Source Code Patterns

---
name: Source Code Security Patterns
description: |
  This skill should be used when analyzing discovered source code for security issues.
  Helps identify dangerous functions, hardcoded secrets, and vulnerable packages.
version: 1.0.0
---

# Source Code Security Patterns

## Discovery Endpoints

Common backup/source locations to check:
- /download, /backup, /backup.zip
- /source.zip, /app.zip, /.git/
- *.bak, *.old files

## Dangerous Patterns by Language

### Python
| Pattern | Risk | Notes |
|---------|------|-------|
| js2py with user input | Critical | Check CVE-2024-28397 |
| yaml.load() no Loader | Critical | Use safe_load |
| subprocess shell=True | High | Command injection |
| render_template_string | High | SSTI |
| debug=True in Flask | Medium | Debugger access |
| Hardcoded secret_key | High | Session forgery |

### PHP
| Pattern | Risk | Notes |
|---------|------|-------|
| system/passthru/shell calls | Critical | Command injection |
| include with variable | Critical | LFI/RFI |
| unserialize user data | Critical | Object injection |

### Node.js
| Pattern | Risk | Notes |
|---------|------|-------|
| spawn/run with user input | High | Command injection |
| vm.runIn* functions | High | Sandbox escape |
| SQL string concatenation | High | SQL injection |

## Search for Secrets

```bash
# Passwords and keys
grep -rniE "(password|secret|token|api.?key)\s*[:=]" .

# Database URLs
grep -rniE "(mysql|postgres|mongo)://" .

# Private keys
grep -rnl "PRIVATE KEY" .

# Env files
find . -name ".env*"
```

## Vulnerable Package Versions

### Python (check requirements.txt)
- js2py <= 0.74: Sandbox escape CVE
- pyyaml < 5.4: Code execution
- flask < 2.0: Security fixes
- jinja2 < 2.11.3: Sandbox issues

### Node.js (check package.json)
- lodash < 4.17.21: Prototype pollution
- serialize-javascript < 3.1.0: RCE

## Quick Checklist

1. Check framework and version
2. Search for hardcoded secrets
3. Review package versions for CVEs
4. Find dangerous function calls
5. Look for debug mode enabled
6. Check for SQL string building
7. Find serialization with user input
8. Check template injection points