124 · The firewall

The full catalog all 124 classes.

Every gate class the firewall enforces, by category — each with a real detection example. All calibrated to 0 false positives on 5,000+ repos.

Access

Cross-tenant · access-control

✗ db.from('invoices').select('*')

A query with no org filter — every tenant's rows leak in prod.

RLS · SECURITY DEFINER

✗ create view billing as select * … security definer

A definer view that skips row-level security.

Mass-assignment

✗ User.create(req.body) // is_admin passes through

Request body bound straight to the model — privilege fields slip in.

CORS misconfiguration

✗ res.setHeader('Access-Control-Allow-Origin', req.headers.origin)

Request Origin reflected into CORS — any site can read authenticated responses.

Firebase public-write rules

✗ { ".read": true, ".write": true }

Firebase rules left world-readable and world-writable.

Injection

SQL injection

✗ db.query('select * from u where id = ' + req.params.id)

User input concatenated into a SQL string.

NoSQL injection

✗ db.users.find({ $where: req.body.q })

User input reaching a NoSQL $where / operator.

LDAP injection

✗ client.search('uid=' + req.query.u)

User input concatenated into an LDAP filter.

XPath injection

✗ doc.select("//user[name='" + name + "']")

User input concatenated into an XPath query.

Unrestricted upload

✗ app.post('/up', multer({ dest: './public' }))

Upload with no type/extension allowlist into a writable web root.

Command / code

✗ exec('convert ' + req.query.file)

User input reaching a shell command.

Template (SSTI)

✗ res.send(ejs.render(req.query.tpl))

User input rendered as a template — server-side template injection.

Path traversal / LFI

✗ fs.readFile('./files/' + req.params.name)

User input in a file path — ../ escapes the directory.

XSS

✗ el.innerHTML = req.query.q

User input written to innerHTML without escaping.

SSRF

✗ fetch(req.query.url) // hits 169.254.169.254

A server fetch to a user-controlled URL — reaches the metadata endpoint.

XXE

✗ libxml.parseXml(body, { noent: true })

XML parsed with external entities enabled.

Open redirect

✗ res.redirect(req.query.next)

User-controlled redirect target — a phishing pivot.

Prototype pollution

✗ merge(target, JSON.parse(req.body))

Deep-merge of user JSON — __proto__ pollutes Object.prototype.

ReDoS

✗ /^(a+)+$/.test(req.query.s)

Catastrophic-backtracking regex run on user input.

CRLF / header injection

✗ res.setHeader('X-Id', req.query.id)

User input in a header — CRLF splits the HTTP response.

Log injection

✗ logger.info('login ' + req.body.user)

Unsanitized user input into logs — forged log lines.

PHP variable extraction

✗ extract($_GET);

extract() on request data — arbitrary variable overwrite.

SpEL injection

✗ parser.parseExpression(input).getValue()

User input evaluated as a Spring SpEL expression.

Obfuscated code execution

✗ eval(atob(req.body.p))

Base64-decoded user input passed to eval.

Unsafe reflection

✗ Class.forName(req.getParameter("c")).newInstance()

User-controlled class name instantiated by reflection.

OGNL injection

✗ Ognl.getValue(req.getParameter("x"), root)

User input evaluated as an OGNL expression (the Struts RCE class).

Script-engine injection

✗ new ScriptEngineManager().getEngineByName("js").eval(input)

User input evaluated by a scripting engine.

JNDI injection

✗ ctx.lookup(req.getParameter("url"))

User-controlled JNDI lookup (the Log4Shell class).

EL injection

✗ factory.createValueExpression(ctx, input, Object.class)

User input evaluated as a Jakarta EL expression.

XSLT injection

✗ transformer.transform(new StreamSource(userXsl), out)

User-supplied XSLT stylesheet — extension-function RCE.

Node vm code injection

✗ vm.runInThisContext(req.body.code)

User input executed in a Node vm context — not a sandbox.

Node require / import injection

✗ require(req.query.mod)

User-controlled require() path — arbitrary module load.

Python import injection

✗ __import__(request.args['m'])

User-controlled __import__ — arbitrary Python module load.

LLM insecure code execution

✗ eval(await llm.complete(prompt)) // model output run as code

Model-generated code executed without a sandbox.

Per-language variants · Go · .NET 32

Go command injection

✗ exec.Command("sh", "-c", r.URL.Query().Get("c"))

Go: user input reaching a shell command.

.NET command injection

✗ Process.Start("cmd.exe", "/c " + Request["c"])

.NET: user input reaching a shell command.

Go SSRF

✗ http.Get(r.URL.Query().Get("url"))

Go: server fetch to a user-controlled URL.

.NET SSRF

✗ new HttpClient().GetAsync(Request["url"])

.NET: server fetch to a user-controlled URL.

Go SQL injection

✗ db.Query("select * from u where id=" + r.FormValue("id"))

Go: user input concatenated into SQL.

.NET SQL injection

✗ new SqlCommand("select * from u where id=" + Request["id"])

.NET: user input concatenated into SQL.

Go path traversal / LFI

✗ os.ReadFile("./files/" + r.URL.Query().Get("f"))

Go: user input in a file path — traversal.

.NET path traversal / LFI

✗ File.ReadAllText("files\\" + Request["f"])

.NET: user input in a file path — traversal.

Go open redirect

✗ http.Redirect(w, r, r.URL.Query().Get("next"), 302)

Go: user-controlled redirect target.

.NET open redirect

✗ Response.Redirect(Request["next"])

.NET: user-controlled redirect target.

Go XSS

✗ fmt.Fprintf(w, "<div>%s</div>", r.URL.Query().Get("q"))

Go: user input written to HTML unescaped.

.NET XSS

✗ Response.Write("<div>" + Request["q"] + "</div>")

.NET: user input written to HTML unescaped.

Go LDAP injection

✗ ldap.NewSearchRequest("(uid=" + r.FormValue("u") + ")")

Go: user input in an LDAP filter.

.NET LDAP injection

✗ new DirectorySearcher("(uid=" + Request["u"] + ")")

.NET: user input in an LDAP filter.

Go XPath injection

✗ xmlquery.Find(doc, "//user[name='"+r.FormValue("u")+"']")

User input concatenated into an XPath query (Go).

.NET XPath injection

✗ nav.Select("//user[name='" + Request["u"] + "']")

User input concatenated into an XPath query (.NET).

Go template (SSTI)

✗ t, _ := template.New("x").Parse(r.URL.Query().Get("tpl")); t.Execute(w, nil)

User input parsed as a template — SSTI (Go).

.NET template (SSTI)

✗ Engine.Razor.RunCompile(Request["tpl"], "k", null, null)

User input rendered as a template — SSTI (.NET).

Go log injection

✗ log.Println("login " + r.FormValue("user"))

Unsanitized user input into logs — forged lines (Go).

.NET log injection

✗ _logger.LogInformation("login " + Request["user"])

Unsanitized user input into logs — forged lines (.NET).

Go zip-slip

✗ os.WriteFile(filepath.Join(dest, f.Name), buf, 0644)

A zip entry name with ../ writes outside the target dir (Go).

.NET zip-slip

✗ entry.ExtractToFile(Path.Combine(dest, entry.FullName))

A zip entry name with ../ writes outside the target dir (.NET).

Go weak randomness

✗ fmt.Sprintf("%d", rand.Int()) // math/rand as a token

math/rand used to mint a security token (Go).

.NET weak randomness

✗ new Random().Next().ToString() // as a token

System.Random used to mint a security token (.NET).

Go CORS misconfiguration

✗ w.Header().Set("Access-Control-Allow-Origin", r.Header.Get("Origin"))

Request Origin reflected into CORS (Go).

.NET CORS misconfiguration

✗ Response.Headers["Access-Control-Allow-Origin"] = Request.Headers["Origin"]

Request Origin reflected into CORS (.NET).

Go NoSQL injection

✗ coll.Find(ctx, bson.M{"$where": r.FormValue("q")})

User input reaching a NoSQL $where operator (Go).

.NET NoSQL injection

✗ collection.Find("{ $where: '" + Request["q"] + "' }")

User input reaching a NoSQL $where operator (.NET).

Go unrestricted upload

✗ io.Copy(dst, file) // no type/ext allowlist, web root

Upload with no type/extension allowlist (Go).

.NET unrestricted upload

✗ file.SaveAs(Server.MapPath("~/public/" + file.FileName))

Upload with no type/extension allowlist (.NET).

Go unsafe reflection

✗ reflect.New(registry[r.FormValue("t")]).Interface()

User-controlled type instantiated by reflection (Go).

.NET unsafe reflection

✗ Activator.CreateInstance(Type.GetType(Request["t"]))

User-controlled type instantiated by reflection (.NET).

Auth

JWT alg-none / bypass

✗ jwt.verify(t, key, { algorithms: ['none'] })

A token accepted with the 'none' algorithm — forgeable.

JWT algorithm confusion

✗ jwt.verify(t, pubKey) // HS256 signed with the RSA public key

RS/HS confusion — the public key accepted as an HMAC secret.

JWT secret in code

✗ jwt.sign(payload, 'my-secret-key')

JWT signing secret hardcoded in source.

Hardcoded secrets

✗ const stripe = 'sk_live_4eC39Hq…'

A live key committed into source (and git history forever).

CSRF disabled

✗ app.use(csrf({ ignoreMethods: ['POST'] }))

CSRF protection turned off on a mutating route.

Insecure session cookie

✗ res.cookie('sid', id, { httpOnly: false })

Session cookie without HttpOnly / Secure / SameSite.

Hardcoded connection credential

✗ createConnection('postgres://user:pass@db')

A DB connection string with an inline password.

Credential in a URL

✗ fetch('https://user:pass@api.co/x')

Credentials embedded in a URL — logged and cached.

Framework session secret

✗ SECRET_KEY = 'changeme'

Framework session/signing secret left at its default.

Per-language variants · Go · .NET 6

Go JWT secret in code

✗ token.SignedString([]byte("my-secret-key"))

JWT signing secret hardcoded in source (Go).

.NET JWT secret in code

✗ new SymmetricSecurityKey(Encoding.UTF8.GetBytes("my-secret-key"))

JWT signing secret hardcoded in source (.NET).

Go JWT algorithm confusion

✗ jwt.Parse(t, func(*jwt.Token) (any, error) { return pubKey, nil })

RS/HS confusion — public key accepted as HMAC secret (Go).

.NET JWT algorithm confusion

✗ handler.ValidateToken(t, params, out _) // HS accepts RSA pubkey

RS/HS confusion — public key accepted as HMAC secret (.NET).

Go insecure session cookie

✗ http.SetCookie(w, &http.Cookie{Name: "sid", Value: id})

Session cookie without HttpOnly / Secure / SameSite (Go).

.NET insecure session cookie

✗ Response.Cookies.Append("sid", id) // no HttpOnly/Secure/SameSite

Session cookie without HttpOnly / Secure / SameSite (.NET).

Crypto

Weak crypto

✗ crypto.createHash('md5').update(password)

MD5 / SHA-1 where a password hash is required.

Static / hardcoded IV

✗ createCipheriv('aes-256-cbc', key, ZERO_IV)

A reused / zero IV — the same plaintext encrypts identically.

Hardcoded crypto key

✗ const KEY = Buffer.from('0123456789abcdef')

A symmetric key hardcoded in source.

Committed private key

✗ -----BEGIN RSA PRIVATE KEY-----

A private key committed to the repository.

Insecure deserialization

✗ pickle.loads(request.data)

Untrusted data deserialized — object-injection RCE.

JSON polymorphic typing

✗ mapper.enableDefaultTyping()

Jackson default typing on untrusted JSON — gadget RCE.

Weak randomness

✗ Math.random().toString(36) // as a token

Math.random() used to mint a security token.

Zip-slip

✗ fs.writeFileSync(dest + entry.name, buf)

A zip entry name with ../ writes outside the target dir.

Insecure temp-file

✗ open('/tmp/app-' + str(os.getpid()))

A predictable temp-file path — symlink / race attack.

TLS-verify off

✗ new https.Agent({ rejectUnauthorized: false })

Certificate verification disabled on an outbound call.

SSH host-key check off

✗ StrictHostKeyChecking=no

SSH host-key verification disabled — MITM.

Timing-unsafe MAC compare

✗ if (mac === expected) { … }

Non-constant-time MAC compare — a timing oracle.

gRPC cleartext channel

✗ grpc.credentials.createInsecure()

A gRPC channel without TLS — cleartext on the wire.

Obsolete TLS version

✗ minVersion: 'TLSv1'

TLS 1.0 / 1.1 allowed — deprecated and breakable.

Weak key size (RSA/DSA)

✗ generateKeyPairSync('rsa', { modulusLength: 1024 })

An RSA/DSA key below 2048 bits.

Weak elliptic curve

✗ crypto.createECDH('secp160r1')

An elliptic curve below the 224-bit security floor.

Weak DH parameters

✗ crypto.createDiffieHellman(512)

Diffie–Hellman parameters below 2048 bits.

Null / no-encryption cipher

✗ tls.connect({ ciphers: 'NULL-MD5' })

A NULL / no-encryption cipher suite — plaintext on the wire.

Insecure ECB cipher mode

✗ createCipheriv('aes-256-ecb', key, null)

ECB mode leaks plaintext patterns block by block.

Insecure RSA padding

✗ privateDecrypt({ padding: RSA_PKCS1_PADDING }, data)

PKCS#1 v1.5 RSA padding — use OAEP.

Per-language variants · Go · .NET 6

.NET obsolete TLS version

✗ ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11

TLS 1.0 / 1.1 allowed — deprecated (.NET).

.NET gRPC cleartext channel

✗ GrpcChannel.ForAddress("http://svc:5000") // cleartext

A gRPC channel without TLS — cleartext (.NET).

.NET hardcoded crypto key

✗ aes.Key = Encoding.UTF8.GetBytes("0123456789abcdef")

A symmetric key hardcoded in source (.NET).

.NET static / hardcoded IV

✗ aes.IV = new byte[16] // zero IV

A reused / zero IV — identical ciphertext (.NET).

Go weak key size

✗ rsa.GenerateKey(rand.Reader, 1024)

An RSA key below 2048 bits (Go).

.NET weak key size

✗ new RSACryptoServiceProvider(1024)

An RSA key below 2048 bits (.NET).

Supply-chain

Mutable deps · slopsquat

✗ "lodahs": "*" // typo'd name, floating range

A floating range on a typo-squatted package name.

CI/CD mutable pins

✗ uses: some/action@main # not a SHA

A CI action pinned to a branch, not a SHA — silently swappable.

Infra

Docker unpinned

✗ FROM node:latest

A base image pinned to :latest — non-reproducible, it drifts.

IaC open-ingress

✗ cidr_blocks = ["0.0.0.0/0"] # port 22

A security group open to 0.0.0.0/0 on SSH.

K8s privilege

✗ securityContext: { privileged: true }

A privileged container — full host access.

CloudFormation

✗ PolicyDocument: { Action: "*", Resource: "*" }

An IAM policy granting Action:* on Resource:*.

Insecure Electron config

✗ webPreferences: { nodeIntegration: true }

Electron renderer with Node integration, no context isolation.

Actuator over-exposure

✗ management.endpoints.web.exposure.include=*

Spring actuator endpoints fully exposed.

World-writable permissions

✗ os.chmod(path, 0o777)

World-writable permissions (0777).

Debug mode in production

✗ DEBUG = True

Debug mode left on in production.

S3 public-write ACL

✗ ACL: 'public-read-write'

An S3 bucket / object ACL that allows public write.

Azure Blob public access

✗ container.SetAccessPolicy(PublicAccessType.Blob)

An Azure Blob container set to public access.

GCS bucket public access

✗ bucket.iam.set({ allUsers: 'roles/storage.objectViewer' })

A GCS bucket granting allUsers read — public objects.

AWS RDS publicly accessible

✗ new rds.DatabaseInstance(this, 'db', { publiclyAccessible: true })

An RDS instance reachable from the public internet.

S3 public-access-block off

✗ new s3.Bucket(this, 'b', { blockPublicAccess: BlockPublicAccess.BLOCK_ACLS })

S3 public-access-block not fully enabled.

Host-header auth off

✗ host = req.headers.host // used in the reset link

Trusting the Host header — password-reset poisoning.

Clickjacking (X-Frame-Options)

✗ // no X-Frame-Options / frame-ancestors set

No X-Frame-Options / frame-ancestors — clickjacking.

Protect your repos — 14 days free