", "code": "const bcrypt = require(\"bcrypt\");\n\nasync function hashPassword(pwtext) {\n return bcrypt.hash(pwtext, 12);\n}\n\nasync function verifyPassword(pwtext, hash) {\n return bcrypt.compare(pwtext, hash);\n}",
"language": "javascript", "language": "javascript",
"description": "SHA256 hashing" "description": "bcrypt for password hashing"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -819,15 +843,15 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography", "ruleTitle": "Avoid Insecure Cryptography",
"type": "good", "type": "good",
"code": "import java.security.MessageDigest;\n\nMessageDigest sha512 = MessageDigest.getInstance(\"SHA-512\");\nsha512.update(password.getBytes());\nbyte[] hash = sha512.digest();", "code": "import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;\n\nBCryptPasswordEncoder encoder = new BCryptPasswordEncoder();\nString hash = encoder.encode(password);\nboolean matches = encoder.matches(password, hash);",
"language": "java", "language": "java",
"description": "SHA-512 hashing" "description": "BCrypt for password hashing"
}, },
{ {
"ruleId": "", "ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography", "ruleTitle": "Avoid Insecure Cryptography",
"type": "bad", "type": "bad",
"code": "Cipher c = Cipher.getInstance(\"DES/ECB/PKCS5Padding\");\nc.init(Cipher.ENCRYPT_MODE, k, iv);", "code": "Cipher c = Cipher.getInstance(\"DES/ECB/PKCS5Padding\");\nc.init(Cipher.ENCRYPT_MODE, k);",
"language": "java", "language": "java",
"description": "DES cipher" "description": "DES cipher"
}, },
@@ -1091,9 +1115,17 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Use Secure Transport", "ruleTitle": "Use Secure Transport",
"type": "good", "type": "good",
"code": "new X509TrustManager() {\n public X509Certificate[] getAcceptedIssuers() { return null; }\n public void checkClientTrusted(X509Certificate[] certs, String authType) { }\n public void checkServerTrusted(X509Certificate[] certs, String authType) {\n try {\n checkValidity();\n } catch (Exception e) {\n throw new CertificateException(\"Certificate not valid or trusted.\");\n }\n }\n}", "code": "// HttpClient uses the JVM default SSLContext, which validates certificates properly\nHttpClient client = HttpClient.newBuilder().build();\n\nHttpRequest request = HttpRequest.newBuilder()\n .uri(URI.create(\"https://example.com/\"))\n .build();\n\nHttpResponse<String> response = client.send(request, BodyHandlers.ofString());",
"language": "java", "language": "java",
"description": "proper certificate validation" "description": "Correct — Option A: Use the JVM default trust manager (preferred) example for Use Secure Transport"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\ntmf.init((KeyStore) null); // uses the JVM default trust store\n\nSSLContext sslContext = SSLContext.getInstance(\"TLS\");\nsslContext.init(null, tmf.getTrustManagers(), new SecureRandom());\n\n// Enable hostname verification\nSSLParameters sslParams = new SSLParameters();\nsslParams.setEndpointIdentificationAlgorithm(\"HTTPS\");\n\nHttpClient client = HttpClient.newBuilder()\n .sslContext(sslContext)\n .sslParameters(sslParams)\n .build();",
"language": "java",
"description": "Correct — Option B: Explicit SSLContext with default TrustManagerFactory (when custom configuration is needed) example for Use Secure Transport"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -1195,7 +1227,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations", "ruleTitle": "Secure Kubernetes Configurations",
"type": "bad", "type": "bad",
"code": "apiVersion: v1\nkind: Pod\nspec:\n containers:\n - image: gcr.io/google_containers/test-webserver\n name: test-container\n volumeMounts:\n - mountPath: /var/run/docker.sock\n name: docker-sock-volume\n volumes:\n - name: docker-sock-volume\n hostPath:\n type: File\n path: /var/run/docker.sock", "code": "apiVersion: v1\nkind: Pod\nspec:\n containers:\n - image: gcr.io/google_containers/test-webserver\n name: test-container\n volumeMounts:\n - mountPath: /var/run/docker.sock\n name: docker-sock-volume\n volumes:\n - name: docker-sock-volume\n hostPath:\n type: Socket\n path: /var/run/docker.sock",
"language": "yaml", "language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations" "description": "Incorrect example for Secure Kubernetes Configurations"
}, },
@@ -1363,7 +1395,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Ensure Memory Safety", "ruleTitle": "Ensure Memory Safety",
"type": "good", "type": "good",
"code": "void safe_code(char *user_input) {\n char buffer[64];\n strncpy(buffer, user_input, sizeof(buffer) - 1);\n buffer[sizeof(buffer) - 1] = '\\0'; // Ensure null termination\n}", "code": "void safe_code(char *user_input) {\n char buffer[64];\n snprintf(buffer, sizeof(buffer), \"%s\", user_input); // Bounds-checked, always null-terminates\n}",
"language": "c", "language": "c",
"description": "Correct example for Ensure Memory Safety" "description": "Correct example for Ensure Memory Safety"
}, },
@@ -1427,9 +1459,9 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Path Traversal", "ruleTitle": "Prevent Path Traversal",
"type": "good", "type": "good",
"code": "const path = require('path');\n\nfunction getFileSafe(req, res) {\n let somePath = req.body.path;\n somePath = somePath.replace(/^(\\.\\.(\\/|\\\\|$))+/, '');\n return path.join(opts.path, somePath);\n}", "code": "const path = require('path');\n\nfunction getFileSafe(req, res) {\n const baseDir = path.resolve(opts.path);\n const resolved = path.resolve(baseDir, '.' + req.body.path);\n if (!resolved.startsWith(baseDir + path.sep)) {\n throw new Error('path traversal attempt');\n }\n return extractFile(resolved);\n}",
"language": "javascript", "language": "javascript",
"description": "path sanitized" "description": "resolve and enforce boundary"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -1563,17 +1595,17 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Performance Best Practices", "ruleTitle": "Performance Best Practices",
"type": "bad", "type": "bad",
"code": "if (items.length === 0) { /* empty */ }", "code": "for (const line of lines) {\n const match = line.match(new RegExp('\\\\d{4}-\\\\d{2}-\\\\d{2}'));\n if (match) results.push(match[0]);\n}",
"language": "javascript", "language": "javascript",
"description": "INCORRECT - Inefficient length check example for Performance Best Practices" "description": "INCORRECT - RegExp compiled on every iteration example for Performance Best Practices"
}, },
{ {
"ruleId": "", "ruleId": "",
"ruleTitle": "Performance Best Practices", "ruleTitle": "Performance Best Practices",
"type": "good", "type": "good",
"code": "if (!items.length) { /* empty */ }", "code": "const datePattern = /\\d{4}-\\d{2}-\\d{2}/;\nfor (const line of lines) {\n const match = line.match(datePattern);\n if (match) results.push(match[0]);\n}",
"language": "javascript", "language": "javascript",
"description": "CORRECT - Direct comparison when possible example for Performance Best Practices" "description": "CORRECT - Compile once, reuse in loop example for Performance Best Practices"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -1603,9 +1635,9 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Prototype Pollution", "ruleTitle": "Prevent Prototype Pollution",
"type": "good", "type": "good",
"code": "app.post('/test/:id', (req, res) => {\n let id = req.params.id;\n if (id !== 'constructor' && id !== '__proto__') {\n let items = req.session.todos[id];\n if (!items) {\n items = req.session.todos[id] = {};\n }\n items[req.query.name] = req.query.text;\n }\n res.end(200);\n});", "code": "const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);\n\napp.post('/test/:id', (req, res) => {\n const id = req.params.id;\n const name = req.query.name;\n\n if (DANGEROUS_KEYS.has(id) || DANGEROUS_KEYS.has(name)) {\n return res.status(400).end();\n }\n\n let items = req.session.todos[id];\n if (!items) {\n items = req.session.todos[id] = Object.create(null);\n }\n items[name] = req.query.text;\n res.end(200);\n});",
"language": "javascript", "language": "javascript",
"description": "JavaScript - validate against dangerous keys" "description": "JavaScript - validate keys and use null-prototype objects"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -1659,7 +1691,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Race Conditions", "ruleTitle": "Prevent Race Conditions",
"type": "bad", "type": "bad",
"code": "import tempfile as tf\n\n# ruleid: tempfile-insecure\nx = tempfile.mktemp()\n# ruleid: tempfile-insecure\nx = tempfile.mktemp(dir=\"/tmp\")", "code": "import tempfile\n\n# ruleid: tempfile-insecure\nx = tempfile.mktemp()\n# ruleid: tempfile-insecure\nx = tempfile.mktemp(dir=\"/tmp\")",
"language": "python", "language": "python",
"description": "vulnerable to race condition" "description": "vulnerable to race condition"
}, },
@@ -1667,7 +1699,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Race Conditions", "ruleTitle": "Prevent Race Conditions",
"type": "good", "type": "good",
"code": "import tempfile\n\n# Use NamedTemporaryFile which atomically creates and opens the file\nwith tempfile.NamedTemporaryFile(mode='w', delete=False) as f:\n f.write(\"data\")\n filename = f.name\n\n# Or use mkstemp which returns both file descriptor and name\nfd, path = tempfile.mkstemp()\ntry:\n with os.fdopen(fd, 'w') as f:\n f.write(\"data\")\nfinally:\n os.unlink(path)", "code": "import os\nimport tempfile\n\n# Use NamedTemporaryFile which atomically creates and opens the file\nwith tempfile.NamedTemporaryFile(mode='w', delete=False) as f:\n f.write(\"data\")\n filename = f.name\n\n# Or use mkstemp which returns both file descriptor and name\nfd, path = tempfile.mkstemp()\ntry:\n with os.fdopen(fd, 'w') as f:\n f.write(\"data\")\nfinally:\n os.unlink(path)",
"language": "python", "language": "python",
"description": "use secure alternatives" "description": "use secure alternatives"
}, },
@@ -1699,9 +1731,9 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent Race Conditions", "ruleTitle": "Prevent Race Conditions",
"type": "good", "type": "good",
"code": "import \"os\"\n\nfunc secureTemp() error {\n // Atomically creates a file with a random suffix\n f, err := os.CreateTemp(\"\", \"prefix-*.txt\")\n if err != nil {\n return err\n }\n defer f.Close()\n\n _, err = f.WriteString(\"secure data\")\n return err\n}", "code": "import \"os\"\n\nfunc main_good() {\n\t// ok:bad-tmp-file-creation\n\tf, err := os.CreateTemp(\"\", \"my_temp-*.txt\")\n\tif err != nil {\n\t\tfmt.Println(\"Error while creating temp file!\")\n\t\treturn\n\t}\n\tdefer f.Close()\n\n\t_, err = f.WriteString(\"secure data\")\n\tif err != nil {\n\t\tfmt.Println(\"Error while writing!\")\n\t}\n}",
"language": "go", "language": "go",
"description": "use TempFile for atomic creation" "description": "use os.CreateTemp for atomic creation"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -2131,17 +2163,17 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations", "ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad", "type": "bad",
"code": "resource \"aws_s3_bucket_object\" \"fail\" {\n bucket = aws_s3_bucket.bucket.bucket\n key = \"my-object\"\n content = \"data\"\n}", "code": "resource \"aws_s3_bucket\" \"bucket\" {\n bucket = \"my-bucket\"\n}",
"language": "hcl", "language": "hcl",
"description": "Incorrect example for Secure AWS Terraform Configurations" "description": "bucket without server-side encryption"
}, },
{ {
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations", "ruleTitle": "Secure AWS Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"aws_s3_bucket_object\" \"pass\" {\n bucket = aws_s3_bucket.bucket.bucket\n key = \"my-object\"\n content = \"data\"\n kms_key_id = aws_kms_key.example.arn\n}", "code": "resource \"aws_s3_bucket\" \"bucket\" {\n bucket = \"my-bucket\"\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"pass\" {\n bucket = aws_s3_bucket.bucket.id\n\n rule {\n apply_server_side_encryption_by_default {\n sse_algorithm = \"aws:kms\"\n kms_master_key_id = aws_kms_key.example.arn\n }\n bucket_key_enabled = true\n }\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure AWS Terraform Configurations" "description": "bucket-level KMS encryption via aws_s3_bucket_server_side_encryption_configuration"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -2323,7 +2355,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations", "ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad", "type": "bad",
"code": "resource \"azurerm_storage_account\" \"bad\" {\n name = \"storageaccountname\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n min_tls_version = \"TLS1_0\"\n enable_https_traffic_only = false\n}\n\nresource \"azurerm_storage_container\" \"bad\" {\n name = \"vhds\"\n storage_account_name = azurerm_storage_account.example.name\n container_access_type = \"blob\"\n}", "code": "resource \"azurerm_storage_account\" \"bad\" {\n name = \"storageaccountname\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n min_tls_version = \"TLS1_0\"\n allow_nested_items_to_be_public = true\n}\n\nresource \"azurerm_storage_container\" \"bad\" {\n name = \"vhds\"\n storage_account_name = azurerm_storage_account.example.name\n container_access_type = \"blob\"\n}",
"language": "hcl", "language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations" "description": "Incorrect example for Secure Azure Terraform Configurations"
}, },
@@ -2331,7 +2363,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations", "ruleTitle": "Secure Azure Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"azurerm_storage_account\" \"good\" {\n name = \"storageaccountname\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n min_tls_version = \"TLS1_2\"\n enable_https_traffic_only = true\n network_rules {\n default_action = \"Deny\"\n ip_rules = [\"100.0.0.1\"]\n virtual_network_subnet_ids = [azurerm_subnet.example.id]\n bypass = [\"Metrics\", \"AzureServices\"]\n }\n}\n\nresource \"azurerm_storage_container\" \"good\" {\n name = \"vhds\"\n storage_account_name = azurerm_storage_account.example.name\n container_access_type = \"private\"\n}", "code": "resource \"azurerm_storage_account\" \"good\" {\n name = \"storageaccountname\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n min_tls_version = \"TLS1_2\"\n allow_nested_items_to_be_public = false\n network_rules {\n default_action = \"Deny\"\n ip_rules = [\"100.0.0.1\"]\n virtual_network_subnet_ids = [azurerm_subnet.example.id]\n bypass = [\"Metrics\", \"AzureServices\"]\n }\n}\n\nresource \"azurerm_storage_container\" \"good\" {\n name = \"vhds\"\n storage_account_name = azurerm_storage_account.example.name\n container_access_type = \"private\"\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations" "description": "Correct example for Secure Azure Terraform Configurations"
}, },
@@ -2339,7 +2371,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations", "ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad", "type": "bad",
"code": "resource \"azurerm_app_service\" \"bad\" {\n name = \"example-app-service\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n app_service_plan_id = azurerm_app_service_plan.example.id\n https_only = false\n remote_debugging_enabled = true\n site_config {\n min_tls_version = \"1.0\"\n cors { allowed_origins = [\"*\"] }\n }\n auth_settings { enabled = false }\n}", "code": "resource \"azurerm_linux_web_app\" \"bad\" {\n name = \"example-app-service\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n service_plan_id = azurerm_service_plan.example.id\n https_only = false\n site_config {\n remote_debugging_enabled = true\n minimum_tls_version = \"1.0\"\n cors { allowed_origins = [\"*\"] }\n }\n auth_settings { enabled = false }\n}",
"language": "hcl", "language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations" "description": "Incorrect example for Secure Azure Terraform Configurations"
}, },
@@ -2347,7 +2379,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations", "ruleTitle": "Secure Azure Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"azurerm_app_service\" \"good\" {\n name = \"example-app-service\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n app_service_plan_id = azurerm_app_service_plan.example.id\n https_only = true\n remote_debugging_enabled = false\n site_config {\n min_tls_version = \"1.2\"\n cors { allowed_origins = [\"https://example.com\"] }\n }\n auth_settings { enabled = true }\n}", "code": "resource \"azurerm_linux_web_app\" \"good\" {\n name = \"example-app-service\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n service_plan_id = azurerm_service_plan.example.id\n https_only = true\n site_config {\n remote_debugging_enabled = false\n minimum_tls_version = \"1.2\"\n cors { allowed_origins = [\"https://example.com\"] }\n }\n auth_settings { enabled = true }\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations" "description": "Correct example for Secure Azure Terraform Configurations"
}, },
@@ -2363,7 +2395,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations", "ruleTitle": "Secure Azure Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"azurerm_key_vault\" \"good\" {\n name = \"examplekeyvault\"\n location = azurerm_resource_group.example.location\n soft_delete_retention_days = 7\n purge_protection_enabled = true\n network_acls { bypass = \"AzureServices\"; default_action = \"Deny\" }\n}\n\nresource \"azurerm_key_vault_key\" \"good\" {\n name = \"mykey\"\n key_vault_id = azurerm_key_vault.example.id\n key_type = \"RSA\"\n key_size = 2048\n expiration_date = \"2025-12-31T00:00:00Z\"\n key_opts = [\"decrypt\", \"encrypt\", \"sign\", \"unwrapKey\", \"verify\", \"wrapKey\"]\n}", "code": "resource \"azurerm_key_vault\" \"good\" {\n name = \"examplekeyvault\"\n location = azurerm_resource_group.example.location\n soft_delete_retention_days = 7\n purge_protection_enabled = true\n network_acls { bypass = \"AzureServices\"; default_action = \"Deny\" }\n}\n\nresource \"azurerm_key_vault_key\" \"good\" {\n name = \"mykey\"\n key_vault_id = azurerm_key_vault.example.id\n key_type = \"RSA\"\n key_size = 2048\n expiration_date = \"2027-12-31T00:00:00Z\"\n key_opts = [\"decrypt\", \"encrypt\", \"sign\", \"unwrapKey\", \"verify\", \"wrapKey\"]\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations" "description": "Correct example for Secure Azure Terraform Configurations"
}, },
@@ -2395,7 +2427,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations", "ruleTitle": "Secure Azure Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"azurerm_kubernetes_cluster\" \"good\" {\n name = \"example-aks1\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n dns_prefix = \"exampleaks1\"\n private_cluster_enabled = true\n disk_encryption_set_id = azurerm_disk_encryption_set.example.id\n api_server_authorized_ip_ranges = [\"192.168.0.0/16\"]\n default_node_pool { name = \"default\"; node_count = 1; vm_size = \"Standard_D2_v2\" }\n identity { type = \"SystemAssigned\" }\n}", "code": "resource \"azurerm_kubernetes_cluster\" \"good\" {\n name = \"example-aks1\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n dns_prefix = \"exampleaks1\"\n private_cluster_enabled = true\n disk_encryption_set_id = azurerm_disk_encryption_set.example.id\n default_node_pool { name = \"default\"; node_count = 1; vm_size = \"Standard_D2_v2\" }\n identity { type = \"SystemAssigned\" }\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations" "description": "Correct example for Secure Azure Terraform Configurations"
}, },
@@ -2427,7 +2459,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations", "ruleTitle": "Secure Azure Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"azurerm_cosmosdb_account\" \"good\" {\n name = \"tfex-cosmos-db\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n offer_type = \"Standard\"\n kind = \"GlobalDocumentDB\"\n public_network_access_enabled = false\n key_vault_key_id = azurerm_key_vault_key.example.versionless_id\n}\n\nresource \"azurerm_container_group\" \"good\" {\n name = \"example-continst\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n ip_address_type = \"private\"\n os_type = \"Linux\"\n network_profile_id = azurerm_network_profile.example.id\n container { name = \"hello-world\"; image = \"microsoft/aci-helloworld:latest\"; cpu = \"0.5\"; memory = \"1.5\" }\n}", "code": "resource \"azurerm_cosmosdb_account\" \"good\" {\n name = \"tfex-cosmos-db\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n offer_type = \"Standard\"\n kind = \"GlobalDocumentDB\"\n public_network_access_enabled = false\n key_vault_key_id = azurerm_key_vault_key.example.versionless_id\n}\n\nresource \"azurerm_container_group\" \"good\" {\n name = \"example-continst\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n ip_address_type = \"private\"\n os_type = \"Linux\"\n subnet_ids = [azurerm_subnet.example.id]\n container { name = \"hello-world\"; image = \"microsoft/aci-helloworld:latest\"; cpu = \"0.5\"; memory = \"1.5\" }\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations" "description": "Correct example for Secure Azure Terraform Configurations"
}, },
@@ -2451,7 +2483,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations", "ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad", "type": "bad",
"code": "resource \"google_storage_bucket\" \"insecure\" {\n name = \"example\"\n location = \"EU\"\n uniform_bucket_level_access = false\n}\nresource \"google_storage_bucket_iam_member\" \"public\" {\n bucket = google_storage_bucket.default.name\n role = \"roles/storage.admin\"\n member = \"allUsers\"\n}", "code": "resource \"google_storage_bucket\" \"insecure\" {\n name = \"example\"\n location = \"EU\"\n uniform_bucket_level_access = false\n}\nresource \"google_storage_bucket_iam_member\" \"public\" {\n bucket = google_storage_bucket.insecure.name\n role = \"roles/storage.admin\"\n member = \"allUsers\"\n}",
"language": "hcl", "language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations" "description": "Incorrect example for Secure GCP Terraform Configurations"
}, },
@@ -2459,7 +2491,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations", "ruleTitle": "Secure GCP Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"google_storage_bucket\" \"secure\" {\n name = \"example\"\n location = \"EU\"\n uniform_bucket_level_access = true\n versioning { enabled = true }\n logging { log_bucket = \"my-logging-bucket\" }\n}\nresource \"google_storage_bucket_iam_member\" \"restricted\" {\n bucket = google_storage_bucket.default.name\n role = \"roles/storage.admin\"\n member = \"user:jane@example.com\"\n}", "code": "resource \"google_storage_bucket\" \"secure\" {\n name = \"example\"\n location = \"EU\"\n uniform_bucket_level_access = true\n versioning { enabled = true }\n logging { log_bucket = \"my-logging-bucket\" }\n}\nresource \"google_storage_bucket_iam_member\" \"restricted\" {\n bucket = google_storage_bucket.secure.name\n role = \"roles/storage.admin\"\n member = \"user:jane@example.com\"\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations" "description": "Correct example for Secure GCP Terraform Configurations"
}, },
@@ -2467,7 +2499,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations", "ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad", "type": "bad",
"code": "resource \"google_compute_instance\" \"insecure\" {\n name = \"test\"; machine_type = \"n1-standard-1\"; zone = \"us-central1-a\"\n can_ip_forward = true; boot_disk {}\n metadata = { serial-port-enable = true, enable-oslogin = false }\n network_interface { network = \"default\"; access_config {} }\n}\nresource \"google_compute_firewall\" \"open\" {\n name = \"allow-all\"; network = \"google_compute_network.vpc.name\"\n allow { protocol = \"tcp\"; ports = [22, 3389] }\n source_ranges = [\"0.0.0.0/0\"]\n}", "code": "resource \"google_compute_instance\" \"insecure\" {\n name = \"test\"; machine_type = \"n1-standard-1\"; zone = \"us-central1-a\"\n can_ip_forward = true; boot_disk {}\n metadata = { serial-port-enable = true, enable-oslogin = false }\n network_interface { network = \"default\"; access_config {} }\n}\nresource \"google_compute_firewall\" \"open\" {\n name = \"allow-all\"; network = google_compute_network.vpc.name\n allow { protocol = \"tcp\"; ports = [22, 3389] }\n source_ranges = [\"0.0.0.0/0\"]\n}",
"language": "hcl", "language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations" "description": "Incorrect example for Secure GCP Terraform Configurations"
}, },
@@ -2475,7 +2507,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations", "ruleTitle": "Secure GCP Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"google_compute_instance\" \"secure\" {\n name = \"test\"; machine_type = \"n1-standard-1\"; zone = \"us-central1-a\"\n can_ip_forward = false\n boot_disk { kms_key_self_link = google_kms_crypto_key.key.id }\n metadata = { enable-oslogin = true }\n network_interface { network = \"default\" }\n shielded_instance_config { enable_vtpm = true; enable_integrity_monitoring = true }\n}\nresource \"google_compute_firewall\" \"restricted\" {\n name = \"allow-ssh\"; network = \"google_compute_network.vpc.name\"\n allow { protocol = \"tcp\"; ports = [\"22\"] }\n source_ranges = [\"172.1.2.3/32\"]; target_tags = [\"ssh\"]\n}", "code": "resource \"google_compute_instance\" \"secure\" {\n name = \"test\"; machine_type = \"n1-standard-1\"; zone = \"us-central1-a\"\n can_ip_forward = false\n boot_disk { kms_key_self_link = google_kms_crypto_key.key.id }\n metadata = { enable-oslogin = true }\n network_interface { network = \"default\" }\n shielded_instance_config { enable_vtpm = true; enable_integrity_monitoring = true }\n}\nresource \"google_compute_firewall\" \"restricted\" {\n name = \"allow-ssh\"; network = google_compute_network.vpc.name\n allow { protocol = \"tcp\"; ports = [\"22\"] }\n source_ranges = [\"172.1.2.3/32\"]; target_tags = [\"ssh\"]\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations" "description": "Correct example for Secure GCP Terraform Configurations"
}, },
@@ -2515,7 +2547,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations", "ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad", "type": "bad",
"code": "resource \"google_project_iam_member\" \"dangerous\" {\n project = \"your-project-id\"; role = \"roles/iam.serviceAccountTokenCreator\"\n member = \"serviceAccount:test-compute@developer.gserviceaccount.com\"\n}\nresource \"google_compute_subnetwork\" \"no_logs\" {\n name = \"example\"; ip_cidr_range = \"10.0.0.0/16\"; network = \"google_compute_network.vpc.id\"\n}\nresource \"google_project\" \"default_network\" {\n name = \"My Project\"; project_id = \"your-project-id\"; org_id = \"1234567\"\n}", "code": "resource \"google_project_iam_member\" \"dangerous\" {\n project = \"your-project-id\"; role = \"roles/iam.serviceAccountTokenCreator\"\n member = \"serviceAccount:test-compute@developer.gserviceaccount.com\"\n}\nresource \"google_compute_subnetwork\" \"no_logs\" {\n name = \"example\"; ip_cidr_range = \"10.0.0.0/16\"; network = google_compute_network.vpc.id\n}\nresource \"google_project\" \"default_network\" {\n name = \"My Project\"; project_id = \"your-project-id\"; org_id = \"1234567\"\n}",
"language": "hcl", "language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations" "description": "Incorrect example for Secure GCP Terraform Configurations"
}, },
@@ -2523,7 +2555,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations", "ruleTitle": "Secure GCP Terraform Configurations",
"type": "good", "type": "good",
"code": "resource \"google_project_iam_member\" \"safe\" {\n project = \"your-project-id\"; role = \"roles/viewer\"; member = \"user:jane@example.com\"\n}\nresource \"google_compute_subnetwork\" \"with_logs\" {\n name = \"example\"; ip_cidr_range = \"10.0.0.0/16\"; network = \"google_compute_network.vpc.self_link\"\n log_config { aggregation_interval = \"INTERVAL_10_MIN\"; flow_sampling = 0.5 }\n}\nresource \"google_project\" \"no_default_network\" {\n name = \"My Project\"; project_id = \"your-project-id\"; org_id = \"1234567\"; auto_create_network = false\n}", "code": "resource \"google_project_iam_member\" \"safe\" {\n project = \"your-project-id\"; role = \"roles/viewer\"; member = \"user:jane@example.com\"\n}\nresource \"google_compute_subnetwork\" \"with_logs\" {\n name = \"example\"; ip_cidr_range = \"10.0.0.0/16\"; network = google_compute_network.vpc.self_link\n log_config { aggregation_interval = \"INTERVAL_10_MIN\"; flow_sampling = 0.5 }\n}\nresource \"google_project\" \"no_default_network\" {\n name = \"My Project\"; project_id = \"your-project-id\"; org_id = \"1234567\"; auto_create_network = false\n}",
"language": "hcl", "language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations" "description": "Correct example for Secure GCP Terraform Configurations"
}, },
@@ -2707,17 +2739,25 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Avoid Unsafe Functions", "ruleTitle": "Avoid Unsafe Functions",
"type": "bad", "type": "bad",
"code": "// ruleid: unsafe-usage\nlet pid = unsafe { libc::getpid() as u32 };", "code": "// ruleid: unsafe-usage\n// This will not compile — libc::getpid() is an extern \"C\" function and requires unsafe\nlet pid = libc::getpid() as u32;",
"language": "rust", "language": "rust",
"description": "Rust - unsafe block bypasses safety" "description": "Rust - calling C FFI without unsafe block"
}, },
{ {
"ruleId": "", "ruleId": "",
"ruleTitle": "Avoid Unsafe Functions", "ruleTitle": "Avoid Unsafe Functions",
"type": "good", "type": "good",
"code": "// ok: unsafe-usage\nlet pid = libc::getpid() as u32;", "code": "// ok: unsafe-usage\n// std::process::id() is a safe wrapper that returns the OS-assigned PID\nlet pid: u32 = std::process::id();",
"language": "rust", "language": "rust",
"description": "Rust - use safe alternatives" "description": "Correct — Option A (Rust - use safe standard library alternative, preferred) example for Avoid Unsafe Functions"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "// ok: unsafe-usage\n// SAFETY: libc::getpid() is a read-only syscall with no preconditions\nlet pid = unsafe { libc::getpid() } as u32;",
"language": "rust",
"description": "Correct — Option B (Rust - minimally scoped unsafe block with SAFETY comment) example for Avoid Unsafe Functions"
}, },
{ {
"ruleId": "", "ruleId": "",
@@ -2859,7 +2899,7 @@
"ruleId": "", "ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection", "ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "good", "type": "good",
"code": "def parse_xml():\n from defusedxml.etree import ElementTree\n tree = ElementTree.parse('data.xml')\n root = tree.getroot()", "code": "def parse_xml():\n import defusedxml.ElementTree as ElementTree\n tree = ElementTree.parse('data.xml')\n root = tree.getroot()",
"language": "python", "language": "python",
"description": "safe usage" "description": "safe usage"
}, },
skills/code-security.zip
BIN
View File
Binary file not shown.
skills/code-security/AGENTS.md
+250 -140
View File
@@ -633,7 +633,7 @@ def parse_xml():
```python ```python
def parse_xml(): def parse_xml():
from defusedxml.etree import ElementTree import defusedxml.ElementTree as ElementTree
tree = ElementTree.parse('data.xml') tree = ElementTree.parse('data.xml')
root = tree.getroot() root = tree.getroot()
``` ```
@@ -811,15 +811,18 @@ function getFile(entry) {
} }
``` ```
**Correct: path sanitized** **Correct: resolve and enforce boundary**
```javascript ```javascript
const path = require('path'); const path = require('path');
function getFileSafe(req, res) { function getFileSafe(req, res) {
let somePath = req.body.path; const baseDir = path.resolve(opts.path);
somePath = somePath.replace(/^(\.\.(\/|\\|$))+/, ''); const resolved = path.resolve(baseDir, '.' + req.body.path);
return path.join(opts.path, somePath); if (!resolved.startsWith(baseDir + path.sep)) {
throw new Error('path traversal attempt');
}
return extractFile(resolved);
} }
``` ```
@@ -1138,13 +1141,16 @@ def unsafe(request):
eval(code) eval(code)
``` ```
**Correct: Python - static eval with hardcoded strings** **Correct: Python - avoid eval entirely, use safe alternatives**
```python ```python
eval("x = 1; x = x + 2") import ast
blah = "import requests; r = requests.get('https://example.com')" def safe_parse(user_expr):
eval(blah) # ast.literal_eval only allows literals (strings, numbers, tuples, lists, dicts, booleans, None)
return ast.literal_eval(user_expr)
# For math expressions, use a purpose-built parser instead of eval
``` ```
**Incorrect: JavaScript - eval with dynamic content** **Incorrect: JavaScript - eval with dynamic content**
@@ -1159,13 +1165,16 @@ function evalSomething(something) {
} }
``` ```
**Correct: JavaScript - static eval strings** **Correct: JavaScript - avoid eval, use safe alternatives**
```javascript ```javascript
eval('var x = "static strings are okay";'); // Instead of eval for JSON parsing:
const data = JSON.parse(jsonString);
const constVar = "function staticStrings() { return 'static strings are okay';}"; // Instead of eval for dynamic property access:
eval(constVar); const value = obj[propertyName];
// Instead of eval for math: use a sandboxed expression parser
``` ```
**Incorrect: Java - ScriptEngine injection** **Incorrect: Java - ScriptEngine injection**
@@ -1215,25 +1224,23 @@ a = %q{def hello() "Hello there!" end}
Thing.module_eval(a) Thing.module_eval(a)
``` ```
**Incorrect: PHP - dangerous exec functions with user input** **Incorrect: PHP - code injection via eval/assert**
```php ```php
exec($user_input); $code = $_GET['code'];
passthru($user_input); eval($code);
$output = shell_exec($user_input);
$output = system($user_input, $retval);
$username = $_COOKIE['username']; $input = $_POST['input'];
exec("wto -n \"$username\" -g", $ret); assert($input); // assert() evaluates strings as code in PHP < 8.0
``` ```
**Correct: PHP - static commands with escapeshellarg** **Correct: PHP - avoid eval, use structured alternatives**
```php ```php
exec('whoami'); // Instead of eval for dynamic config, use a data format:
$config = json_decode(file_get_contents('config.json'), true);
$fullpath = $_POST['fullpath']; // Instead of eval for templates, use a template engine (Twig, Blade)
$filesize = trim(shell_exec('stat -c %s ' . escapeshellarg($fullpath)));
``` ```
--- ---
@@ -1495,8 +1502,7 @@ void bad_code(char *user_input) {
```c ```c
void safe_code(char *user_input) { void safe_code(char *user_input) {
char buffer[64]; char buffer[64];
strncpy(buffer, user_input, sizeof(buffer) - 1); snprintf(buffer, sizeof(buffer), "%s", user_input); // Bounds-checked, always null-terminates
buffer[sizeof(buffer) - 1] = '\0'; // Ensure null termination
} }
``` ```
@@ -1579,13 +1585,17 @@ function hashPassword(pwtext) {
} }
``` ```
**Correct: SHA256 hashing** **Correct: bcrypt for password hashing**
```javascript ```javascript
const crypto = require("crypto"); const bcrypt = require("bcrypt");
function hashPassword(pwtext) { async function hashPassword(pwtext) {
return crypto.createHash("sha256").update(pwtext).digest("hex"); return bcrypt.hash(pwtext, 12);
}
async function verifyPassword(pwtext, hash) {
return bcrypt.compare(pwtext, hash);
} }
``` ```
@@ -1601,21 +1611,21 @@ byte[] hash = md5.digest();
MessageDigest sha1 = MessageDigest.getInstance("SHA-1"); MessageDigest sha1 = MessageDigest.getInstance("SHA-1");
``` ```
**Correct: SHA-512 hashing** **Correct: BCrypt for password hashing**
```java ```java
import java.security.MessageDigest; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
MessageDigest sha512 = MessageDigest.getInstance("SHA-512"); BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
sha512.update(password.getBytes()); String hash = encoder.encode(password);
byte[] hash = sha512.digest(); boolean matches = encoder.matches(password, hash);
``` ```
**Incorrect: DES cipher** **Incorrect: DES cipher**
```java ```java
Cipher c = Cipher.getInstance("DES/ECB/PKCS5Padding"); Cipher c = Cipher.getInstance("DES/ECB/PKCS5Padding");
c.init(Cipher.ENCRYPT_MODE, k, iv); c.init(Cipher.ENCRYPT_MODE, k);
``` ```
**Correct: AES with GCM** **Correct: AES with GCM**
@@ -1866,23 +1876,41 @@ new X509TrustManager() {
} }
``` ```
**Correct: proper certificate validation** **Correct — Option A: Use the JVM default trust manager (preferred):**
```java ```java
new X509TrustManager() { // HttpClient uses the JVM default SSLContext, which validates certificates properly
public X509Certificate[] getAcceptedIssuers() { return null; } HttpClient client = HttpClient.newBuilder().build();
public void checkClientTrusted(X509Certificate[] certs, String authType) { }
public void checkServerTrusted(X509Certificate[] certs, String authType) { HttpRequest request = HttpRequest.newBuilder()
try { .uri(URI.create("https://example.com/"))
checkValidity(); .build();
} catch (Exception e) {
throw new CertificateException("Certificate not valid or trusted."); HttpResponse<String> response = client.send(request, BodyHandlers.ofString());
}
}
}
``` ```
Reference: [https://nodejs.org/api/https.html](https://nodejs.org/api/https.html), [https://golang.org/pkg/crypto/tls/](https://golang.org/pkg/crypto/tls/), [https://docs.python.org/3/library/ssl.html](https://docs.python.org/3/library/ssl.html), [https://docs.oracle.com/en/java/javase/11/docs/api/java.net.http/java/net/http/HttpClient.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.net.http/java/net/http/HttpClient.html) **Correct — Option B: Explicit SSLContext with default TrustManagerFactory (when custom configuration is needed):**
```java
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init((KeyStore) null); // uses the JVM default trust store
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, tmf.getTrustManagers(), new SecureRandom());
// Enable hostname verification
SSLParameters sslParams = new SSLParameters();
sslParams.setEndpointIdentificationAlgorithm("HTTPS");
HttpClient client = HttpClient.newBuilder()
.sslContext(sslContext)
.sslParameters(sslParams)
.build();
```
**References:**
Reference: [https://nodejs.org/api/https.html](https://nodejs.org/api/https.html), [https://golang.org/pkg/crypto/tls/](https://golang.org/pkg/crypto/tls/), [https://docs.python.org/3/library/ssl.html](https://docs.python.org/3/library/ssl.html)
--- ---
@@ -2108,14 +2136,13 @@ function getUserData(token) {
} }
``` ```
**Correct: JavaScript jsonwebtoken - verify before decode** **Correct: JavaScript jsonwebtoken - use verify which returns decoded payload**
```javascript ```javascript
const jwt = require('jsonwebtoken'); const jwt = require('jsonwebtoken');
function getUserData(token, secretKey) { function getUserData(token, secretKey) {
jwt.verify(token, secretKey); const decoded = jwt.verify(token, secretKey);
const decoded = jwt.decode(token, true);
if (decoded.isAdmin) { if (decoded.isAdmin) {
return getAdminData(); return getAdminData();
} }
@@ -2214,29 +2241,56 @@ def my_view(request):
**References:** **References:**
**Incorrect: Express app without csurf middleware** **Incorrect: Express app without CSRF protection**
```javascript ```javascript
var express = require('express') const express = require('express')
var bodyParser = require('body-parser') const bodyParser = require('body-parser')
var app = express() const app = express()
app.post('/process', bodyParser.urlencoded({ extended: false }), function(req, res) { app.post('/process', bodyParser.urlencoded({ extended: false }), function(req, res) {
res.send('data is being processed') res.send('data is being processed')
}) })
``` ```
**Correct: include csurf middleware** **Correct — Option A: csrf-csrf (Double-Submit Cookie pattern):**
```javascript ```javascript
var csrf = require('csurf') const express = require('express')
var express = require('express') const cookieParser = require('cookie-parser')
const { doubleCsrf } = require('csrf-csrf')
var app = express() const { doubleCsrfProtection, generateToken } = doubleCsrf({
app.use(csrf({ cookie: true })) getSecret: () => process.env.CSRF_SECRET,
cookieName: '__Host-psifi.x-csrf-token',
cookieOptions: { sameSite: 'strict', secure: true },
})
const app = express()
app.use(cookieParser())
app.use(doubleCsrfProtection)
// Generate a token for forms/SPA clients
app.get('/csrf-token', (req, res) => {
res.json({ token: generateToken(req, res) })
})
``` ```
**Correct — Option B: csrf-sync (Synchronizer Token pattern):**
```javascript
const express = require('express')
const { csrfSync } = require('csrf-sync')
const { csrfSynchronisedProtection, generateToken } = csrfSync()
const app = express()
app.use(csrfSynchronisedProtection)
```
**Additional defenses: complement token-based CSRF protection**
**References:** **References:**
**Incorrect: explicitly disabling CSRF protection** **Incorrect: explicitly disabling CSRF protection**
@@ -2326,18 +2380,24 @@ app.get('/test/:id', (req, res) => {
}); });
``` ```
**Correct: JavaScript - validate against dangerous keys** **Correct: JavaScript - validate keys and use null-prototype objects**
```javascript ```javascript
const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
app.post('/test/:id', (req, res) => { app.post('/test/:id', (req, res) => {
let id = req.params.id; const id = req.params.id;
if (id !== 'constructor' && id !== '__proto__') { const name = req.query.name;
let items = req.session.todos[id];
if (!items) { if (DANGEROUS_KEYS.has(id) || DANGEROUS_KEYS.has(name)) {
items = req.session.todos[id] = {}; return res.status(400).end();
}
items[req.query.name] = req.query.text;
} }
let items = req.session.todos[id];
if (!items) {
items = req.session.todos[id] = Object.create(null);
}
items[name] = req.query.text;
res.end(200); res.end(200);
}); });
``` ```
@@ -2610,18 +2670,28 @@ func main() {
// Avoid using the unsafe package. Use Go's type-safe alternatives for memory operations. // Avoid using the unsafe package. Use Go's type-safe alternatives for memory operations.
``` ```
**Incorrect: Rust - unsafe block bypasses safety** **Incorrect: Rust - calling C FFI without unsafe block**
```rust ```rust
// ruleid: unsafe-usage // ruleid: unsafe-usage
let pid = unsafe { libc::getpid() as u32 }; // This will not compile — libc::getpid() is an extern "C" function and requires unsafe
let pid = libc::getpid() as u32;
``` ```
**Correct: Rust - use safe alternatives** **Correct — Option A (Rust - use safe standard library alternative, preferred):**
```rust ```rust
// ok: unsafe-usage // ok: unsafe-usage
let pid = libc::getpid() as u32; // std::process::id() is a safe wrapper that returns the OS-assigned PID
let pid: u32 = std::process::id();
```
**Correct — Option B (Rust - minimally scoped unsafe block with SAFETY comment):**
```rust
// ok: unsafe-usage
// SAFETY: libc::getpid() is a read-only syscall with no preconditions
let pid = unsafe { libc::getpid() } as u32;
``` ```
**Incorrect: OCaml - unsafe functions skip bounds checks** **Incorrect: OCaml - unsafe functions skip bounds checks**
@@ -2654,24 +2724,31 @@ AWS infrastructure misconfigurations including public S3 buckets, unencrypted re
Security best practices for AWS Terraform configurations to prevent common misconfigurations. Security best practices for AWS Terraform configurations to prevent common misconfigurations.
**Incorrect:** **Incorrect: bucket without server-side encryption**
```hcl ```hcl
resource "aws_s3_bucket_object" "fail" { resource "aws_s3_bucket" "bucket" {
bucket = aws_s3_bucket.bucket.bucket bucket = "my-bucket"
key = "my-object"
content = "data"
} }
``` ```
**Correct:** **Correct: bucket-level KMS encryption via aws_s3_bucket_server_side_encryption_configuration**
```hcl ```hcl
resource "aws_s3_bucket_object" "pass" { resource "aws_s3_bucket" "bucket" {
bucket = aws_s3_bucket.bucket.bucket bucket = "my-bucket"
key = "my-object" }
content = "data"
kms_key_id = aws_kms_key.example.arn resource "aws_s3_bucket_server_side_encryption_configuration" "pass" {
bucket = aws_s3_bucket.bucket.id
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "aws:kms"
kms_master_key_id = aws_kms_key.example.arn
}
bucket_key_enabled = true
}
} }
``` ```
@@ -2878,7 +2955,7 @@ resource "azurerm_storage_account" "bad" {
resource_group_name = azurerm_resource_group.example.name resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location location = azurerm_resource_group.example.location
min_tls_version = "TLS1_0" min_tls_version = "TLS1_0"
enable_https_traffic_only = false allow_nested_items_to_be_public = true
} }
resource "azurerm_storage_container" "bad" { resource "azurerm_storage_container" "bad" {
@@ -2896,7 +2973,7 @@ resource "azurerm_storage_account" "good" {
resource_group_name = azurerm_resource_group.example.name resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location location = azurerm_resource_group.example.location
min_tls_version = "TLS1_2" min_tls_version = "TLS1_2"
enable_https_traffic_only = true allow_nested_items_to_be_public = false
network_rules { network_rules {
default_action = "Deny" default_action = "Deny"
ip_rules = ["100.0.0.1"] ip_rules = ["100.0.0.1"]
@@ -2915,15 +2992,15 @@ resource "azurerm_storage_container" "good" {
**Incorrect:** **Incorrect:**
```hcl ```hcl
resource "azurerm_app_service" "bad" { resource "azurerm_linux_web_app" "bad" {
name = "example-app-service" name = "example-app-service"
location = azurerm_resource_group.example.location location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name resource_group_name = azurerm_resource_group.example.name
app_service_plan_id = azurerm_app_service_plan.example.id service_plan_id = azurerm_service_plan.example.id
https_only = false https_only = false
remote_debugging_enabled = true
site_config { site_config {
min_tls_version = "1.0" remote_debugging_enabled = true
minimum_tls_version = "1.0"
cors { allowed_origins = ["*"] } cors { allowed_origins = ["*"] }
} }
auth_settings { enabled = false } auth_settings { enabled = false }
@@ -2933,15 +3010,15 @@ resource "azurerm_app_service" "bad" {
**Correct:** **Correct:**
```hcl ```hcl
resource "azurerm_app_service" "good" { resource "azurerm_linux_web_app" "good" {
name = "example-app-service" name = "example-app-service"
location = azurerm_resource_group.example.location location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name resource_group_name = azurerm_resource_group.example.name
app_service_plan_id = azurerm_app_service_plan.example.id service_plan_id = azurerm_service_plan.example.id
https_only = true https_only = true
remote_debugging_enabled = false
site_config { site_config {
min_tls_version = "1.2" remote_debugging_enabled = false
minimum_tls_version = "1.2"
cors { allowed_origins = ["https://example.com"] } cors { allowed_origins = ["https://example.com"] }
} }
auth_settings { enabled = true } auth_settings { enabled = true }
@@ -2983,7 +3060,7 @@ resource "azurerm_key_vault_key" "good" {
key_vault_id = azurerm_key_vault.example.id key_vault_id = azurerm_key_vault.example.id
key_type = "RSA" key_type = "RSA"
key_size = 2048 key_size = 2048
expiration_date = "2025-12-31T00:00:00Z" expiration_date = "2027-12-31T00:00:00Z"
key_opts = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"] key_opts = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"]
} }
``` ```
@@ -3055,9 +3132,8 @@ resource "azurerm_kubernetes_cluster" "good" {
location = azurerm_resource_group.example.location location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name resource_group_name = azurerm_resource_group.example.name
dns_prefix = "exampleaks1" dns_prefix = "exampleaks1"
private_cluster_enabled = true private_cluster_enabled = true
disk_encryption_set_id = azurerm_disk_encryption_set.example.id disk_encryption_set_id = azurerm_disk_encryption_set.example.id
api_server_authorized_ip_ranges = ["192.168.0.0/16"]
default_node_pool { name = "default"; node_count = 1; vm_size = "Standard_D2_v2" } default_node_pool { name = "default"; node_count = 1; vm_size = "Standard_D2_v2" }
identity { type = "SystemAssigned" } identity { type = "SystemAssigned" }
} }
@@ -3136,7 +3212,7 @@ resource "azurerm_container_group" "good" {
resource_group_name = azurerm_resource_group.example.name resource_group_name = azurerm_resource_group.example.name
ip_address_type = "private" ip_address_type = "private"
os_type = "Linux" os_type = "Linux"
network_profile_id = azurerm_network_profile.example.id subnet_ids = [azurerm_subnet.example.id]
container { name = "hello-world"; image = "microsoft/aci-helloworld:latest"; cpu = "0.5"; memory = "1.5" } container { name = "hello-world"; image = "microsoft/aci-helloworld:latest"; cpu = "0.5"; memory = "1.5" }
} }
``` ```
@@ -3196,7 +3272,7 @@ resource "google_storage_bucket" "insecure" {
uniform_bucket_level_access = false uniform_bucket_level_access = false
} }
resource "google_storage_bucket_iam_member" "public" { resource "google_storage_bucket_iam_member" "public" {
bucket = google_storage_bucket.default.name bucket = google_storage_bucket.insecure.name
role = "roles/storage.admin" role = "roles/storage.admin"
member = "allUsers" member = "allUsers"
} }
@@ -3213,7 +3289,7 @@ resource "google_storage_bucket" "secure" {
logging { log_bucket = "my-logging-bucket" } logging { log_bucket = "my-logging-bucket" }
} }
resource "google_storage_bucket_iam_member" "restricted" { resource "google_storage_bucket_iam_member" "restricted" {
bucket = google_storage_bucket.default.name bucket = google_storage_bucket.secure.name
role = "roles/storage.admin" role = "roles/storage.admin"
member = "user:jane@example.com" member = "user:jane@example.com"
} }
@@ -3229,7 +3305,7 @@ resource "google_compute_instance" "insecure" {
network_interface { network = "default"; access_config {} } network_interface { network = "default"; access_config {} }
} }
resource "google_compute_firewall" "open" { resource "google_compute_firewall" "open" {
name = "allow-all"; network = "google_compute_network.vpc.name" name = "allow-all"; network = google_compute_network.vpc.name
allow { protocol = "tcp"; ports = [22, 3389] } allow { protocol = "tcp"; ports = [22, 3389] }
source_ranges = ["0.0.0.0/0"] source_ranges = ["0.0.0.0/0"]
} }
@@ -3247,7 +3323,7 @@ resource "google_compute_instance" "secure" {
shielded_instance_config { enable_vtpm = true; enable_integrity_monitoring = true } shielded_instance_config { enable_vtpm = true; enable_integrity_monitoring = true }
} }
resource "google_compute_firewall" "restricted" { resource "google_compute_firewall" "restricted" {
name = "allow-ssh"; network = "google_compute_network.vpc.name" name = "allow-ssh"; network = google_compute_network.vpc.name
allow { protocol = "tcp"; ports = ["22"] } allow { protocol = "tcp"; ports = ["22"] }
source_ranges = ["172.1.2.3/32"]; target_tags = ["ssh"] source_ranges = ["172.1.2.3/32"]; target_tags = ["ssh"]
} }
@@ -3312,7 +3388,7 @@ resource "google_project_iam_member" "dangerous" {
member = "serviceAccount:test-compute@developer.gserviceaccount.com" member = "serviceAccount:test-compute@developer.gserviceaccount.com"
} }
resource "google_compute_subnetwork" "no_logs" { resource "google_compute_subnetwork" "no_logs" {
name = "example"; ip_cidr_range = "10.0.0.0/16"; network = "google_compute_network.vpc.id" name = "example"; ip_cidr_range = "10.0.0.0/16"; network = google_compute_network.vpc.id
} }
resource "google_project" "default_network" { resource "google_project" "default_network" {
name = "My Project"; project_id = "your-project-id"; org_id = "1234567" name = "My Project"; project_id = "your-project-id"; org_id = "1234567"
@@ -3326,7 +3402,7 @@ resource "google_project_iam_member" "safe" {
project = "your-project-id"; role = "roles/viewer"; member = "user:jane@example.com" project = "your-project-id"; role = "roles/viewer"; member = "user:jane@example.com"
} }
resource "google_compute_subnetwork" "with_logs" { resource "google_compute_subnetwork" "with_logs" {
name = "example"; ip_cidr_range = "10.0.0.0/16"; network = "google_compute_network.vpc.self_link" name = "example"; ip_cidr_range = "10.0.0.0/16"; network = google_compute_network.vpc.self_link
log_config { aggregation_interval = "INTERVAL_10_MIN"; flow_sampling = 0.5 } log_config { aggregation_interval = "INTERVAL_10_MIN"; flow_sampling = 0.5 }
} }
resource "google_project" "no_default_network" { resource "google_project" "no_default_network" {
@@ -3616,7 +3692,7 @@ spec:
volumes: volumes:
- name: docker-sock-volume - name: docker-sock-volume
hostPath: hostPath:
type: File type: Socket
path: /var/run/docker.sock path: /var/run/docker.sock
``` ```
@@ -3683,7 +3759,7 @@ The last user in the container should not be 'root'. If an attacker gains contro
**Incorrect:** **Incorrect:**
```dockerfile ```dockerfile
FROM busybox FROM debian:bookworm
RUN apt-get update && apt-get install -y some-package RUN apt-get update && apt-get install -y some-package
USER appuser USER appuser
USER root USER root
@@ -3692,7 +3768,7 @@ USER root
**Correct:** **Correct:**
```dockerfile ```dockerfile
FROM busybox FROM debian:bookworm
USER root USER root
RUN apt-get update && apt-get install -y some-package RUN apt-get update && apt-get install -y some-package
USER appuser USER appuser
@@ -3761,7 +3837,7 @@ services:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
``` ```
**Correct:** **Correct: use a named volume instead of host mounts**
```yaml ```yaml
version: "3.9" version: "3.9"
@@ -3769,7 +3845,9 @@ services:
worker: worker:
image: my-worker-image:1.0 image: my-worker-image:1.0
volumes: volumes:
- /tmp/data:/tmp/data - worker-data:/app/data
volumes:
worker-data:
``` ```
If unverified user data can reach the run or create method, it can result in running arbitrary containers. If unverified user data can reach the run or create method, it can result in running arbitrary containers.
@@ -4090,7 +4168,7 @@ close_out oc
**Incorrect: vulnerable to race condition** **Incorrect: vulnerable to race condition**
```python ```python
import tempfile as tf import tempfile
# ruleid: tempfile-insecure # ruleid: tempfile-insecure
x = tempfile.mktemp() x = tempfile.mktemp()
@@ -4101,6 +4179,7 @@ x = tempfile.mktemp(dir="/tmp")
**Correct: use secure alternatives** **Correct: use secure alternatives**
```python ```python
import os
import tempfile import tempfile
# Use NamedTemporaryFile which atomically creates and opens the file # Use NamedTemporaryFile which atomically creates and opens the file
@@ -4182,26 +4261,27 @@ func main() {
} }
``` ```
**Correct: use TempFile for atomic creation** **Correct: use os.CreateTemp for atomic creation**
```go ```go
import "os" import "os"
func secureTemp() error { func main_good() {
// Atomically creates a file with a random suffix // ok:bad-tmp-file-creation
f, err := os.CreateTemp("", "prefix-*.txt") f, err := os.CreateTemp("", "my_temp-*.txt")
if err != nil { if err != nil {
return err fmt.Println("Error while creating temp file!")
} return
defer f.Close() }
defer f.Close()
_, err = f.WriteString("secure data") _, err = f.WriteString("secure data")
return err if err != nil {
fmt.Println("Error while writing!")
}
} }
``` ```
Best Practice: Use os.CreateTemp (Go 1.16+) or ioutil.TempFile which atomically creates a new file with a unique name.
**References:** **References:**
**References:** **References:**
@@ -4264,6 +4344,15 @@ finally:
break # Suppresses the exception! break # Suppresses the exception!
``` ```
**CORRECT - Let the exception propagate; use finally only for cleanup:**
```python
try:
raise ValueError()
finally:
cleanup() # Cleanup runs, exception still propagates
```
**INCORRECT:** **INCORRECT:**
```python ```python
@@ -4302,7 +4391,7 @@ return `value is {x}` // Missing $
return `value is ${x}` return `value is ${x}`
``` ```
Loop variables are shared across iterations. Loop variables are shared across iterations (Go < 1.22).
**INCORRECT:** **INCORRECT:**
@@ -4332,7 +4421,16 @@ bigValue, _ := strconv.Atoi("2147483648")
value := int16(bigValue) // Overflow! value := int16(bigValue) // Overflow!
``` ```
CORRECT: Use strconv.ParseInt with correct bit size. **CORRECT:**
```go
parsed, err := strconv.ParseInt("2147483648", 10, 32)
if err != nil {
// handles out-of-range and invalid syntax
log.Fatal(err)
}
value := int32(parsed)
```
**INCORRECT:** **INCORRECT:**
@@ -4369,7 +4467,12 @@ int i = atoi(buf);
**CORRECT:** **CORRECT:**
```c ```c
long l = strtol(buf, NULL, 10); char *endptr;
errno = 0;
long l = strtol(buf, &endptr, 10);
if (errno != 0 || endptr == buf || *endptr != '\0') {
// handle conversion error
}
``` ```
Unquoted variables split on whitespace. Unquoted variables split on whitespace.
@@ -4598,7 +4701,7 @@ total = len(persons.all())
total = persons.count() total = persons.count()
``` ```
Rather than adding one element at a time, use batch loading to improve performance. Each individual db.session.add() in a loop can trigger separate database operations. Rather than adding one element at a time, use batch loading to improve performance. Looping db.session.add() increases session bookkeeping overhead and can trigger per-iteration SQL if autoflush is enabled (e.g., when a query runs during the loop).
**INCORRECT - Adding one at a time in a loop:** **INCORRECT - Adding one at a time in a loop:**
@@ -4642,18 +4745,25 @@ function FunctionalComponent() {
} }
``` ```
Check array length efficiently without traversing the entire collection. Hoist expensive work (object allocations, RegExp compilation, function creation) out of loops.
**INCORRECT - Inefficient length check:** **INCORRECT - RegExp compiled on every iteration:**
```javascript ```javascript
if (items.length === 0) { /* empty */ } for (const line of lines) {
const match = line.match(new RegExp('\\d{4}-\\d{2}-\\d{2}'));
if (match) results.push(match[0]);
}
``` ```
**CORRECT - Direct comparison when possible:** **CORRECT - Compile once, reuse in loop:**
```javascript ```javascript
if (!items.length) { /* empty */ } const datePattern = /\d{4}-\d{2}-\d{2}/;
for (const line of lines) {
const match = line.match(datePattern);
if (match) results.push(match[0]);
}
``` ```
For operations that require iterating, prefer built-in methods that short-circuit: For operations that require iterating, prefer built-in methods that short-circuit:
skills/llm-security.zip
BIN
View File
Binary file not shown.
skills/llm-security/AGENTS.md
+1 -1
View File
@@ -2,7 +2,7 @@
**Version 1.0** **Version 1.0**
March 2026 April 2026
> **Note:** > **Note:**
> This document is mainly for agents and LLMs to follow when maintaining, > This document is mainly for agents and LLMs to follow when maintaining,
skills/semgrep.zip
BIN
View File
Binary file not shown.