Skip to content
-
Detect path traversal in file operations
File reads and writes that join a base directory with user input are traversal bugs unless the resolved path is re-checked.
Source Code Review
-
Find SSRF sinks where the URL is user-shaped
Any HTTP client call whose URL derives from input is SSRF unless the host is validated after DNS resolution.
Source Code Review
-
Separate authentication from authorization in review
Most access bugs are objects fetched by id without an ownership check, not missing login gates.
Source Code Review
-
Review Node child_process and dynamic requires
exec with a string, dynamic require, and vm without a sandbox are the Node sinks that turn input into code.
Source Code Review
-
Spot template injection in Python web code
render_template_string or f-string templates built from user input give Jinja SSTI and full RCE.
Source Code Review
-
Catch Python’s unsafe loaders and shell calls
pickle.loads, yaml.load, and subprocess with shell True are the three highest-yield greps in a Python review.
Source Code Review
-
Find JNDI lookups that take remote input
Any Context.lookup or logging pattern that interpolates user data can be steered to a malicious LDAP or RMI server.
Source Code Review
-
Trace SpEL and OGNL expression injection in Java
User input concatenated into a Spring Expression or OGNL evaluation is direct code execution.
Source Code Review
-
Flag Java deserialization and unsafe Jackson typing
ObjectInputStream on untrusted data and Jackson default typing are both direct paths to RCE with a classpath gadget.
Source Code Review
-
Hunt PHP object injection at every unserialize
User-controlled input into unserialize plus a class with magic methods equals remote code execution through a POP chain.
Source Code Review