Vulnerability Patterns

Vulnerability Patterns — Code Vulnerability Pattern Database

A reference of vulnerable code patterns, CWE classification, and safe alternatives used by the security-analyst agent during security reviews.

Target Agent

security-analyst — Directly applies the vulnerability patterns from this skill to code security analysis.

Vulnerability Classification System (CWE Top 25)

Priority Detection Targets

Language-Specific Vulnerable Code Patterns

Python

SQL Injection (CWE-89)

# Vulnerable
query = f"SELECT * FROM users WHERE name = '{user_input}'"
cursor.execute(query)

# Safe
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))
# Or use ORM (SQLAlchemy, Django ORM)

Command Injection (CWE-78)

# Vulnerable
os.system(f"ping {user_input}")
subprocess.call(f"ls {user_input}", shell=True)

# Safe
subprocess.run(["ping", user_input], shell=False)
# shlex.quote() for escaping (if unavoidable)

Path Traversal (CWE-22)

# Vulnerable
file_path = os.path.join(BASE_DIR, user_input)
open(file_path).read()

# Safe
file_path = os.path.realpath(os.path.join(BASE_DIR, user_input))
if not file_path.startswith(os.path.realpath(BASE_DIR)):
    raise ValueError("Invalid path")

YAML Deserialization (CWE-502)

# Vulnerable
data = yaml.load(user_input)  # Arbitrary code execution possible

# Safe
data = yaml.safe_load(user_input)

JavaScript/TypeScript

XSS (CWE-79)

// Vulnerable (React)
<div dangerouslySetInnerHTML={{__html: userInput}} />

// Safe
<div>{userInput}</div>  // React auto-escapes
// When needed, use DOMPurify
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userInput)}} />

Prototype Pollution (CWE-1321)

// Vulnerable
function merge(target, source) {
  for (let key in source) {
    target[key] = source[key];  // __proto__ pollution possible
  }
}

// Safe
function merge(target, source) {
  for (let key of Object.keys(source)) {
    if (key === '__proto__' || key === 'constructor') continue;
    target[key] = source[key];
  }
}
// Or use Object.create(null)

ReDoS (CWE-1333)

// Vulnerable (Catastrophic Backtracking)
const regex = /^(a+)+$/;
regex.test("aaaaaaaaaaaaaaaaaaaaaaaaaaaaab");  // Exponential time

// Safe: Use non-backtracking patterns
const regex = /^a+$/;  // Remove nested repetition

eval/Function Execution (CWE-95)

// Vulnerable
eval(userInput);
new Function(userInput)();
setTimeout(userInput, 1000);

// Safe: Never use eval; use alternative logic

Java

SQL Injection (CWE-89)

// Vulnerable
String query = "SELECT * FROM users WHERE id = " + userId;
Statement stmt = conn.createStatement();
stmt.executeQuery(query);

// Safe
PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
ps.setInt(1, userId);
ps.executeQuery();

XXE (CWE-611)

// Vulnerable
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
db.parse(userInput);

// Safe
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);

Deserialization (CWE-502)

// Vulnerable
ObjectInputStream ois = new ObjectInputStream(userInputStream);
Object obj = ois.readObject();  // Arbitrary code execution possible

// Safe: Use JSON/XML serialization (Jackson, Gson)
// Use ObjectInputFilter (Java 9+)

Go

SQL Injection (CWE-89)

// Vulnerable
query := fmt.Sprintf("SELECT * FROM users WHERE name = '%s'", userInput)
db.Query(query)

// Safe
db.Query("SELECT * FROM users WHERE name = $1", userInput)

Path Traversal (CWE-22)

// Vulnerable
http.ServeFile(w, r, filepath.Join(baseDir, r.URL.Path))

// Safe
cleanPath := filepath.Clean(r.URL.Path)
fullPath := filepath.Join(baseDir, cleanPath)
if !strings.HasPrefix(fullPath, baseDir) {
    http.Error(w, "Forbidden", 403)
    return
}

Severity Assessment Criteria

CVSS v3.1-Based Assessment

Practical Exploitability Assessment