vulnerability-patterns

# Vulnerability Patterns — Code Vulnerability Pattern Database

A reference of vulnerable code patterns, CWE classification, and safe alternatives used by the security-analyst agent during security reviews.

## Target Agent

`security-analyst` — Directly applies the vulnerability patterns from this skill to code security analysis.

## Vulnerability Classification System (CWE Top 25)

### Priority Detection Targets

| CWE | Name | Severity | Frequency |
|-----|------|----------|-----------|
| CWE-79 | XSS (Cross-Site Scripting) | High | Very high |
| CWE-89 | SQL Injection | Critical | High |
| CWE-78 | OS Command Injection | Critical | Medium |
| CWE-22 | Path Traversal | High | Medium |
| CWE-352 | CSRF | High | High |
| CWE-798 | Hardcoded Credentials | Critical | High |
| CWE-862 | Missing Authorization | Critical | High |
| CWE-306 | Missing Authentication | Critical | Medium |
| CWE-502 | Deserialization | Critical | Medium |
| CWE-918 | SSRF | High | Medium |

## Language-Specific Vulnerable Code Patterns

### Python

#### SQL Injection (CWE-89)
```python
# Vulnerable
query = f"SELECT * FROM users WHERE name = '{user_input}'"
cursor.execute(query)

# Safe
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))
# Or use ORM (SQLAlchemy, Django ORM)
```

#### Command Injection (CWE-78)
```python
# Vulnerable
os.system(f"ping {user_input}")
subprocess.call(f"ls {user_input}", shell=True)

# Safe
subprocess.run(["ping", user_input], shell=False)
# shlex.quote() for escaping (if unavoidable)
```

#### Path Traversal (CWE-22)
```python
# Vulnerable
file_path = os.path.join(BASE_DIR, user_input)
open(file_path).read()

# Safe
file_path = os.path.realpath(os.path.join(BASE_DIR, user_input))
if not file_path.startswith(os.path.realpath(BASE_DIR)):
    raise ValueError("Invalid path")
```

#### YAML Deserialization (CWE-502)
```python
# Vulnerable
data = yaml.load(user_input)  # Arbitrary code execution possible

# Safe
data = yaml.safe_load(user_input)
```

### JavaScript/TypeScript

#### XSS (CWE-79)
```javascript
// Vulnerable (React)
<div dangerouslySetInnerHTML={{__html: userInput}} />

// Safe
<div>{userInput}</div>  // React auto-escapes
// When needed, use DOMPurify
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userInput)}} />
```

#### Prototype Pollution (CWE-1321)
```javascript
// Vulnerable
function merge(target, source) {
  for (let key in source) {
    target[key] = source[key];  // __proto__ pollution possible
  }
}

// Safe
function merge(target, source) {
  for (let key of Object.keys(source)) {
    if (key === '__proto__' || key === 'constructor') continue;
    target[key] = source[key];
  }
}
// Or use Object.create(null)
```

#### ReDoS (CWE-1333)
```javascript
// Vulnerable (Catastrophic Backtracking)
const regex = /^(a+)+$/;
regex.test("aaaaaaaaaaaaaaaaaaaaaaaaaaaaab");  // Exponential time

// Safe: Use non-backtracking patterns
const regex = /^a+$/;  // Remove nested repetition
```

#### eval/Function Execution (CWE-95)
```javascript
// Vulnerable
eval(userInput);
new Function(userInput)();
setTimeout(userInput, 1000);

// Safe: Never use eval; use alternative logic
```

### Java

#### SQL Injection (CWE-89)
```java
// Vulnerable
String query = "SELECT * FROM users WHERE id = " + userId;
Statement stmt = conn.createStatement();
stmt.executeQuery(query);

// Safe
PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
ps.setInt(1, userId);
ps.executeQuery();
```

#### XXE (CWE-611)
```java
// Vulnerable
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
db.parse(userInput);

// Safe
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
```

#### Deserialization (CWE-502)
```java
// Vulnerable
ObjectInputStream ois = new ObjectInputStream(userInputStream);
Object obj = ois.readObject();  // Arbitrary code execution possible

// Safe: Use JSON/XML serialization (Jackson, Gson)
// Use ObjectInputFilter (Java 9+)
```

### Go

#### SQL Injection (CWE-89)
```go
// Vulnerable
query := fmt.Sprintf("SELECT * FROM users WHERE name = '%s'", userInput)
db.Query(query)

// Safe
db.Query("SELECT * FROM users WHERE name = $1", userInput)
```

#### Path Traversal (CWE-22)
```go
// Vulnerable
http.ServeFile(w, r, filepath.Join(baseDir, r.URL.Path))

// Safe
cleanPath := filepath.Clean(r.URL.Path)
fullPath := filepath.Join(baseDir, cleanPath)
if !strings.HasPrefix(fullPath, baseDir) {
    http.Error(w, "Forbidden", 403)
    return
}
```

## Severity Assessment Criteria

### CVSS v3.1-Based Assessment

| Factor | Weight | Criteria |
|--------|--------|----------|
| Attack Vector | High | Network (remote) > Local |
| Attack Complexity | High | Low complexity > High complexity |
| Privileges Required | Medium | None > Low > High |
| User Interaction | Medium | None > Required |
| Impact (CIA) | High | Each confidentiality/integrity/availability |

### Practical Exploitability Assessment

| Factor | High Risk | Low Risk |
|--------|----------|---------|
| Input source | External user input | Internal config |
| Data sensitivity | PII, credentials | Public data |
| Authentication | Unauthenticated | Admin only |
| Exploit complexity | Simple string injection | Multi-step chain |
| Existing defenses | None | WAF, input validation present |