Code Review Examples

Common Culprits

VulnerabilityLanguageVulnerable CodeReason for VulnerabilityFixed CodeReason for Fix

RCE

PHP

eval($_GET['cmd']);

Directly executing user input

$allowedCmds = ['ls', 'pwd']; if (in_array($_GET['cmd'], $allowedCmds)) { system($_GET['cmd']); }

Whitelist of allowed commands

SQLi

PHP

$query = "SELECT * FROM users WHERE id = '$id'";

Direct inclusion of user input in SQL

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?"); $stmt->execute([$id]);

Parameterized query

SQLi

Java

String query = "SELECT * FROM users WHERE id = '" + id + "'";

String concatenation in SQL

PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE id = ?"); stmt.setString(1, id);

Use of PreparedStatement

SQLi

Python

cursor.execute(f"SELECT * FROM users WHERE id = '{id}'")

String formatting in SQL

cursor.execute("SELECT * FROM users WHERE id = %s", (id,))

Parameterized query

XSS

PHP

echo $_GET['user'];

Direct output of user input

echo htmlspecialchars($_GET['user'], ENT_QUOTES, 'UTF-8');

Encoding special characters

XSS

Java

out.println("<input value='" + request.getParameter("name") + "'>");

Unescaped data in HTML

out.println("<input value='" + Encode.forHtmlAttribute(request.getParameter("name")) + "'>");

Using encoding library

XSS

Python

return f"<p>{user_input}</p>"

Unescaped data in HTML

return f"<p>{escape(user_input)}</p>"

Using escape function

CSRF

PHP

if ($_POST['action'] == 'delete') { delete_item($id); }

No CSRF token check

if ($_POST['csrf_token'] === $_SESSION['csrf_token']) { delete_item($id); }

Validating CSRF token

CSRF

Java

@PostMapping("/transfer")

No CSRF protection

@PostMapping("/transfer") @CsrfProtect

Using CSRF protection annotation

CSRF

Python

@app.route('/change-email', methods=['POST'])

No CSRF protection

@app.route('/change-email', methods=['POST']) @csrf.protect()

Using CSRF protection decorator

Insecure Deserialization

PHP

$data = unserialize($_GET['data']);

Deserializing user input

$data = json_decode($_GET['data'], true);

Using JSON instead of serialized data

Insecure Deserialization

Java

ObjectInputStream ois = new ObjectInputStream(input); Object obj = ois.readObject();

Deserializing without checks

ObjectInputStream ois = new ObjectInputStream(input) { @Override protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException { if (!allowedClasses.contains(desc.getName())) throw new InvalidClassException("Unauthorized deserialization attempt", desc.getName()); return super.resolveClass(desc); } };

Implementing a custom ObjectInputStream with class whitelist

Insecure Deserialization

Python

pickle.loads(data)

Using pickle for deserialization

json.loads(data)

Using JSON instead of pickle

XXE

PHP

$dom = new DOMDocument(); $dom->loadXML($xml);

No entity restriction

`$dom = new DOMDocument(); $dom->loadXML($xml, LIBXML_NOENT

LIBXML_DTDLOAD);`

XXE

Java

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); DocumentBuilder db = dbf.newDocumentBuilder();

Default DocumentBuilderFactory settings

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

Enabling secure processing feature

XXE

Python

ET.fromstring(xml_data)

Default XML parsing

ET.fromstring(xml_data, ET.XMLParser(resolve_entities=False))

Disabling entity resolution

SSRF

PHP

$content = file_get_contents($_GET['url']);

No URL validation

$allowedHosts = ['example.com']; $url = parse_url($_GET['url']); if (in_array($url['host'], $allowedHosts)) { $content = file_get_contents($_GET['url']); }

Whitelist of allowed hosts

SSRF

Java

URL url = new URL(request.getParameter("url")); url.openConnection();

No URL validation

URL url = new URL(request.getParameter("url")); if (!isAllowedHost(url.getHost())) { throw new SecurityException("Host not allowed"); }

Validating host against whitelist

SSRF

Python

requests.get(url)

No URL validation

if not is_valid_url(url): raise ValueError("Invalid URL")

Custom URL validation function

Path Traversal

PHP

include($_GET['file'] . ".php");

No path validation

$file = basename($_GET['file']); include("/var/www/files/$file.php");

Using basename to remove directory traversal

Path Traversal

Java

File file = new File(baseDir + fileName);

No path normalization

File file = new File(baseDir, fileName).getCanonicalFile(); if (!file.getPath().startsWith(baseDir)) { throw new SecurityException("Invalid file path"); }

Path normalization and validation

Path Traversal

Python

open(os.path.join(base_dir, user_file))

No path validation

file_path = os.path.normpath(os.path.join(base_dir, user_file)); if not file_path.startswith(base_dir): raise ValueError("Invalid file path")

Path normalization and validation

Command Injection

PHP

system("ping " . $_GET['ip']);

Unsanitized input in system command

$ip = escapeshellarg($_GET['ip']); system("ping $ip");

Escaping shell arguments

Command Injection

Java

Runtime.getRuntime().exec("ping " + ip);

Unsanitized input in command

ProcessBuilder pb = new ProcessBuilder("ping", ip); pb.start();

Using ProcessBuilder with arguments

Command Injection

Python

os.system("ping " + ip)

Unsanitized input in system command

subprocess.run(["ping", ip], check=True)

Using subprocess with arguments

IDOR

PHP

$data = $db->query("SELECT * FROM users WHERE id = " . $_GET['id']);

No access control check

if ($user->canAccess($_GET['id'])) { $data = $db->query("SELECT * FROM users WHERE id = ?", [$_GET['id']]); }

Implementing access control

IDOR

Java

return userRepository.findById(id);

No access control check

if (currentUser.canAccess(id)) { return userRepository.findById(id); } else { throw new AccessDeniedException(); }

Implementing access control

IDOR

Python

return User.objects.get(id=user_id)

No access control check

if request.user.can_access(user_id): return User.objects.get(id=user_id)

Implementing access control

NoSQL Injection

PHP

$users = $collection->find(array("username" => $_GET['username']));

Direct use of user input in query

$users = $collection->find(array("username" => new MongoDB\BSON\Regex('^' . preg_quote($_GET['username']) . '$', 'i')));

Using regex for exact match

NoSQL Injection

Java

collection.find(eq("username", username))

Direct use of user input in query

collection.find(regex("username", "^" + Pattern.quote(username) + "$"))

Using regex for exact match

NoSQL Injection

Python

collection.find({"username": username})

Direct use of user input in query

collection.find({"username": {"$regex": "^" + re.escape(username) + "$"}})

Using regex for exact match

Buffer Overflow

C

char buffer[5]; strcpy(buffer, argv[1]);

No bounds checking

char buffer[5]; strncpy(buffer, argv[1], sizeof(buffer) - 1); buffer[sizeof(buffer) - 1] = '\0';

Using bounded string copy

Programming LanguageFunctionPossible VulnerabilityVulnerable ScenariosRemediation

PHP

eval()

Code Injection

When user-controlled input is directly passed to eval()

Avoid using eval(). Prefer alternative approaches or secure code design

assert()

Code Injection

When user-controlled input is directly passed to assert()

Avoid using assert(). Prefer alternative approaches or secure code design

system(), shell_exec(), passthru(), popen(), )

Command Injection

When user-controlled input is directly passed to these functions

Use proper input validation and parameterization. Sanitize user input

include(), require()

File Inclusion

When user-controlled input is used without proper validation

Validate and sanitize user input for the included/required file path

unserialize()

Deserialization Vulnerabilities

When untrusted data is deserialized without proper validation

Implement proper input validation and utilize safe unserialization methods

Python

yaml.load()

Deserialization Vulnerabilities

When untrusted YAML data is deserialized without proper validation

Implement proper input validation and utilize safe deserialization methods

JavaScript

document.location.href()

Cross-Site Scripting (XSS)

When user-controlled input is used without proper sanitization

Properly sanitize and validate user input before using it in document.location.href

Ruby

%x(), backticks(code)

Command Injection

When user-controlled input is directly passed to these functions

Use proper input validation and parameterization. Sanitize user input

Marshal.load()

Deserialization Vulnerabilities

When untrusted data is deserialized without proper validation

Implement proper input validation and utilize safe deserialization methods

yaml.load()

Deserialization Vulnerabilities

When untrusted YAML data is deserialized without proper validation

Implement proper input validation and utilize safe deserialization methods

PreviousSecure CodingNextBroken Access Control

Last updated