I01 Injection Risk Patterns
What this means
SiteShadow flagged "injection-shaped" code patterns where untrusted input may be interpreted as code, a query, a command, or a template.
Why it matters
- Injection often turns user input into instructions.
- Outcomes range from data leaks (SQL/NoSQL injection) to RCE (command/code injection).
- Even "internal tools" become attack surfaces once exposed via automation, cron jobs, or webhooks.
Safer examples
1) Parameterize queries (don't concatenate)
await db.query("SELECT * FROM users WHERE id = $1", [id]);2) Don't evaluate user input
# Bad: eval(user_input)
# Good: parse and validate a known format instead
value = int(user_input)3) Avoid "build a shell command string"
subprocess.run(["convert", "--", input_path, output_path], check=True)How SiteShadow detects it (high level)
- Detects dangerous sinks (SQL execution, shell execution, dynamic evaluation, template/DOM sinks).
- Requires untrusted sources in context (request params/body/query, env, network input) to reduce false positives.
- Uses language-aware heuristics for common frameworks when possible.
References
- CWE-89: https://cwe.mitre.org/data/definitions/89.html
- CWE-78: https://cwe.mitre.org/data/definitions/78.html
---