# Code Review Dangerous Sinks

> Grep-ready dangerous function/sink catalog per language for fast code review. Load when reviewing source in PHP, Python, JavaScript/Node, Java, Ruby, Go, .NET/C# and you need the exact functions that cause RCE/SQLi/SSRF/traversal/deserialization. Signals: "dangerous functions", "sinks", grepping a codebase.

- Skill: `noorqureshi/code-review-dangerous-sinks` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/code-review-dangerous-sinks`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/code-review-dangerous-sinks/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/code-review-dangerous-sinks

---


# Dangerous sinks by language (grep catalog)

## When it applies
You're reading source and want the fastest path to bugs: grep every dangerous sink, then trace
each hit's argument back to user input.

## Why it works
A small set of functions cause most severe bugs (command/code exec, SQL, deserialization, file
access, SSRF). Enumerating them turns review into "find the sink → prove the source".

## Sinks to grep (trace the argument to a user source)
- **Command exec (RCE, CWE-78)**: PHP `system exec shell_exec passthru proc_open` · Python
  `os.system subprocess.*(shell=True) os.popen` · Node `child_process.exec execSync` · Java
  `Runtime.exec ProcessBuilder` · Ruby `` system exec `backticks` %x() `` · Go `exec.Command`.
- **Code eval (CWE-94)**: `eval` (all), Python `exec pickle.loads`, Node `Function() vm`,
  PHP `eval assert create_function preg_replace/e`, Ruby `eval send`.
- **SQL (CWE-89)**: string-built queries / concatenation into `query execute` (all ORMs have a
  raw path — grep `raw`, `.query(`, `String.format` near SQL).
- **Deserialization (CWE-502)**: Python `pickle yaml.load(!safe) marshal`, Java `readObject
  XMLDecoder`, PHP `unserialize`, Ruby `Marshal.load YAML.load`, .NET `BinaryFormatter`.
- **File/path (CWE-22)**: `open read include require fopen readFile sendFile` with user paths;
  archive extractors (zip-slip).
- **SSRF (CWE-918)**: URL fetchers — `requests.get urllib curl file_get_contents http.get
  HttpClient` taking a user URL.
- **Template (SSTI)**: `render_template_string`, Twig/Freemarker string templates.
- **Secrets**: `password= api_key= secret token=` literals; private keys.

## Method
`rg -n "os\.system|subprocess|shell_exec|eval\(|unserialize|pickle\.loads|readObject|render_template_string"`
then for each hit trace the argument. Pair with `semgrep --config auto` for dataflow.

## Gotchas
- Parameterized queries / allowlisted args = safe; confirm the source, don't report the grep hit.
- `yaml.safe_load` and framework-escaped ORMs are the safe variants — note which one is used.

## References
OWASP Code Review Guide; GTFOBins (for the exec side); Semgrep registry.