{ "version": 1, "name": "Software Security fix-card API", "documentation": "https://softwaresecurity.com/api/#fix-cards", "schema": "https://softwaresecurity.com/api/v1/schema.json", "license": "https://creativecommons.org/licenses/by/4.0/", "codeLicense": "https://softwaresecurity.com/downloads/LICENSE-CODE.txt", "updated": "2026-10-11", "count": 188, "rulesPage": "https://softwaresecurity.com/fix/rules/", "cards": [ { "key": "csrf-node-express", "title": "Fix CSRF in Node.js and Express", "url": "https://softwaresecurity.com/fix/csrf/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csrf-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/csrf-node-express.zip", "weakness": { "key": "csrf", "title": "Cross-site request forgery (CSRF)", "url": "https://softwaresecurity.com/fix/csrf/" }, "identifiers": { "cwe": [ "CWE-352" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-62" ], "asvs": [ "v5.0.0-3.5.1", "v5.0.0-3.5.3", "v5.0.0-3.3.2" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csrf/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage" }, { "tool": "CodeQL", "id": "js/missing-token-validation" } ] } }, { "key": "csrf-python-flask", "title": "Fix CSRF in Python and Flask", "url": "https://softwaresecurity.com/fix/csrf/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csrf-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/csrf-python-flask.zip", "weakness": { "key": "csrf", "title": "Cross-site request forgery (CSRF)", "url": "https://softwaresecurity.com/fix/csrf/" }, "identifiers": { "cwe": [ "CWE-352" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-62" ], "asvs": [ "v5.0.0-3.5.1", "v5.0.0-3.5.3", "v5.0.0-3.3.2" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csrf/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled" }, { "tool": "CodeQL", "id": "py/csrf-protection-disabled" } ] } }, { "key": "csrf-java-spring", "title": "Fix CSRF in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/csrf/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csrf-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/csrf-java-spring.zip", "weakness": { "key": "csrf", "title": "Cross-site request forgery (CSRF)", "url": "https://softwaresecurity.com/fix/csrf/" }, "identifiers": { "cwe": [ "CWE-352" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-62" ], "asvs": [ "v5.0.0-3.5.1", "v5.0.0-3.5.3", "v5.0.0-3.3.2" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Security 7.1.1, Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csrf/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled" }, { "tool": "Semgrep", "id": "java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping" }, { "tool": "CodeQL", "id": "java/csrf-unprotected-request-type" }, { "tool": "CodeQL", "id": "java/spring-disabled-csrf-protection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPRING_CSRF_PROTECTION_DISABLED" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING" } ] } }, { "key": "csrf-csharp-aspnetcore", "title": "Fix CSRF in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/csrf/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csrf-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/csrf-csharp-aspnetcore.zip", "weakness": { "key": "csrf", "title": "Cross-site request forgery (CSRF)", "url": "https://softwaresecurity.com/fix/csrf/" }, "identifiers": { "cwe": [ "CWE-352" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-62" ], "asvs": [ "v5.0.0-3.5.1", "v5.0.0-3.5.3", "v5.0.0-3.3.2" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12)", "framework": "ASP.NET Core 10 minimal API with cookie authentication and antiforgery" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csrf/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery" }, { "tool": "CodeQL", "id": "cs/web/missing-token-validation" }, { "tool": ".NET code analysis", "id": "CA3147" } ] } }, { "key": "csrf-python-django", "title": "Fix CSRF in Python and Django", "url": "https://softwaresecurity.com/fix/csrf/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csrf-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/csrf-python-django.zip", "weakness": { "key": "csrf", "title": "Cross-site request forgery (CSRF)", "url": "https://softwaresecurity.com/fix/csrf/" }, "identifiers": { "cwe": [ "CWE-352" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-62" ], "asvs": [ "v5.0.0-3.5.1", "v5.0.0-3.5.3", "v5.0.0-3.3.2" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (CsrfViewMiddleware, sessions and django.contrib.auth)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csrf/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.audit.csrf-exempt.no-csrf-exempt" }, { "tool": "CodeQL", "id": "py/csrf-protection-disabled" } ] } }, { "key": "csrf-ruby-rails", "title": "Fix CSRF in Ruby on Rails", "url": "https://softwaresecurity.com/fix/csrf/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csrf-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/csrf-ruby-rails.zip", "weakness": { "key": "csrf", "title": "Cross-site request forgery (CSRF)", "url": "https://softwaresecurity.com/fix/csrf/" }, "identifiers": { "cwe": [ "CWE-352" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-62" ], "asvs": [ "v5.0.0-3.5.1", "v5.0.0-3.5.3", "v5.0.0-3.3.2" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (protect_from_forgery, cookie sessions)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csrf/ruby-rails/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "ruby.lang.security.missing-csrf-protection.missing-csrf-protection" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection" }, { "tool": "CodeQL", "id": "rb/csrf-protection-disabled" }, { "tool": "CodeQL", "id": "rb/csrf-protection-not-enabled" }, { "tool": "Brakeman", "id": "CSRFTokenForgeryCVE" }, { "tool": "Brakeman", "id": "ForgerySetting" }, { "tool": "Brakeman", "id": "SkipBeforeFilter" } ] } }, { "key": "csrf-php-laravel", "title": "Fix CSRF in PHP and Laravel", "url": "https://softwaresecurity.com/fix/csrf/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csrf-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/csrf-php-laravel.zip", "weakness": { "key": "csrf", "title": "Cross-site request forgery (CSRF)", "url": "https://softwaresecurity.com/fix/csrf/" }, "identifiers": { "cwe": [ "CWE-352" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-62" ], "asvs": [ "v5.0.0-3.5.1", "v5.0.0-3.5.3", "v5.0.0-3.3.2" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (sessions on SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csrf/php-laravel/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "php.laravel.security.laravel-blade-form-missing-csrf.laravel-blade-form-missing-csrf" } ] } }, { "key": "missing-authorization-node-express", "title": "Fix missing object-level authorization (IDOR) in Node.js and Express", "url": "https://softwaresecurity.com/fix/missing-authorization/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-node-express.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag)", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/node-express/#scanner-rules", "rules": [] } }, { "key": "missing-authorization-python-flask", "title": "Fix missing object-level authorization (IDOR) in Python and Flask", "url": "https://softwaresecurity.com/fix/missing-authorization/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-python-flask.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/python-flask/#scanner-rules", "rules": [] } }, { "key": "missing-authorization-java-spring", "title": "Fix missing object-level authorization (IDOR) in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/missing-authorization/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-java-spring.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring Security 7.1.1, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/java-spring/#scanner-rules", "rules": [ { "tool": "Find Security Bugs (SpotBugs)", "id": "SPRING_ENDPOINT" } ] } }, { "key": "missing-authorization-csharp-aspnetcore", "title": "Fix missing object-level authorization (IDOR) in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/missing-authorization/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-csharp-aspnetcore.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization" }, { "tool": "CodeQL", "id": "cs/web/insecure-direct-object-reference" }, { "tool": "CodeQL", "id": "cs/web/missing-function-level-access-control" } ] } }, { "key": "missing-authorization-typescript-nextjs", "title": "Fix missing object-level authorization (IDOR) in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/missing-authorization/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-typescript-nextjs.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript", "runtime": "Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag; route handlers use the default Node.js runtime)", "framework": "Next.js 16.4.0 (App Router route handlers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/typescript-nextjs/#scanner-rules", "rules": [] } }, { "key": "missing-authorization-python-fastapi", "title": "Fix IDOR and missing authorization in Python and FastAPI", "url": "https://softwaresecurity.com/fix/missing-authorization/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-python-fastapi.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) with SQLAlchemy 2.0.54" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/python-fastapi/#scanner-rules", "rules": [] } }, { "key": "missing-authorization-python-django", "title": "Fix IDOR and missing authorization in Python and Django", "url": "https://softwaresecurity.com/fix/missing-authorization/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-python-django.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (ORM over SQLite, django.contrib.auth sessions)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/python-django/#scanner-rules", "rules": [] } }, { "key": "missing-authorization-go-nethttp", "title": "Fix IDOR and missing authorization in Go and net/http", "url": "https://softwaresecurity.com/fix/missing-authorization/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-go-nethttp.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, database/sql) with modernc.org/sqlite 1.60.1" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/go-nethttp/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "go-security-extended" } ] } }, { "key": "missing-authorization-ruby-rails", "title": "Fix IDOR and missing authorization in Ruby on Rails", "url": "https://softwaresecurity.com/fix/missing-authorization/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-ruby-rails.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (Active Record scopes over SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/ruby-rails/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find" }, { "tool": "Brakeman", "id": "UnscopedFind" } ] } }, { "key": "missing-authorization-php-laravel", "title": "Fix missing object-level authorization (IDOR) in PHP and Laravel", "url": "https://softwaresecurity.com/fix/missing-authorization/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authorization-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authorization-php-laravel.zip", "weakness": { "key": "missing-authorization", "title": "Missing object-level authorization (IDOR and BOLA)", "url": "https://softwaresecurity.com/fix/missing-authorization/" }, "identifiers": { "cwe": [ "CWE-862", "CWE-639", "CWE-863" ], "owaspTop10_2025": [ "A01:2025" ], "owaspApiTop10_2023": [ "API1:2023" ], "capec": [] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (Eloquent over SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authorization/php-laravel/#scanner-rules", "rules": [] } }, { "key": "open-redirect-node-express", "title": "Fix open redirects in Node.js and Express", "url": "https://softwaresecurity.com/fix/open-redirect/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-node-express.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.express-open-redirect.express-open-redirect" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect" }, { "tool": "CodeQL", "id": "js/server-side-unvalidated-url-redirection" } ] } }, { "key": "open-redirect-python-flask", "title": "Fix open redirects in Python and Flask", "url": "https://softwaresecurity.com/fix/open-redirect/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-python-flask.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.open-redirect.open-redirect" }, { "tool": "CodeQL", "id": "py/url-redirection" } ] } }, { "key": "open-redirect-java-spring", "title": "Fix open redirects in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/open-redirect/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-java-spring.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.unvalidated-redirect.unvalidated-redirect" }, { "tool": "Semgrep", "id": "java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect" }, { "tool": "CodeQL", "id": "java/unvalidated-url-redirection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPRING_UNVALIDATED_REDIRECT" } ] } }, { "key": "open-redirect-csharp-aspnetcore", "title": "Fix open redirects in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/open-redirect/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-csharp-aspnetcore.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12)", "framework": "ASP.NET Core 10 MVC controllers with cookie authentication and antiforgery" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.lang.security.open-redirect.open-redirect" }, { "tool": "CodeQL", "id": "cs/web/unvalidated-url-redirection" }, { "tool": ".NET code analysis", "id": "CA3007" } ] } }, { "key": "open-redirect-typescript-nextjs", "title": "Fix open redirects in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/open-redirect/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-typescript-nextjs.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript", "runtime": "Node.js 26.11.1", "framework": "Next.js 16.4.0 (App Router server action with redirect() from next/navigation)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.express-open-redirect.express-open-redirect" }, { "tool": "CodeQL", "id": "js/server-side-unvalidated-url-redirection" } ] } }, { "key": "open-redirect-python-fastapi", "title": "Fix open redirects in Python and FastAPI", "url": "https://softwaresecurity.com/fix/open-redirect/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-python-fastapi.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/python-fastapi/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/url-redirection" } ] } }, { "key": "open-redirect-python-django", "title": "Fix open redirects in Python and Django", "url": "https://softwaresecurity.com/fix/open-redirect/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-python-django.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (django.contrib.auth sign-in)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.open-redirect.open-redirect" }, { "tool": "CodeQL", "id": "py/url-redirection" } ] } }, { "key": "open-redirect-go-nethttp", "title": "Fix open redirects in Go and net/http", "url": "https://softwaresecurity.com/fix/open-redirect/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-go-nethttp.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, net/url)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.injection.open-redirect.open-redirect" }, { "tool": "CodeQL", "id": "go/bad-redirect-check" }, { "tool": "CodeQL", "id": "go/unvalidated-url-redirection" }, { "tool": "gosec", "id": "G124" }, { "tool": "gosec", "id": "G710" } ] } }, { "key": "open-redirect-ruby-rails", "title": "Fix open redirects in Ruby on Rails", "url": "https://softwaresecurity.com/fix/open-redirect/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-ruby-rails.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (sign-in with has_secure_password, redirect_to and url_from)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/ruby-rails/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-redirect-to.check-redirect-to" }, { "tool": "CodeQL", "id": "rb/url-redirection" }, { "tool": "Brakeman", "id": "Redirect" } ] } }, { "key": "open-redirect-php-laravel", "title": "Fix open redirects in PHP and Laravel", "url": "https://softwaresecurity.com/fix/open-redirect/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/open-redirect-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/open-redirect-php-laravel.zip", "weakness": { "key": "open-redirect", "title": "Open redirect", "url": "https://softwaresecurity.com/fix/open-redirect/" }, "identifiers": { "cwe": [ "CWE-601" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [], "asvs": [ "v5.0.0-3.7.2" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (sessions on SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/open-redirect/php-laravel/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "php.lang.security.redirect-to-request-uri.redirect-to-request-uri" }, { "tool": "Psalm", "id": "TaintedHeader" } ] } }, { "key": "path-traversal-node-express", "title": "Fix path traversal in Node.js and Express", "url": "https://softwaresecurity.com/fix/path-traversal/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-node-express.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal" }, { "tool": "CodeQL", "id": "js/path-injection" } ] } }, { "key": "path-traversal-python-flask", "title": "Fix path traversal in Python and Flask", "url": "https://softwaresecurity.com/fix/path-traversal/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-python-flask.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.injection.path-traversal-open.path-traversal-open" }, { "tool": "CodeQL", "id": "py/path-injection" } ] } }, { "key": "path-traversal-java-spring", "title": "Fix path traversal in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/path-traversal/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-java-spring.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.spring.security.injection.tainted-file-path.tainted-file-path" }, { "tool": "CodeQL", "id": "java/partial-path-traversal-from-remote" }, { "tool": "CodeQL", "id": "java/path-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "PATH_TRAVERSAL_IN" } ] } }, { "key": "path-traversal-csharp-aspnetcore", "title": "Fix path traversal in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/path-traversal/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-csharp-aspnetcore.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine" }, { "tool": "CodeQL", "id": "cs/path-injection" }, { "tool": ".NET code analysis", "id": "CA3003" } ] } }, { "key": "path-traversal-typescript-nextjs", "title": "Fix path traversal in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/path-traversal/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-typescript-nextjs.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript", "runtime": "Node.js 26.11.1 (route handlers use the default Node.js runtime, which node:fs needs)", "framework": "Next.js 16.4.0 (App Router route handlers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal" }, { "tool": "CodeQL", "id": "js/path-injection" } ] } }, { "key": "path-traversal-python-fastapi", "title": "Fix path traversal in Python and FastAPI", "url": "https://softwaresecurity.com/fix/path-traversal/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-python-fastapi.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0 FileResponse)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/python-fastapi/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/path-injection" } ] } }, { "key": "path-traversal-python-django", "title": "Fix path traversal in Python and Django", "url": "https://softwaresecurity.com/fix/path-traversal/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-python-django.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (FileResponse)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name" }, { "tool": "Semgrep", "id": "python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join" }, { "tool": "Semgrep", "id": "python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open" }, { "tool": "CodeQL", "id": "py/path-injection" } ] } }, { "key": "path-traversal-go-nethttp", "title": "Fix path traversal in Go and net/http", "url": "https://softwaresecurity.com/fix/path-traversal/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-go-nethttp.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, os.Root)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.filepath-clean-misuse.filepath-clean-misuse" }, { "tool": "CodeQL", "id": "go/path-injection" }, { "tool": "gosec", "id": "G304" }, { "tool": "gosec", "id": "G703" } ] } }, { "key": "path-traversal-ruby-rails", "title": "Fix path traversal in Ruby on Rails", "url": "https://softwaresecurity.com/fix/path-traversal/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-ruby-rails.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (API controller, send_file)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/ruby-rails/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-send-file.check-send-file" }, { "tool": "CodeQL", "id": "rb/path-injection" }, { "tool": "Brakeman", "id": "Pathname" }, { "tool": "Brakeman", "id": "SendFile" } ] } }, { "key": "path-traversal-php-laravel", "title": "Fix path traversal in PHP and Laravel", "url": "https://softwaresecurity.com/fix/path-traversal/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/path-traversal-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/path-traversal-php-laravel.zip", "weakness": { "key": "path-traversal", "title": "Path traversal", "url": "https://softwaresecurity.com/fix/path-traversal/" }, "identifiers": { "cwe": [ "CWE-22", "CWE-23", "CWE-36", "CWE-59" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-126", "CAPEC-139", "CAPEC-597", "CAPEC-64", "CAPEC-79", "CAPEC-132" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (Storage)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/path-traversal/php-laravel/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "php.lang.security.injection.tainted-filename.tainted-filename" }, { "tool": "Psalm", "id": "TaintedFile" } ] } }, { "key": "ssrf-node-express", "title": "Fix SSRF in Node.js and Express", "url": "https://softwaresecurity.com/fix/ssrf/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-node-express.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.express-ssrf.express-ssrf" }, { "tool": "CodeQL", "id": "js/request-forgery" } ] } }, { "key": "ssrf-python-flask", "title": "Fix SSRF in Python and Flask", "url": "https://softwaresecurity.com/fix/ssrf/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-python-flask.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.ssrf.ssrf-injection-requests" }, { "tool": "CodeQL", "id": "py/full-ssrf" } ] } }, { "key": "ssrf-java-spring", "title": "Fix SSRF in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/ssrf/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-java-spring.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket" }, { "tool": "Semgrep", "id": "java.spring.security.injection.tainted-url-host.tainted-url-host" }, { "tool": "CodeQL", "id": "java/ssrf" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "URLCONNECTION_SSRF_FD" } ] } }, { "key": "ssrf-csharp-aspnetcore", "title": "Fix SSRF in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/ssrf/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-csharp-aspnetcore.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/request-forgery" } ] } }, { "key": "ssrf-typescript-nextjs", "title": "Fix SSRF in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/ssrf/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-typescript-nextjs.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript", "runtime": "Node.js 26.11.1 (route handlers use the default Node.js runtime; node:http, node:net and node:dns are not available on the Edge runtime)", "framework": "Next.js 16.4.0 (App Router route handlers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.express-ssrf.express-ssrf" }, { "tool": "CodeQL", "id": "js/request-forgery" } ] } }, { "key": "ssrf-python-fastapi", "title": "Fix SSRF in Python and FastAPI", "url": "https://softwaresecurity.com/fix/ssrf/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-python-fastapi.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/python-fastapi/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.ssrf.ssrf-injection-requests" }, { "tool": "CodeQL", "id": "py/full-ssrf" }, { "tool": "Bandit", "id": "B104" } ] } }, { "key": "ssrf-python-django", "title": "Fix SSRF in Python and Django", "url": "https://softwaresecurity.com/fix/ssrf/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-python-django.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests" }, { "tool": "CodeQL", "id": "py/full-ssrf" }, { "tool": "Bandit", "id": "B104" } ] } }, { "key": "ssrf-go-nethttp", "title": "Fix SSRF in Go and net/http", "url": "https://softwaresecurity.com/fix/ssrf/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-go-nethttp.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http client, net/netip)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.injection.tainted-url-host.tainted-url-host" }, { "tool": "CodeQL", "id": "go/request-forgery" }, { "tool": "gosec", "id": "G107" }, { "tool": "gosec", "id": "G704" } ] } }, { "key": "ssrf-ruby-rails", "title": "Fix server-side request forgery in Ruby on Rails", "url": "https://softwaresecurity.com/fix/ssrf/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-ruby-rails.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (API controller) with Net::HTTP (net-http 0.9.1) and IPAddr (ipaddr 1.2.8)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/ruby-rails/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "rb/request-forgery" }, { "tool": "Brakeman", "id": "SSRF" } ] } }, { "key": "ssrf-php-laravel", "title": "Fix server-side request forgery in PHP and Laravel", "url": "https://softwaresecurity.com/fix/ssrf/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ssrf-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/ssrf-php-laravel.zip", "weakness": { "key": "ssrf", "title": "Server-side request forgery (SSRF)", "url": "https://softwaresecurity.com/fix/ssrf/" }, "identifiers": { "cwe": [ "CWE-918" ], "owaspTop10_2025": [ "A01:2025" ], "capec": [ "CAPEC-664" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 with PHP 8.5's Uri\\WhatWg\\Url, filter_var(FILTER_FLAG_GLOBAL_RANGE) and stream sockets" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ssrf/php-laravel/#scanner-rules", "rules": [] } }, { "key": "cors-misconfiguration-node-express", "title": "Fix CORS misconfiguration in Node.js and Express", "url": "https://softwaresecurity.com/fix/cors-misconfiguration/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/cors-misconfiguration-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/cors-misconfiguration-node-express.zip", "weakness": { "key": "cors-misconfiguration", "title": "CORS misconfiguration on credentialed APIs", "url": "https://softwaresecurity.com/fix/cors-misconfiguration/" }, "identifiers": { "cwe": [ "CWE-942", "CWE-346" ], "owaspTop10_2025": [ "A02:2025", "A07:2025" ], "capec": [], "asvs": [ "v5.0.0-3.4.2", "v5.0.0-3.5.2" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/cors-misconfiguration/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.cors-misconfiguration.cors-misconfiguration" }, { "tool": "Semgrep", "id": "typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard" }, { "tool": "CodeQL", "id": "js/cors-misconfiguration-for-credentials" }, { "tool": "CodeQL", "id": "js/cors-permissive-configuration" } ] } }, { "key": "cors-misconfiguration-python-flask", "title": "Fix CORS misconfiguration in Python and Flask", "url": "https://softwaresecurity.com/fix/cors-misconfiguration/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/cors-misconfiguration-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/cors-misconfiguration-python-flask.zip", "weakness": { "key": "cors-misconfiguration", "title": "CORS misconfiguration on credentialed APIs", "url": "https://softwaresecurity.com/fix/cors-misconfiguration/" }, "identifiers": { "cwe": [ "CWE-942", "CWE-346" ], "owaspTop10_2025": [ "A02:2025", "A07:2025" ], "capec": [], "asvs": [ "v5.0.0-3.4.2", "v5.0.0-3.5.2" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/cors-misconfiguration/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.audit.flask-cors-misconfiguration.flask-cors-misconfiguration" }, { "tool": "CodeQL", "id": "py/cors-bypass" }, { "tool": "CodeQL", "id": "py/cors-misconfiguration-with-credentials" } ] } }, { "key": "cors-misconfiguration-java-spring", "title": "Fix CORS misconfiguration in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/cors-misconfiguration/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/cors-misconfiguration-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/cors-misconfiguration-java-spring.zip", "weakness": { "key": "cors-misconfiguration", "title": "CORS misconfiguration on credentialed APIs", "url": "https://softwaresecurity.com/fix/cors-misconfiguration/" }, "identifiers": { "cwe": [ "CWE-942", "CWE-346" ], "owaspTop10_2025": [ "A02:2025", "A07:2025" ], "capec": [], "asvs": [ "v5.0.0-3.4.2", "v5.0.0-3.5.2" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/cors-misconfiguration/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.permissive-cors.permissive-cors" }, { "tool": "CodeQL", "id": "java/unvalidated-cors-origin-set" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "PERMISSIVE_CORS" } ] } }, { "key": "cors-misconfiguration-csharp-aspnetcore", "title": "Fix CORS misconfiguration in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/cors-misconfiguration/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/cors-misconfiguration-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/cors-misconfiguration-csharp-aspnetcore.zip", "weakness": { "key": "cors-misconfiguration", "title": "CORS misconfiguration on credentialed APIs", "url": "https://softwaresecurity.com/fix/cors-misconfiguration/" }, "identifiers": { "cwe": [ "CWE-942", "CWE-346" ], "owaspTop10_2025": [ "A02:2025", "A07:2025" ], "capec": [], "asvs": [ "v5.0.0-3.4.2", "v5.0.0-3.5.2" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12)", "framework": "ASP.NET Core 10 minimal API with the CORS middleware" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/cors-misconfiguration/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "SonarQube", "id": "S5122" } ] } }, { "key": "xxe-python-flask", "title": "Fix XML external entity processing in Python and Flask", "url": "https://softwaresecurity.com/fix/xxe/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xxe-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/xxe-python-flask.zip", "weakness": { "key": "xxe", "title": "XML external entity (XXE) processing", "url": "https://softwaresecurity.com/fix/xxe/" }, "identifiers": { "cwe": [ "CWE-611", "CWE-776" ], "owaspTop10_2025": [ "A02:2025" ], "capec": [ "CAPEC-221", "CAPEC-197" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8 (libexpat 2.8.5)", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xxe/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.use-defused-xml.use-defused-xml" }, { "tool": "CodeQL", "id": "py/xxe" }, { "tool": "Bandit", "id": "B405" } ] } }, { "key": "xxe-java-spring", "title": "Fix XML external entity processing in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/xxe/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xxe-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/xxe-java-spring.zip", "weakness": { "key": "xxe", "title": "XML external entity (XXE) processing", "url": "https://softwaresecurity.com/fix/xxe/" }, "identifiers": { "cwe": [ "CWE-611", "CWE-776" ], "owaspTop10_2025": [ "A02:2025" ], "capec": [ "CAPEC-221", "CAPEC-197" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xxe/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false" }, { "tool": "Semgrep", "id": "java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing" }, { "tool": "CodeQL", "id": "java/xxe" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "XXE_DOCUMENT" } ] } }, { "key": "xxe-csharp-aspnetcore", "title": "Fix XML external entity processing in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/xxe/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xxe-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/xxe-csharp-aspnetcore.zip", "weakness": { "key": "xxe", "title": "XML external entity (XXE) processing", "url": "https://softwaresecurity.com/fix/xxe/" }, "identifiers": { "cwe": [ "CWE-611", "CWE-776" ], "owaspTop10_2025": [ "A02:2025" ], "capec": [ "CAPEC-221", "CAPEC-197" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xxe/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/xml/insecure-dtd-handling" }, { "tool": ".NET code analysis", "id": "CA3075" } ] } }, { "key": "insecure-randomness-node-express", "title": "Fix insecure randomness for reset tokens in Node.js and Express", "url": "https://softwaresecurity.com/fix/insecure-randomness/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/insecure-randomness-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/insecure-randomness-node-express.zip", "weakness": { "key": "insecure-randomness", "title": "Insecure randomness for security tokens", "url": "https://softwaresecurity.com/fix/insecure-randomness/" }, "identifiers": { "cwe": [ "CWE-330", "CWE-338" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-59", "CAPEC-112" ], "asvs": [ "v5.0.0-11.5.1", "v5.0.0-11.5.2" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/insecure-randomness/node-express/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "js/insecure-randomness" } ] } }, { "key": "insecure-randomness-python-flask", "title": "Fix insecure randomness for reset tokens in Python and Flask", "url": "https://softwaresecurity.com/fix/insecure-randomness/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/insecure-randomness-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/insecure-randomness-python-flask.zip", "weakness": { "key": "insecure-randomness", "title": "Insecure randomness for security tokens", "url": "https://softwaresecurity.com/fix/insecure-randomness/" }, "identifiers": { "cwe": [ "CWE-330", "CWE-338" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-59", "CAPEC-112" ], "asvs": [ "v5.0.0-11.5.1", "v5.0.0-11.5.2" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/insecure-randomness/python-flask/#scanner-rules", "rules": [ { "tool": "Bandit", "id": "B311" } ] } }, { "key": "insecure-randomness-java-spring", "title": "Fix insecure randomness for reset tokens in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/insecure-randomness/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/insecure-randomness-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/insecure-randomness-java-spring.zip", "weakness": { "key": "insecure-randomness", "title": "Insecure randomness for security tokens", "url": "https://softwaresecurity.com/fix/insecure-randomness/" }, "identifiers": { "cwe": [ "CWE-330", "CWE-338" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-59", "CAPEC-112" ], "asvs": [ "v5.0.0-11.5.1", "v5.0.0-11.5.2" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/insecure-randomness/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.crypto.weak-random.weak-random" }, { "tool": "CodeQL", "id": "java/insecure-randomness" }, { "tool": "CodeQL", "id": "java/predictable-seed" } ] } }, { "key": "insecure-randomness-csharp-aspnetcore", "title": "Fix insecure randomness for reset tokens in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/insecure-randomness/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/insecure-randomness-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/insecure-randomness-csharp-aspnetcore.zip", "weakness": { "key": "insecure-randomness", "title": "Insecure randomness for security tokens", "url": "https://softwaresecurity.com/fix/insecure-randomness/" }, "identifiers": { "cwe": [ "CWE-330", "CWE-338" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-59", "CAPEC-112" ], "asvs": [ "v5.0.0-11.5.1", "v5.0.0-11.5.2" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/insecure-randomness/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": ".NET code analysis", "id": "CA5394" } ] } }, { "key": "insecure-randomness-go-nethttp", "title": "Fix insecure randomness for reset tokens in Go and net/http", "url": "https://softwaresecurity.com/fix/insecure-randomness/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/insecure-randomness-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/insecure-randomness-go-nethttp.zip", "weakness": { "key": "insecure-randomness", "title": "Insecure randomness for security tokens", "url": "https://softwaresecurity.com/fix/insecure-randomness/" }, "identifiers": { "cwe": [ "CWE-330", "CWE-338" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-59", "CAPEC-112" ], "asvs": [ "v5.0.0-11.5.1", "v5.0.0-11.5.2" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, crypto/rand)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/insecure-randomness/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.audit.crypto.math_random.math-random-used" }, { "tool": "CodeQL", "id": "go/insecure-randomness" }, { "tool": "gosec", "id": "G404" } ] } }, { "key": "password-hashing-node-express", "title": "Fix weak password hashing in Node.js and Express", "url": "https://softwaresecurity.com/fix/password-hashing/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/password-hashing-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/password-hashing-node-express.zip", "weakness": { "key": "password-hashing", "title": "Weak password hashing", "url": "https://softwaresecurity.com/fix/password-hashing/" }, "identifiers": { "cwe": [ "CWE-916", "CWE-759", "CWE-327" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-55", "CAPEC-49" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/password-hashing/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.md5-used-as-password.md5-used-as-password" }, { "tool": "CodeQL", "id": "js/insufficient-password-hash" } ] } }, { "key": "password-hashing-python-flask", "title": "Fix weak password hashing in Python and Flask", "url": "https://softwaresecurity.com/fix/password-hashing/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/password-hashing-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/password-hashing-python-flask.zip", "weakness": { "key": "password-hashing", "title": "Weak password hashing", "url": "https://softwaresecurity.com/fix/password-hashing/" }, "identifiers": { "cwe": [ "CWE-916", "CWE-759", "CWE-327" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-55", "CAPEC-49" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/password-hashing/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.audit.md5-used-as-password.md5-used-as-password" }, { "tool": "CodeQL", "id": "py/weak-sensitive-data-hashing" }, { "tool": "Bandit", "id": "B324" } ] } }, { "key": "password-hashing-java-spring", "title": "Fix weak password hashing in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/password-hashing/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/password-hashing-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/password-hashing-java-spring.zip", "weakness": { "key": "password-hashing", "title": "Weak password hashing", "url": "https://softwaresecurity.com/fix/password-hashing/" }, "identifiers": { "cwe": [ "CWE-916", "CWE-759", "CWE-327" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-55", "CAPEC-49" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC) with Spring Security Crypto 7.1.1" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/password-hashing/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.md5-used-as-password.md5-used-as-password" }, { "tool": "CodeQL", "id": "java/hash-without-salt" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "UNSAFE_HASH_EQUALS" } ] } }, { "key": "password-hashing-csharp-aspnetcore", "title": "Fix weak password hashing in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/password-hashing/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/password-hashing-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/password-hashing-csharp-aspnetcore.zip", "weakness": { "key": "password-hashing", "title": "Weak password hashing", "url": "https://softwaresecurity.com/fix/password-hashing/" }, "identifiers": { "cwe": [ "CWE-916", "CWE-759", "CWE-327" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-55", "CAPEC-49" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API with ASP.NET Core Identity's PasswordHasher" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/password-hashing/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/hash-without-salt" }, { "tool": ".NET code analysis", "id": "CA5350" }, { "tool": ".NET code analysis", "id": "CA5351" }, { "tool": ".NET code analysis", "id": "CA5387" }, { "tool": ".NET code analysis", "id": "CA5388" } ] } }, { "key": "password-hashing-python-fastapi", "title": "Fix weak password hashing in Python and FastAPI", "url": "https://softwaresecurity.com/fix/password-hashing/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/password-hashing-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/password-hashing-python-fastapi.zip", "weakness": { "key": "password-hashing", "title": "Weak password hashing", "url": "https://softwaresecurity.com/fix/password-hashing/" }, "identifiers": { "cwe": [ "CWE-916", "CWE-759", "CWE-327" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-55", "CAPEC-49" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/password-hashing/python-fastapi/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.audit.md5-used-as-password.md5-used-as-password" }, { "tool": "CodeQL", "id": "py/weak-sensitive-data-hashing" }, { "tool": "Bandit", "id": "B324" } ] } }, { "key": "password-hashing-python-django", "title": "Fix weak password hashing in Python and Django", "url": "https://softwaresecurity.com/fix/password-hashing/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/password-hashing-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/password-hashing-python-django.zip", "weakness": { "key": "password-hashing", "title": "Weak password hashing", "url": "https://softwaresecurity.com/fix/password-hashing/" }, "identifiers": { "cwe": [ "CWE-916", "CWE-759", "CWE-327" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-55", "CAPEC-49" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (django.contrib.auth.hashers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/password-hashing/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.audit.unvalidated-password.unvalidated-password" }, { "tool": "Semgrep", "id": "python.lang.security.audit.md5-used-as-password.md5-used-as-password" }, { "tool": "CodeQL", "id": "py/weak-sensitive-data-hashing" }, { "tool": "Bandit", "id": "B324" } ] } }, { "key": "password-hashing-go-nethttp", "title": "Fix weak password hashing in Go and net/http", "url": "https://softwaresecurity.com/fix/password-hashing/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/password-hashing-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/password-hashing-go-nethttp.zip", "weakness": { "key": "password-hashing", "title": "Weak password hashing", "url": "https://softwaresecurity.com/fix/password-hashing/" }, "identifiers": { "cwe": [ "CWE-916", "CWE-759", "CWE-327" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-55", "CAPEC-49" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, database/sql) with x/crypto 0.57.0 (argon2)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/password-hashing/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.audit.md5-used-as-password.md5-used-as-password" }, { "tool": "CodeQL", "id": "go/weak-sensitive-data-hashing" }, { "tool": "gosec", "id": "G401" } ] } }, { "key": "password-hashing-php-laravel", "title": "Fix weak password hashing in PHP and Laravel", "url": "https://softwaresecurity.com/fix/password-hashing/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/password-hashing-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/password-hashing-php-laravel.zip", "weakness": { "key": "password-hashing", "title": "Weak password hashing", "url": "https://softwaresecurity.com/fix/password-hashing/" }, "identifiers": { "cwe": [ "CWE-916", "CWE-759", "CWE-327" ], "owaspTop10_2025": [ "A04:2025" ], "capec": [ "CAPEC-55", "CAPEC-49" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (Hash facade)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/password-hashing/php-laravel/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "php.lang.security.md5-used-as-password.md5-used-as-password" }, { "tool": "Semgrep", "id": "php.lang.security.weak-crypto.weak-crypto" } ] } }, { "key": "code-injection-node-express", "title": "Fix code injection in Node.js and Express", "url": "https://softwaresecurity.com/fix/code-injection/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/code-injection-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/code-injection-node-express.zip", "weakness": { "key": "code-injection", "title": "Code injection", "url": "https://softwaresecurity.com/fix/code-injection/" }, "identifiers": { "cwe": [ "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1 (node:vm built in)", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/code-injection/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression" }, { "tool": "CodeQL", "id": "js/code-injection" } ] } }, { "key": "code-injection-python-flask", "title": "Fix code injection in Python and Flask", "url": "https://softwaresecurity.com/fix/code-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/code-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/code-injection-python-flask.zip", "weakness": { "key": "code-injection", "title": "Code injection", "url": "https://softwaresecurity.com/fix/code-injection/" }, "identifiers": { "cwe": [ "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ], "asvs": [ "v5.0.0-1.3.2" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/code-injection/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.audit.eval-detected.eval-detected" }, { "tool": "CodeQL", "id": "py/code-injection" }, { "tool": "Bandit", "id": "B105" }, { "tool": "Bandit", "id": "B307" } ] } }, { "key": "code-injection-java-spring", "title": "Fix code injection in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/code-injection/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/code-injection-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/code-injection-java-spring.zip", "weakness": { "key": "code-injection", "title": "Code injection", "url": "https://softwaresecurity.com/fix/code-injection/" }, "identifiers": { "cwe": [ "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, SpEL / spring-expression)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/code-injection/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.spring.security.audit.spel-injection.spel-injection" }, { "tool": "CodeQL", "id": "java/spel-expression-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPEL_INJECTION" } ] } }, { "key": "code-injection-csharp-aspnetcore", "title": "Fix code injection in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/code-injection/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/code-injection-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/code-injection-csharp-aspnetcore.zip", "weakness": { "key": "code-injection", "title": "Code injection", "url": "https://softwaresecurity.com/fix/code-injection/" }, "identifiers": { "cwe": [ "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": "ASP.NET Core 10 minimal API on .NET 10.0.12", "framework": "ASP.NET Core 10 (minimal API)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/code-injection/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/code-injection" } ] } }, { "key": "code-injection-python-fastapi", "title": "Fix code injection in Python and FastAPI", "url": "https://softwaresecurity.com/fix/code-injection/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/code-injection-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/code-injection-python-fastapi.zip", "weakness": { "key": "code-injection", "title": "Code injection", "url": "https://softwaresecurity.com/fix/code-injection/" }, "identifiers": { "cwe": [ "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ], "asvs": [ "v5.0.0-1.3.2" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/code-injection/python-fastapi/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.audit.eval-detected.eval-detected" }, { "tool": "CodeQL", "id": "py/code-injection" }, { "tool": "Bandit", "id": "B105" }, { "tool": "Bandit", "id": "B307" } ] } }, { "key": "xss-node-express", "title": "Fix cross-site scripting in Node.js and Express", "url": "https://softwaresecurity.com/fix/xss/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-node-express.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0 with EJS 6.0.1 templates" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.xss.ejs.var-in-href.var-in-href" }, { "tool": "CodeQL", "id": "js/reflected-xss" } ] } }, { "key": "xss-python-flask", "title": "Fix cross-site scripting in Python and Flask", "url": "https://softwaresecurity.com/fix/xss/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-python-flask.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3 with Jinja2 templates" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe" }, { "tool": "Semgrep", "id": "python.flask.security.xss.audit.template-unquoted-attribute-var.template-unquoted-attribute-var" }, { "tool": "CodeQL", "id": "py/reflective-xss" }, { "tool": "Bandit", "id": "B701" } ] } }, { "key": "xss-java-spring", "title": "Fix cross-site scripting in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/xss/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-java-spring.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring MVC) with Thymeleaf 3.1.5" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/java-spring/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "java/xss" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "XSS_JSP_PRINT" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "XSS_SERVLET" } ] } }, { "key": "xss-csharp-aspnetcore", "title": "Fix cross-site scripting in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/xss/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-csharp-aspnetcore.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 MVC with Razor views" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.dotnet.security.audit.razor-use-of-htmlstring.razor-use-of-htmlstring" }, { "tool": "CodeQL", "id": "cs/web/xss" } ] } }, { "key": "xss-typescript-nextjs", "title": "Fix XSS in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/xss/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-typescript-nextjs.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript (TSX)", "runtime": "Node.js 26.11.1", "framework": "Next.js 16.4.0 (App Router server component) with React 19.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml" }, { "tool": "CodeQL", "id": "js/xss" } ] } }, { "key": "xss-python-django", "title": "Fix XSS in Python and Django", "url": "https://softwaresecurity.com/fix/xss/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-python-django.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 with Django templates" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "generic.html-templates.security.var-in-href.var-in-href" }, { "tool": "Semgrep", "id": "python.django.security.audit.xss.template-autoescape-off.template-autoescape-off" }, { "tool": "Semgrep", "id": "python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe" }, { "tool": "CodeQL", "id": "py/reflective-xss" }, { "tool": "Bandit", "id": "B308" }, { "tool": "Bandit", "id": "B703" } ] } }, { "key": "xss-go-nethttp", "title": "Fix cross-site scripting in Go and net/http", "url": "https://softwaresecurity.com/fix/xss/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-go-nethttp.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, html/template)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.audit.xss.import-text-template.import-text-template" }, { "tool": "Semgrep", "id": "go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter" }, { "tool": "Semgrep", "id": "go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type" }, { "tool": "CodeQL", "id": "go/html-template-escaping-bypass-xss" }, { "tool": "CodeQL", "id": "go/reflected-xss" }, { "tool": "gosec", "id": "G203" }, { "tool": "gosec", "id": "G708" } ] } }, { "key": "xss-ruby-rails", "title": "Fix XSS in Ruby on Rails", "url": "https://softwaresecurity.com/fix/xss/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-ruby-rails.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (ERB views)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/ruby-rails/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.templates.dangerous-link-to.dangerous-link-to" }, { "tool": "CodeQL", "id": "rb/reflected-xss" }, { "tool": "Brakeman", "id": "CrossSiteScripting" }, { "tool": "Brakeman", "id": "LinkToHref" } ] } }, { "key": "xss-php-laravel", "title": "Fix cross-site scripting in PHP and Laravel", "url": "https://softwaresecurity.com/fix/xss/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xss-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/xss-php-laravel.zip", "weakness": { "key": "xss", "title": "Cross-site scripting (XSS)", "url": "https://softwaresecurity.com/fix/xss/" }, "identifiers": { "cwe": [ "CWE-79" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-63" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (Blade)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xss/php-laravel/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "php.lang.security.injection.echoed-request.echoed-request" }, { "tool": "Psalm", "id": "TaintedHtml" } ] } }, { "key": "csv-formula-injection-node-express", "title": "Fix CSV formula injection in Node.js and Express", "url": "https://softwaresecurity.com/fix/csv-formula-injection/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csv-formula-injection-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/csv-formula-injection-node-express.zip", "weakness": { "key": "csv-formula-injection", "title": "CSV formula injection", "url": "https://softwaresecurity.com/fix/csv-formula-injection/" }, "identifiers": { "cwe": [ "CWE-1236" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csv-formula-injection/node-express/#scanner-rules", "rules": [] } }, { "key": "csv-formula-injection-python-flask", "title": "Fix CSV formula injection in Python and Flask", "url": "https://softwaresecurity.com/fix/csv-formula-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csv-formula-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/csv-formula-injection-python-flask.zip", "weakness": { "key": "csv-formula-injection", "title": "CSV formula injection", "url": "https://softwaresecurity.com/fix/csv-formula-injection/" }, "identifiers": { "cwe": [ "CWE-1236" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [], "asvs": [ "v5.0.0-1.2.10" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csv-formula-injection/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.injection.csv-writer-injection.csv-writer-injection" }, { "tool": "Semgrep", "id": "python.lang.security.use-defusedcsv.use-defusedcsv" } ] } }, { "key": "csv-formula-injection-java-spring", "title": "Fix CSV formula injection in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/csv-formula-injection/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csv-formula-injection-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/csv-formula-injection-java-spring.zip", "weakness": { "key": "csv-formula-injection", "title": "CSV formula injection", "url": "https://softwaresecurity.com/fix/csv-formula-injection/" }, "identifiers": { "cwe": [ "CWE-1236" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (spring-boot-starter-webmvc)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csv-formula-injection/java-spring/#scanner-rules", "rules": [] } }, { "key": "csv-formula-injection-csharp-aspnetcore", "title": "Fix CSV formula injection in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/csv-formula-injection/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csv-formula-injection-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/csv-formula-injection-csharp-aspnetcore.zip", "weakness": { "key": "csv-formula-injection", "title": "CSV formula injection", "url": "https://softwaresecurity.com/fix/csv-formula-injection/" }, "identifiers": { "cwe": [ "CWE-1236" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": "ASP.NET Core 10 minimal API on .NET 10.0.12", "framework": "ASP.NET Core 10 (minimal API)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csv-formula-injection/csharp-aspnetcore/#scanner-rules", "rules": [] } }, { "key": "csv-formula-injection-python-django", "title": "Fix CSV formula injection in Python and Django", "url": "https://softwaresecurity.com/fix/csv-formula-injection/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csv-formula-injection-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/csv-formula-injection-python-django.zip", "weakness": { "key": "csv-formula-injection", "title": "CSV formula injection", "url": "https://softwaresecurity.com/fix/csv-formula-injection/" }, "identifiers": { "cwe": [ "CWE-1236" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [], "asvs": [ "v5.0.0-1.2.10" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csv-formula-injection/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.csv-writer-injection.csv-writer-injection" }, { "tool": "Semgrep", "id": "python.lang.security.use-defusedcsv.use-defusedcsv" } ] } }, { "key": "csv-formula-injection-ruby-rails", "title": "Fix CSV formula injection in Ruby on Rails", "url": "https://softwaresecurity.com/fix/csv-formula-injection/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/csv-formula-injection-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/csv-formula-injection-ruby-rails.zip", "weakness": { "key": "csv-formula-injection", "title": "CSV formula injection", "url": "https://softwaresecurity.com/fix/csv-formula-injection/" }, "identifiers": { "cwe": [ "CWE-1236", "CWE-74" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (API controller, CSV.generate, send_data)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/csv-formula-injection/ruby-rails/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "rb/csv-injection" } ] } }, { "key": "ldap-injection-python-flask", "title": "Fix LDAP filter injection in Python and Flask", "url": "https://softwaresecurity.com/fix/ldap-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ldap-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/ldap-injection-python-flask.zip", "weakness": { "key": "ldap-injection", "title": "LDAP filter injection", "url": "https://softwaresecurity.com/fix/ldap-injection/" }, "identifiers": { "cwe": [ "CWE-90" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-136" ], "asvs": [ "v5.0.0-1.2.6" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ldap-injection/python-flask/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/ldap-injection" } ] } }, { "key": "ldap-injection-java-spring", "title": "Fix LDAP filter injection in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/ldap-injection/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/ldap-injection-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/ldap-injection-java-spring.zip", "weakness": { "key": "ldap-injection", "title": "LDAP filter injection", "url": "https://softwaresecurity.com/fix/ldap-injection/" }, "identifiers": { "cwe": [ "CWE-90" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-136" ], "asvs": [ "v5.0.0-1.2.6" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC, Spring LDAP 4.1.1)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/ldap-injection/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.ldap-injection.ldap-injection" }, { "tool": "Semgrep", "id": "java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request" }, { "tool": "CodeQL", "id": "java/ldap-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "LDAP_INJECTION" } ] } }, { "key": "nosql-injection-node-express", "title": "Fix NoSQL operator injection in Node.js and Express", "url": "https://softwaresecurity.com/fix/nosql-injection/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/nosql-injection-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/nosql-injection-node-express.zip", "weakness": { "key": "nosql-injection", "title": "NoSQL operator injection", "url": "https://softwaresecurity.com/fix/nosql-injection/" }, "identifiers": { "cwe": [ "CWE-943" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-676" ], "asvs": [ "v5.0.0-1.2.4", "v5.0.0-15.3.5" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0 with the MongoDB Node.js driver 7.7.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/nosql-injection/node-express/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "js/sql-injection" } ] } }, { "key": "nosql-injection-python-flask", "title": "Fix NoSQL operator injection in Python and Flask", "url": "https://softwaresecurity.com/fix/nosql-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/nosql-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/nosql-injection-python-flask.zip", "weakness": { "key": "nosql-injection", "title": "NoSQL operator injection", "url": "https://softwaresecurity.com/fix/nosql-injection/" }, "identifiers": { "cwe": [ "CWE-943" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-676" ], "asvs": [ "v5.0.0-1.2.4", "v5.0.0-15.3.5" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3 with PyMongo 4.18.2 (tests: mongomock 4.3.0)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/nosql-injection/python-flask/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/nosql-injection" } ] } }, { "key": "command-injection-node-express", "title": "Fix OS command and argument injection in Node.js and Express", "url": "https://softwaresecurity.com/fix/command-injection/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/command-injection-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/command-injection-node-express.zip", "weakness": { "key": "command-injection", "title": "OS command and argument injection", "url": "https://softwaresecurity.com/fix/command-injection/" }, "identifiers": { "cwe": [ "CWE-78", "CWE-88" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-88", "CAPEC-6" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1 (node:child_process is built in)", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/command-injection/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.lang.security.detect-child-process.detect-child-process" }, { "tool": "CodeQL", "id": "js/second-order-command-line-injection" }, { "tool": "CodeQL", "id": "js/shell-command-injection-from-environment" }, { "tool": "ESLint (security plugin)", "id": "security/detect-child-process" } ] } }, { "key": "command-injection-python-flask", "title": "Fix OS command and argument injection in Python and Flask", "url": "https://softwaresecurity.com/fix/command-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/command-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/command-injection-python-flask.zip", "weakness": { "key": "command-injection", "title": "OS command and argument injection", "url": "https://softwaresecurity.com/fix/command-injection/" }, "identifiers": { "cwe": [ "CWE-78", "CWE-88" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-88", "CAPEC-6" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python 3.14", "runtime": "CPython 3.14.8 (subprocess is in the standard library)", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/command-injection/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit" }, { "tool": "Semgrep", "id": "python.lang.security.audit.subprocess-shell-true.subprocess-shell-true" }, { "tool": "CodeQL", "id": "py/command-line-injection" }, { "tool": "Bandit", "id": "B602" } ] } }, { "key": "command-injection-java-spring", "title": "Fix OS command and argument injection in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/command-injection/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/command-injection-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/command-injection-java-spring.zip", "weakness": { "key": "command-injection", "title": "OS command and argument injection", "url": "https://softwaresecurity.com/fix/command-injection/" }, "identifiers": { "cwe": [ "CWE-78", "CWE-88" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-88", "CAPEC-6" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/command-injection/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.command-injection-process-builder.command-injection-process-builder" }, { "tool": "CodeQL", "id": "java/command-line-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "COMMAND_INJECTION" } ] } }, { "key": "command-injection-csharp-aspnetcore", "title": "Fix OS command and argument injection in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/command-injection/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/command-injection-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/command-injection-csharp-aspnetcore.zip", "weakness": { "key": "command-injection", "title": "OS command and argument injection", "url": "https://softwaresecurity.com/fix/command-injection/" }, "identifiers": { "cwe": [ "CWE-78", "CWE-88" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-88", "CAPEC-6" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/command-injection/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/command-line-injection" }, { "tool": ".NET code analysis", "id": "CA3006" } ] } }, { "key": "command-injection-typescript-nextjs", "title": "Fix OS command injection in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/command-injection/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/command-injection-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/command-injection-typescript-nextjs.zip", "weakness": { "key": "command-injection", "title": "OS command and argument injection", "url": "https://softwaresecurity.com/fix/command-injection/" }, "identifiers": { "cwe": [ "CWE-78", "CWE-88" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-88", "CAPEC-6" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript", "runtime": "Node.js 26.11.1 (route handlers use the default Node.js runtime; node:child_process is not available on the Edge runtime)", "framework": "Next.js 16.4.0 (App Router route handlers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/command-injection/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.lang.security.detect-child-process.detect-child-process" }, { "tool": "CodeQL", "id": "js/command-line-injection" }, { "tool": "CodeQL", "id": "js/second-order-command-line-injection" } ] } }, { "key": "command-injection-go-nethttp", "title": "Fix OS command and argument injection in Go and net/http", "url": "https://softwaresecurity.com/fix/command-injection/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/command-injection-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/command-injection-go-nethttp.zip", "weakness": { "key": "command-injection", "title": "OS command and argument injection", "url": "https://softwaresecurity.com/fix/command-injection/" }, "identifiers": { "cwe": [ "CWE-78", "CWE-88" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-88", "CAPEC-6" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, os/exec)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/command-injection/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd" }, { "tool": "Semgrep", "id": "go.lang.security.audit.dangerous-exec-command.dangerous-exec-command" }, { "tool": "CodeQL", "id": "go/command-injection" }, { "tool": "gosec", "id": "G204" }, { "tool": "gosec", "id": "G702" } ] } }, { "key": "template-injection-node-express", "title": "Fix server-side template injection in Node.js and Express", "url": "https://softwaresecurity.com/fix/template-injection/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/template-injection-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/template-injection-node-express.zip", "weakness": { "key": "template-injection", "title": "Server-side template injection", "url": "https://softwaresecurity.com/fix/template-injection/" }, "identifiers": { "cwe": [ "CWE-1336", "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/template-injection/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.lang.security.audit.code-string-concat.code-string-concat" }, { "tool": "CodeQL", "id": "js/code-injection" } ] } }, { "key": "template-injection-python-flask", "title": "Fix server-side template injection in Python and Flask", "url": "https://softwaresecurity.com/fix/template-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/template-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/template-injection-python-flask.zip", "weakness": { "key": "template-injection", "title": "Server-side template injection", "url": "https://softwaresecurity.com/fix/template-injection/" }, "identifiers": { "cwe": [ "CWE-1336", "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3 (Jinja2 3.1.6)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/template-injection/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.audit.render-template-string.render-template-string" }, { "tool": "Semgrep", "id": "python.flask.security.dangerous-template-string.dangerous-template-string" }, { "tool": "CodeQL", "id": "py/code-injection" }, { "tool": "CodeQL", "id": "py/template-injection" }, { "tool": "Bandit", "id": "B701" } ] } }, { "key": "template-injection-java-spring", "title": "Fix server-side template (SpEL) injection in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/template-injection/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/template-injection-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/template-injection-java-spring.zip", "weakness": { "key": "template-injection", "title": "Server-side template injection", "url": "https://softwaresecurity.com/fix/template-injection/" }, "identifiers": { "cwe": [ "CWE-1336", "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, SpEL / spring-expression)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/template-injection/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.spring.security.audit.spel-injection.spel-injection" }, { "tool": "CodeQL", "id": "java/server-side-template-injection" }, { "tool": "CodeQL", "id": "java/spel-expression-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPEL_INJECTION" } ] } }, { "key": "template-injection-csharp-aspnetcore", "title": "Fix server-side template injection in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/template-injection/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/template-injection-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/template-injection-csharp-aspnetcore.zip", "weakness": { "key": "template-injection", "title": "Server-side template injection", "url": "https://softwaresecurity.com/fix/template-injection/" }, "identifiers": { "cwe": [ "CWE-1336", "CWE-94", "CWE-95" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-242" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/template-injection/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/code-injection" } ] } }, { "key": "sql-injection-node-express", "title": "Fix SQL injection in Node.js and Express", "url": "https://softwaresecurity.com/fix/sql-injection/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-node-express.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag)", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.injection.tainted-sql-string.tainted-sql-string" }, { "tool": "CodeQL", "id": "js/sql-injection" } ] } }, { "key": "sql-injection-python-flask", "title": "Fix SQL injection in Python and Flask", "url": "https://softwaresecurity.com/fix/sql-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-python-flask.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.injection.tainted-sql-string.tainted-sql-string" }, { "tool": "Semgrep", "id": "python.lang.security.audit.formatted-sql-query.formatted-sql-query" }, { "tool": "CodeQL", "id": "py/sql-injection" }, { "tool": "Bandit", "id": "B608" } ] } }, { "key": "sql-injection-java-spring", "title": "Fix SQL injection in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/sql-injection/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-java-spring.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.spring.security.audit.spring-sqli.spring-sqli" }, { "tool": "Semgrep", "id": "java.spring.security.injection.tainted-sql-string.tainted-sql-string" }, { "tool": "CodeQL", "id": "java/concatenated-sql-query" }, { "tool": "CodeQL", "id": "java/sql-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SQL_INJECTION_SPRING_JDBC" } ] } }, { "key": "sql-injection-csharp-aspnetcore", "title": "Fix SQL injection in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/sql-injection/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-csharp-aspnetcore.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.lang.security.sqli.csharp-sqli.csharp-sqli" }, { "tool": "CodeQL", "id": "cs/sql-injection" }, { "tool": ".NET code analysis", "id": "CA2100" } ] } }, { "key": "sql-injection-typescript-nextjs", "title": "Fix SQL injection in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/sql-injection/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-typescript-nextjs.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript", "runtime": "Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag; route handlers use the default Node.js runtime)", "framework": "Next.js 16.4.0 (App Router route handlers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "js/sql-injection" } ] } }, { "key": "sql-injection-python-fastapi", "title": "Fix SQL injection in Python and FastAPI", "url": "https://softwaresecurity.com/fix/sql-injection/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-python-fastapi.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5) with SQLAlchemy 2.0.54" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/python-fastapi/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.audit.formatted-sql-query.formatted-sql-query" }, { "tool": "Semgrep", "id": "python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text" }, { "tool": "Semgrep", "id": "python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query" }, { "tool": "CodeQL", "id": "py/sql-injection" }, { "tool": "Bandit", "id": "B608" } ] } }, { "key": "sql-injection-python-django", "title": "Fix SQL injection in Python and Django", "url": "https://softwaresecurity.com/fix/sql-injection/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-python-django.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (ORM over SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute" }, { "tool": "Semgrep", "id": "python.lang.security.audit.formatted-sql-query.formatted-sql-query" }, { "tool": "Semgrep", "id": "python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query" }, { "tool": "CodeQL", "id": "py/sql-injection" }, { "tool": "Bandit", "id": "B608" } ] } }, { "key": "sql-injection-go-nethttp", "title": "Fix SQL injection in Go and net/http", "url": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-go-nethttp.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, database/sql) with modernc.org/sqlite 1.60.1" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.audit.database.string-formatted-query.string-formatted-query" }, { "tool": "Semgrep", "id": "go.lang.security.audit.sqli.gosql-sqli.gosql-sqli" }, { "tool": "Semgrep", "id": "go.lang.security.injection.tainted-sql-string.tainted-sql-string" }, { "tool": "CodeQL", "id": "go/sql-injection" }, { "tool": "gosec", "id": "G201" }, { "tool": "gosec", "id": "G202" }, { "tool": "gosec", "id": "G701" } ] } }, { "key": "sql-injection-ruby-rails", "title": "Fix SQL injection in Ruby on Rails", "url": "https://softwaresecurity.com/fix/sql-injection/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-ruby-rails.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (Active Record over SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/ruby-rails/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-sql.check-sql" }, { "tool": "Semgrep", "id": "ruby.rails.security.injection.tainted-sql-string.tainted-sql-string" }, { "tool": "CodeQL", "id": "rb/sql-injection" }, { "tool": "Brakeman", "id": "SQL" } ] } }, { "key": "sql-injection-php-laravel", "title": "Fix SQL injection in PHP and Laravel", "url": "https://softwaresecurity.com/fix/sql-injection/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/sql-injection-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/sql-injection-php-laravel.zip", "weakness": { "key": "sql-injection", "title": "SQL injection", "url": "https://softwaresecurity.com/fix/sql-injection/" }, "identifiers": { "cwe": [ "CWE-89" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-66" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (query builder over SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/sql-injection/php-laravel/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "php.lang.security.injection.tainted-sql-string.tainted-sql-string" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-sql-injection.laravel-sql-injection" }, { "tool": "Psalm", "id": "TaintedSql" } ] } }, { "key": "xpath-injection-python-flask", "title": "Fix XPath injection in Python and Flask", "url": "https://softwaresecurity.com/fix/xpath-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xpath-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/xpath-injection-python-flask.zip", "weakness": { "key": "xpath-injection", "title": "XPath injection", "url": "https://softwaresecurity.com/fix/xpath-injection/" }, "identifiers": { "cwe": [ "CWE-643" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [ "CAPEC-83" ], "asvs": [ "v5.0.0-1.2.7" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xpath-injection/python-flask/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/xpath-injection" } ] } }, { "key": "xpath-injection-java-spring", "title": "Fix XPath injection in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/xpath-injection/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xpath-injection-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/xpath-injection-java-spring.zip", "weakness": { "key": "xpath-injection", "title": "XPath injection", "url": "https://softwaresecurity.com/fix/xpath-injection/" }, "identifiers": { "cwe": [ "CWE-643", "CWE-91" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (javax.xml.xpath)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xpath-injection/java-spring/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "java/xml/xpath-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "XPATH_INJECTION" } ] } }, { "key": "xpath-injection-csharp-aspnetcore", "title": "Fix XPath injection in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/xpath-injection/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/xpath-injection-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/xpath-injection-csharp-aspnetcore.zip", "weakness": { "key": "xpath-injection", "title": "XPath injection", "url": "https://softwaresecurity.com/fix/xpath-injection/" }, "identifiers": { "cwe": [ "CWE-643", "CWE-91" ], "owaspTop10_2025": [ "A05:2025" ], "capec": [] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": "ASP.NET Core 10 minimal API on .NET 10.0.12", "framework": "ASP.NET Core 10 (minimal API); System.Xml.XPath" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/xpath-injection/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.dotnet.security.audit.xpath-injection.xpath-injection" }, { "tool": "CodeQL", "id": "cs/xml/xpath-injection" } ] } }, { "key": "clickjacking-node-express", "title": "Fix clickjacking in Node.js and Express", "url": "https://softwaresecurity.com/fix/clickjacking/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/clickjacking-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/clickjacking-node-express.zip", "weakness": { "key": "clickjacking", "title": "Clickjacking", "url": "https://softwaresecurity.com/fix/clickjacking/" }, "identifiers": { "cwe": [ "CWE-1021" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-103", "CAPEC-222" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/clickjacking/node-express/#scanner-rules", "rules": [] } }, { "key": "clickjacking-python-flask", "title": "Fix clickjacking in Python and Flask", "url": "https://softwaresecurity.com/fix/clickjacking/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/clickjacking-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/clickjacking-python-flask.zip", "weakness": { "key": "clickjacking", "title": "Clickjacking", "url": "https://softwaresecurity.com/fix/clickjacking/" }, "identifiers": { "cwe": [ "CWE-1021" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-103" ], "asvs": [ "v5.0.0-3.4.6" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/clickjacking/python-flask/#scanner-rules", "rules": [] } }, { "key": "clickjacking-typescript-nextjs", "title": "Fix clickjacking in Next.js", "url": "https://softwaresecurity.com/fix/clickjacking/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/clickjacking-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/clickjacking-typescript-nextjs.zip", "weakness": { "key": "clickjacking", "title": "Clickjacking", "url": "https://softwaresecurity.com/fix/clickjacking/" }, "identifiers": { "cwe": [ "CWE-1021" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-103", "CAPEC-222" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript (Next.js App Router, middleware)", "runtime": "Node.js 26.11.1 (middleware runs on the Node.js runtime)", "framework": "Next.js 16.4.0 (middleware)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/clickjacking/typescript-nextjs/#scanner-rules", "rules": [] } }, { "key": "clickjacking-python-django", "title": "Fix clickjacking in Python and Django", "url": "https://softwaresecurity.com/fix/clickjacking/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/clickjacking-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/clickjacking-python-django.zip", "weakness": { "key": "clickjacking", "title": "Clickjacking", "url": "https://softwaresecurity.com/fix/clickjacking/" }, "identifiers": { "cwe": [ "CWE-1021" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-103" ], "asvs": [ "v5.0.0-3.4.6" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (XFrameOptionsMiddleware, ContentSecurityPolicyMiddleware)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/clickjacking/python-django/#scanner-rules", "rules": [] } }, { "key": "regex-dos-node-express", "title": "Fix ReDoS in Node.js and Express", "url": "https://softwaresecurity.com/fix/regex-dos/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/regex-dos-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/regex-dos-node-express.zip", "weakness": { "key": "regex-dos", "title": "Regular-expression denial of service (ReDoS)", "url": "https://softwaresecurity.com/fix/regex-dos/" }, "identifiers": { "cwe": [ "CWE-1333" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-492" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/regex-dos/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp" }, { "tool": "CodeQL", "id": "js/redos" }, { "tool": "SonarQube", "id": "S5852" } ] } }, { "key": "regex-dos-python-flask", "title": "Fix ReDoS in Python and Flask", "url": "https://softwaresecurity.com/fix/regex-dos/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/regex-dos-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/regex-dos-python-flask.zip", "weakness": { "key": "regex-dos", "title": "Regular-expression denial of service (ReDoS)", "url": "https://softwaresecurity.com/fix/regex-dos/" }, "identifiers": { "cwe": [ "CWE-1333" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-492" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/regex-dos/python-flask/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/redos" } ] } }, { "key": "regex-dos-java-spring", "title": "Fix ReDoS in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/regex-dos/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/regex-dos-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/regex-dos-java-spring.zip", "weakness": { "key": "regex-dos", "title": "Regular-expression denial of service (ReDoS)", "url": "https://softwaresecurity.com/fix/regex-dos/" }, "identifiers": { "cwe": [ "CWE-1333" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-492" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/regex-dos/java-spring/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "java/redos" }, { "tool": "SonarQube", "id": "S5852" } ] } }, { "key": "regex-dos-csharp-aspnetcore", "title": "Fix ReDoS in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/regex-dos/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/regex-dos-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/regex-dos-csharp-aspnetcore.zip", "weakness": { "key": "regex-dos", "title": "Regular-expression denial of service (ReDoS)", "url": "https://softwaresecurity.com/fix/regex-dos/" }, "identifiers": { "cwe": [ "CWE-1333" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-492" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/regex-dos/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/redos" }, { "tool": "SonarQube", "id": "S2631" } ] } }, { "key": "resource-limits-node-express", "title": "Fix unbounded resource consumption in Node.js and Express", "url": "https://softwaresecurity.com/fix/resource-limits/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/resource-limits-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/resource-limits-node-express.zip", "weakness": { "key": "resource-limits", "title": "Unbounded resource consumption", "url": "https://softwaresecurity.com/fix/resource-limits/" }, "identifiers": { "cwe": [ "CWE-770", "CWE-400" ], "owaspTop10_2025": [ "A06:2025" ], "owaspApiTop10_2023": [ "API4:2023" ], "capec": [ "CAPEC-130", "CAPEC-125" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/resource-limits/node-express/#scanner-rules", "rules": [] } }, { "key": "resource-limits-csharp-aspnetcore", "title": "Fix unbounded resource consumption in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/resource-limits/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/resource-limits-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/resource-limits-csharp-aspnetcore.zip", "weakness": { "key": "resource-limits", "title": "Unbounded resource consumption", "url": "https://softwaresecurity.com/fix/resource-limits/" }, "identifiers": { "cwe": [ "CWE-770", "CWE-400" ], "owaspTop10_2025": [ "A06:2025" ], "owaspApiTop10_2023": [ "API4:2023" ], "capec": [ "CAPEC-130", "CAPEC-125" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": "ASP.NET Core 10 minimal API on .NET 10.0.12", "framework": "ASP.NET Core 10 (minimal API); Microsoft.AspNetCore.RateLimiting" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/resource-limits/csharp-aspnetcore/#scanner-rules", "rules": [] } }, { "key": "resource-limits-python-fastapi", "title": "Fix missing resource limits in Python and FastAPI", "url": "https://softwaresecurity.com/fix/resource-limits/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/resource-limits-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/resource-limits-python-fastapi.zip", "weakness": { "key": "resource-limits", "title": "Unbounded resource consumption", "url": "https://softwaresecurity.com/fix/resource-limits/" }, "identifiers": { "cwe": [ "CWE-770", "CWE-400" ], "owaspTop10_2025": [ "A06:2025" ], "owaspApiTop10_2023": [ "API4:2023" ], "capec": [ "CAPEC-130", "CAPEC-125" ], "asvs": [ "v5.0.0-15.2.2", "v5.0.0-2.4.1" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/resource-limits/python-fastapi/#scanner-rules", "rules": [] } }, { "key": "resource-limits-go-nethttp", "title": "Fix missing resource limits in Go and net/http", "url": "https://softwaresecurity.com/fix/resource-limits/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/resource-limits-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/resource-limits-go-nethttp.zip", "weakness": { "key": "resource-limits", "title": "Unbounded resource consumption", "url": "https://softwaresecurity.com/fix/resource-limits/" }, "identifiers": { "cwe": [ "CWE-770", "CWE-400" ], "owaspTop10_2025": [ "A06:2025" ], "owaspApiTop10_2023": [ "API4:2023" ], "capec": [ "CAPEC-130", "CAPEC-469", "CAPEC-488" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http: MaxBytesReader, http.Server timeouts)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/resource-limits/go-nethttp/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "go/uncontrolled-allocation-size" } ] } }, { "key": "file-upload-node-express", "title": "Fix unrestricted file upload in Node.js and Express", "url": "https://softwaresecurity.com/fix/file-upload/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-node-express.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename" }, { "tool": "CodeQL", "id": "js/http-to-file-access" }, { "tool": "CodeQL", "id": "js/path-injection" } ] } }, { "key": "file-upload-python-flask", "title": "Fix unrestricted file upload in Python and Flask", "url": "https://softwaresecurity.com/fix/file-upload/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-python-flask.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.injection.path-traversal-open.path-traversal-open" }, { "tool": "CodeQL", "id": "py/path-injection" } ] } }, { "key": "file-upload-java-spring", "title": "Fix unrestricted file upload in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/file-upload/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-java-spring.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC on Tomcat 11.0.26)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.spring.security.injection.tainted-file-path.tainted-file-path" }, { "tool": "CodeQL", "id": "java/path-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "FILE_UPLOAD_FILENAME" } ] } }, { "key": "file-upload-csharp-aspnetcore", "title": "Fix unrestricted file upload in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/file-upload/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-csharp-aspnetcore.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine" }, { "tool": "CodeQL", "id": "cs/path-injection" }, { "tool": "CodeQL", "id": "cs/web/file-upload" }, { "tool": ".NET code analysis", "id": "CA3003" } ] } }, { "key": "file-upload-typescript-nextjs", "title": "Fix unrestricted file upload in Next.js", "url": "https://softwaresecurity.com/fix/file-upload/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-typescript-nextjs.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-650" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript (Next.js App Router route handlers)", "runtime": "Node.js 26.11.1 (route handlers use the default Node.js runtime)", "framework": "Next.js 16.4.0 (App Router route handlers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "js/http-to-file-access" } ] } }, { "key": "file-upload-python-fastapi", "title": "Fix unrestricted file upload in Python and FastAPI", "url": "https://softwaresecurity.com/fix/file-upload/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-python-fastapi.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/python-fastapi/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/path-injection" } ] } }, { "key": "file-upload-python-django", "title": "Fix unrestricted file upload in Python and Django", "url": "https://softwaresecurity.com/fix/file-upload/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-python-django.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (request.FILES, FileResponse, django.views.static.serve)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/python-django/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/path-injection" } ] } }, { "key": "file-upload-go-nethttp", "title": "Fix unrestricted file upload in Go and net/http", "url": "https://softwaresecurity.com/fix/file-upload/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-go-nethttp.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http multipart, http.MaxBytesReader, crypto/rand)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/go-nethttp/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "go/path-injection" } ] } }, { "key": "file-upload-ruby-rails", "title": "Fix unrestricted file upload in Ruby on Rails", "url": "https://softwaresecurity.com/fix/file-upload/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-ruby-rails.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (API controller, ActionDispatch::Http::UploadedFile, send_file)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/ruby-rails/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "rb/path-injection" }, { "tool": "Brakeman", "id": "FileAccess" }, { "tool": "Brakeman", "id": "SendFile" } ] } }, { "key": "file-upload-php-laravel", "title": "Fix unrestricted file upload in PHP and Laravel", "url": "https://softwaresecurity.com/fix/file-upload/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/file-upload-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/file-upload-php-laravel.zip", "weakness": { "key": "file-upload", "title": "Unrestricted file upload", "url": "https://softwaresecurity.com/fix/file-upload/" }, "identifiers": { "cwe": [ "CWE-434", "CWE-646", "CWE-73", "CWE-770" ], "owaspTop10_2025": [ "A06:2025" ], "capec": [ "CAPEC-1", "CAPEC-209", "CAPEC-635", "CAPEC-650" ], "asvs": [ "v5.0.0-5.2.1", "v5.0.0-5.2.2", "v5.0.0-5.3.1", "v5.0.0-5.3.2", "v5.0.0-5.4.1", "v5.0.0-3.2.1", "v5.0.0-3.4.4" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (validation rules mimes, extensions and max; UploadedFile::store; Storage)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/file-upload/php-laravel/#scanner-rules", "rules": [] } }, { "key": "hardcoded-secrets-node-express", "title": "Fix hard-coded secrets in Node.js and Express", "url": "https://softwaresecurity.com/fix/hardcoded-secrets/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/hardcoded-secrets-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/hardcoded-secrets-node-express.zip", "weakness": { "key": "hardcoded-secrets", "title": "Hard-coded secrets", "url": "https://softwaresecurity.com/fix/hardcoded-secrets/" }, "identifiers": { "cwe": [ "CWE-798", "CWE-260" ], "owaspTop10_2025": [ "A07:2025", "A02:2025" ], "capec": [ "CAPEC-191" ], "asvs": [ "v5.0.0-13.3.1", "v5.0.0-14.2.1", "v5.0.0-16.2.5", "v5.0.0-16.5.1" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/hardcoded-secrets/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "generic.secrets.gitleaks.generic-api-key.generic-api-key" }, { "tool": "Semgrep", "id": "generic.secrets.security.detected-generic-api-key.detected-generic-api-key" }, { "tool": "CodeQL", "id": "js/clear-text-logging" }, { "tool": "CodeQL", "id": "js/hardcoded-credentials" }, { "tool": "detect-secrets", "id": "KeywordDetector" } ] } }, { "key": "hardcoded-secrets-python-flask", "title": "Fix hard-coded secrets in Python and Flask", "url": "https://softwaresecurity.com/fix/hardcoded-secrets/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/hardcoded-secrets-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/hardcoded-secrets-python-flask.zip", "weakness": { "key": "hardcoded-secrets", "title": "Hard-coded secrets", "url": "https://softwaresecurity.com/fix/hardcoded-secrets/" }, "identifiers": { "cwe": [ "CWE-798", "CWE-261" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-191" ], "asvs": [ "v5.0.0-13.3.1", "v5.0.0-14.2.1", "v5.0.0-16.2.5", "v5.0.0-16.5.1" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/hardcoded-secrets/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "generic.secrets.gitleaks.generic-api-key.generic-api-key" }, { "tool": "Semgrep", "id": "generic.secrets.security.detected-generic-api-key.detected-generic-api-key" }, { "tool": "Semgrep", "id": "python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure" }, { "tool": "CodeQL", "id": "py/clear-text-logging-sensitive-data" }, { "tool": "CodeQL", "id": "py/hardcoded-credentials" }, { "tool": "Bandit", "id": "B105" }, { "tool": "detect-secrets", "id": "KeywordDetector" } ] } }, { "key": "hardcoded-secrets-java-spring", "title": "Fix hard-coded secrets in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/hardcoded-secrets/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/hardcoded-secrets-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/hardcoded-secrets-java-spring.zip", "weakness": { "key": "hardcoded-secrets", "title": "Hard-coded secrets", "url": "https://softwaresecurity.com/fix/hardcoded-secrets/" }, "identifiers": { "cwe": [ "CWE-798", "CWE-260" ], "owaspTop10_2025": [ "A07:2025", "A02:2025" ], "capec": [ "CAPEC-191" ], "asvs": [ "v5.0.0-13.3.1", "v5.0.0-14.2.1", "v5.0.0-16.2.5", "v5.0.0-16.5.1" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC, RestClient)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/hardcoded-secrets/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "generic.secrets.gitleaks.generic-api-key.generic-api-key" }, { "tool": "Semgrep", "id": "generic.secrets.security.detected-generic-api-key.detected-generic-api-key" }, { "tool": "CodeQL", "id": "java/hardcoded-credential-api-call" }, { "tool": "CodeQL", "id": "java/sensitive-log" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "HARD_CODE_PASSWORD" }, { "tool": "detect-secrets", "id": "KeywordDetector" } ] } }, { "key": "hardcoded-secrets-csharp-aspnetcore", "title": "Fix hard-coded secrets in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/hardcoded-secrets/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/hardcoded-secrets-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/hardcoded-secrets-csharp-aspnetcore.zip", "weakness": { "key": "hardcoded-secrets", "title": "Hard-coded secrets", "url": "https://softwaresecurity.com/fix/hardcoded-secrets/" }, "identifiers": { "cwe": [ "CWE-798", "CWE-260" ], "owaspTop10_2025": [ "A07:2025", "A02:2025" ], "capec": [ "CAPEC-191" ], "asvs": [ "v5.0.0-13.3.1", "v5.0.0-14.2.1", "v5.0.0-16.2.5", "v5.0.0-16.5.1" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12)", "framework": "ASP.NET Core 10 minimal API with the options pattern and IHttpClientFactory" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/hardcoded-secrets/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "generic.secrets.gitleaks.generic-api-key.generic-api-key" }, { "tool": "Semgrep", "id": "generic.secrets.security.detected-generic-api-key.detected-generic-api-key" }, { "tool": "CodeQL", "id": "cs/cleartext-storage-of-sensitive-information" }, { "tool": "CodeQL", "id": "cs/hardcoded-credentials" }, { "tool": ".NET code analysis", "id": "CA5390" }, { "tool": "detect-secrets", "id": "KeywordDetector" } ] } }, { "key": "tls-certificate-validation-node-express", "title": "Fix TLS certificate validation in Node.js and Express", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/tls-certificate-validation-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/tls-certificate-validation-node-express.zip", "weakness": { "key": "tls-certificate-validation", "title": "Improper TLS certificate validation", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/" }, "identifiers": { "cwe": [ "CWE-295", "CWE-297", "CWE-296" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-94", "CAPEC-459", "CAPEC-475" ], "asvs": [ "v5.0.0-12.3.2", "v5.0.0-12.3.4" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/tls-certificate-validation/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification" }, { "tool": "CodeQL", "id": "js/disabling-certificate-validation" } ] } }, { "key": "tls-certificate-validation-python-flask", "title": "Fix TLS certificate validation in Python and Flask", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/tls-certificate-validation-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/tls-certificate-validation-python-flask.zip", "weakness": { "key": "tls-certificate-validation", "title": "Improper TLS certificate validation", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/" }, "identifiers": { "cwe": [ "CWE-295", "CWE-297", "CWE-296" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-94", "CAPEC-459", "CAPEC-475" ], "asvs": [ "v5.0.0-12.3.2", "v5.0.0-12.3.4" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/tls-certificate-validation/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation" }, { "tool": "Semgrep", "id": "python.requests.security.disabled-cert-validation.disabled-cert-validation" }, { "tool": "CodeQL", "id": "py/request-without-cert-validation" }, { "tool": "Bandit", "id": "B501" } ] } }, { "key": "tls-certificate-validation-java-spring", "title": "Fix TLS certificate validation in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/tls-certificate-validation-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/tls-certificate-validation-java-spring.zip", "weakness": { "key": "tls-certificate-validation", "title": "Improper TLS certificate validation", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/" }, "identifiers": { "cwe": [ "CWE-295", "CWE-297", "CWE-296" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-94", "CAPEC-459", "CAPEC-475" ], "asvs": [ "v5.0.0-12.3.2", "v5.0.0-12.3.4" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC, RestClient)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager" }, { "tool": "Semgrep", "id": "java.lang.security.audit.weak-ssl-context.weak-ssl-context" }, { "tool": "Semgrep", "id": "problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification" }, { "tool": "CodeQL", "id": "java/insecure-trustmanager" }, { "tool": "CodeQL", "id": "java/unsafe-hostname-verification" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "WEAK_TRUST_MANAGER" } ] } }, { "key": "tls-certificate-validation-csharp-aspnetcore", "title": "Fix TLS certificate validation in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/tls-certificate-validation-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/tls-certificate-validation-csharp-aspnetcore.zip", "weakness": { "key": "tls-certificate-validation", "title": "Improper TLS certificate validation", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/" }, "identifiers": { "cwe": [ "CWE-295", "CWE-297", "CWE-296" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-94", "CAPEC-459", "CAPEC-475" ], "asvs": [ "v5.0.0-12.3.2", "v5.0.0-12.3.4" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C#", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API with IHttpClientFactory" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/tls-certificate-validation/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": ".NET code analysis", "id": "CA5359" } ] } }, { "key": "tls-certificate-validation-go-nethttp", "title": "Fix TLS certificate validation in Go and net/http", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/tls-certificate-validation-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/tls-certificate-validation-go-nethttp.zip", "weakness": { "key": "tls-certificate-validation", "title": "Improper TLS certificate validation", "url": "https://softwaresecurity.com/fix/tls-certificate-validation/" }, "identifiers": { "cwe": [ "CWE-295", "CWE-297", "CWE-296" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-94", "CAPEC-459", "CAPEC-475" ], "asvs": [ "v5.0.0-12.3.2", "v5.0.0-12.3.4" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http client, crypto/tls, crypto/x509)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion" }, { "tool": "Semgrep", "id": "problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification" }, { "tool": "CodeQL", "id": "go/disabled-certificate-check" }, { "tool": "CodeQL", "id": "go/insecure-tls" }, { "tool": "gosec", "id": "G123" }, { "tool": "gosec", "id": "G402" } ] } }, { "key": "jwt-validation-node-express", "title": "Fix JWT validation in Node.js and Express", "url": "https://softwaresecurity.com/fix/jwt-validation/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/jwt-validation-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/jwt-validation-node-express.zip", "weakness": { "key": "jwt-validation", "title": "JWT validation in APIs (bearer tokens)", "url": "https://softwaresecurity.com/fix/jwt-validation/" }, "identifiers": { "cwe": [ "CWE-347", "CWE-287" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-475", "CAPEC-196" ], "asvs": [ "v5.0.0-9.1.1", "v5.0.0-9.1.2", "v5.0.0-9.1.3", "v5.0.0-9.2.1", "v5.0.0-9.2.3", "v5.0.0-10.3.1", "v5.0.0-10.3.3" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/jwt-validation/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.jose.security.jwt-none-alg.jwt-none-alg" }, { "tool": "Semgrep", "id": "javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify" }, { "tool": "CodeQL", "id": "js/decode-jwt-without-verification" }, { "tool": "CodeQL", "id": "js/jwt-missing-verification" } ] } }, { "key": "jwt-validation-python-flask", "title": "Fix JWT validation in Python and Flask", "url": "https://softwaresecurity.com/fix/jwt-validation/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/jwt-validation-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/jwt-validation-python-flask.zip", "weakness": { "key": "jwt-validation", "title": "JWT validation in APIs (bearer tokens)", "url": "https://softwaresecurity.com/fix/jwt-validation/" }, "identifiers": { "cwe": [ "CWE-347", "CWE-287" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-475", "CAPEC-196" ], "asvs": [ "v5.0.0-9.1.1", "v5.0.0-9.1.2", "v5.0.0-9.1.3", "v5.0.0-9.2.1", "v5.0.0-9.2.3", "v5.0.0-10.3.1", "v5.0.0-10.3.3" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/jwt-validation/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.jwt.security.jwt-none-alg.jwt-python-none-alg" }, { "tool": "Semgrep", "id": "python.jwt.security.unverified-jwt-decode.unverified-jwt-decode" }, { "tool": "CodeQL", "id": "py/jwt-missing-verification" } ] } }, { "key": "jwt-validation-java-spring", "title": "Fix JWT validation in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/jwt-validation/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/jwt-validation-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/jwt-validation-java-spring.zip", "weakness": { "key": "jwt-validation", "title": "JWT validation in APIs (bearer tokens)", "url": "https://softwaresecurity.com/fix/jwt-validation/" }, "identifiers": { "cwe": [ "CWE-347", "CWE-287" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-475", "CAPEC-196" ], "asvs": [ "v5.0.0-9.1.1", "v5.0.0-9.1.2", "v5.0.0-9.1.3", "v5.0.0-9.2.1", "v5.0.0-9.2.3", "v5.0.0-10.3.1", "v5.0.0-10.3.3" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Security 7.1.1 OAuth2 resource server, Spring Framework 7.0.9, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/jwt-validation/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify" }, { "tool": "CodeQL", "id": "java/missing-jwt-signature-check" } ] } }, { "key": "jwt-validation-csharp-aspnetcore", "title": "Fix JWT validation in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/jwt-validation-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/jwt-validation-csharp-aspnetcore.zip", "weakness": { "key": "jwt-validation", "title": "JWT validation in APIs (bearer tokens)", "url": "https://softwaresecurity.com/fix/jwt-validation/" }, "identifiers": { "cwe": [ "CWE-347", "CWE-287" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-475", "CAPEC-196" ], "asvs": [ "v5.0.0-9.1.1", "v5.0.0-9.1.2", "v5.0.0-9.1.3", "v5.0.0-9.2.1", "v5.0.0-9.2.3", "v5.0.0-10.3.1", "v5.0.0-10.3.3" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12)", "framework": "ASP.NET Core 10 minimal API with JWT bearer authentication" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation" }, { "tool": "Semgrep", "id": "csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token" }, { "tool": "CodeQL", "id": "cs/json-webtoken-handler/delegated-security-validations-always-return-true" }, { "tool": "CodeQL", "id": "cs/json-webtoken-handler/security-validations-disabled" }, { "tool": ".NET code analysis", "id": "CA5404" }, { "tool": ".NET code analysis", "id": "CA5405" } ] } }, { "key": "jwt-validation-typescript-nextjs", "title": "Fix JWT validation in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/jwt-validation/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/jwt-validation-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/jwt-validation-typescript-nextjs.zip", "weakness": { "key": "jwt-validation", "title": "JWT validation in APIs (bearer tokens)", "url": "https://softwaresecurity.com/fix/jwt-validation/" }, "identifiers": { "cwe": [ "CWE-347", "CWE-287" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-475", "CAPEC-196" ], "asvs": [ "v5.0.0-9.1.1", "v5.0.0-9.1.2", "v5.0.0-9.1.3", "v5.0.0-9.2.1", "v5.0.0-9.2.3", "v5.0.0-10.3.1", "v5.0.0-10.3.3" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript", "runtime": "Node.js 26.11.1 (the route handler uses the default Node.js runtime; jose also runs on the Edge runtime)", "framework": "Next.js 16.4.0 (App Router route handlers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/jwt-validation/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.jose.security.jwt-none-alg.jwt-none-alg" }, { "tool": "Semgrep", "id": "javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify" }, { "tool": "CodeQL", "id": "js/decode-jwt-without-verification" } ] } }, { "key": "jwt-validation-python-fastapi", "title": "Fix JWT validation in Python and FastAPI", "url": "https://softwaresecurity.com/fix/jwt-validation/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/jwt-validation-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/jwt-validation-python-fastapi.zip", "weakness": { "key": "jwt-validation", "title": "JWT validation in APIs (bearer tokens)", "url": "https://softwaresecurity.com/fix/jwt-validation/" }, "identifiers": { "cwe": [ "CWE-347", "CWE-287" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-475", "CAPEC-196" ], "asvs": [ "v5.0.0-9.1.1", "v5.0.0-9.1.2", "v5.0.0-9.1.3", "v5.0.0-9.2.1", "v5.0.0-9.2.3", "v5.0.0-10.3.1", "v5.0.0-10.3.3" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0) with an HTTPBearer dependency" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/jwt-validation/python-fastapi/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.jwt.security.jwt-none-alg.jwt-python-none-alg" }, { "tool": "Semgrep", "id": "python.jwt.security.unverified-jwt-decode.unverified-jwt-decode" }, { "tool": "Semgrep", "id": "python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure" }, { "tool": "CodeQL", "id": "py/jwt-missing-verification" } ] } }, { "key": "jwt-validation-go-nethttp", "title": "Fix JWT validation in Go and net/http", "url": "https://softwaresecurity.com/fix/jwt-validation/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/jwt-validation-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/jwt-validation-go-nethttp.zip", "weakness": { "key": "jwt-validation", "title": "JWT validation in APIs (bearer tokens)", "url": "https://softwaresecurity.com/fix/jwt-validation/" }, "identifiers": { "cwe": [ "CWE-347", "CWE-287" ], "owaspTop10_2025": [ "A07:2025", "A04:2025" ], "capec": [ "CAPEC-475", "CAPEC-196" ], "asvs": [ "v5.0.0-9.1.1", "v5.0.0-9.1.2", "v5.0.0-9.1.3", "v5.0.0-9.2.1", "v5.0.0-9.2.3", "v5.0.0-10.3.1", "v5.0.0-10.3.3" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http) with golang-jwt/jwt v5.3.1" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/jwt-validation/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified" }, { "tool": "CodeQL", "id": "go/missing-jwt-signature-check" } ] } }, { "key": "missing-authentication-node-express", "title": "Fix missing authentication for a critical function in Node.js and Express", "url": "https://softwaresecurity.com/fix/missing-authentication/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-node-express.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306", "CWE-287" ], "owaspTop10_2025": [ "A07:2025" ], "owaspApiTop10_2023": [ "API2:2023" ], "capec": [ "CAPEC-12" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1 (node:sqlite needs 22.13.0 or later without a flag)", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/node-express/#scanner-rules", "rules": [] } }, { "key": "missing-authentication-python-flask", "title": "Fix missing authentication in Python and Flask", "url": "https://softwaresecurity.com/fix/missing-authentication/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-python-flask.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306" ], "owaspTop10_2025": [ "A07:2025" ], "capec": [ "CAPEC-36" ], "asvs": [ "v5.0.0-13.2.1", "v5.0.0-8.3.1", "v5.0.0-6.3.4" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/python-flask/#scanner-rules", "rules": [ { "tool": "Bandit", "id": "B105" } ] } }, { "key": "missing-authentication-java-spring", "title": "Fix missing authentication for a critical function in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/missing-authentication/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-java-spring.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306", "CWE-287" ], "owaspTop10_2025": [ "A07:2025" ], "owaspApiTop10_2023": [ "API2:2023" ], "capec": [ "CAPEC-12" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (spring-boot-starter-webmvc, OncePerRequestFilter)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/java-spring/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "java/missing-jwt-signature-check" } ] } }, { "key": "missing-authentication-csharp-aspnetcore", "title": "Fix missing authentication for a critical function in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/missing-authentication/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-csharp-aspnetcore.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306", "CWE-287" ], "owaspTop10_2025": [ "A07:2025" ], "owaspApiTop10_2023": [ "API2:2023" ], "capec": [ "CAPEC-12" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10 (SDK 10.0.112, runtime 10.0.12)", "framework": "ASP.NET Core 10 minimal API (authentication handler + RequireAuthorization)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/web/missing-function-level-access-control" } ] } }, { "key": "missing-authentication-typescript-nextjs", "title": "Fix missing authentication for a critical function in Next.js", "url": "https://softwaresecurity.com/fix/missing-authentication/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-typescript-nextjs.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306", "CWE-287" ], "owaspTop10_2025": [ "A07:2025" ], "owaspApiTop10_2023": [ "API2:2023" ], "capec": [ "CAPEC-12" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript (Next.js App Router)", "runtime": "Node.js 26.11.1 (node:sqlite needs 22.13.0 or later; route handlers use the default Node.js runtime)", "framework": "Next.js 16.4.0 (App Router route handlers)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/typescript-nextjs/#scanner-rules", "rules": [] } }, { "key": "missing-authentication-python-fastapi", "title": "Fix missing authentication in Python and FastAPI", "url": "https://softwaresecurity.com/fix/missing-authentication/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-python-fastapi.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306" ], "owaspTop10_2025": [ "A07:2025" ], "capec": [ "CAPEC-36" ], "asvs": [ "v5.0.0-13.2.1", "v5.0.0-8.3.1", "v5.0.0-6.3.4" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/python-fastapi/#scanner-rules", "rules": [ { "tool": "Bandit", "id": "B105" } ] } }, { "key": "missing-authentication-python-django", "title": "Fix missing authentication in Python and Django", "url": "https://softwaresecurity.com/fix/missing-authentication/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-python-django.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306" ], "owaspTop10_2025": [ "A07:2025" ], "capec": [ "CAPEC-36" ], "asvs": [ "v5.0.0-13.2.1", "v5.0.0-8.3.1", "v5.0.0-6.3.4" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/python-django/#scanner-rules", "rules": [ { "tool": "Bandit", "id": "B105" } ] } }, { "key": "missing-authentication-go-nethttp", "title": "Fix missing authentication in Go and net/http", "url": "https://softwaresecurity.com/fix/missing-authentication/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-go-nethttp.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306", "CWE-287", "CWE-288", "CWE-290" ], "owaspTop10_2025": [ "A07:2025" ], "owaspApiTop10_2023": [ "API2:2023" ], "capec": [ "CAPEC-12", "CAPEC-36", "CAPEC-216" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, crypto/hmac, crypto/sha256)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/go-nethttp/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "go.lang.security.audit.crypto.use_of_weak_rsa_key.use_of_weak_rsa_key" }, { "tool": "CodeQL", "id": "go-security-extended" } ] } }, { "key": "missing-authentication-ruby-rails", "title": "Fix missing authentication in Ruby on Rails", "url": "https://softwaresecurity.com/fix/missing-authentication/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-ruby-rails.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306", "CWE-287", "CWE-288", "CWE-290" ], "owaspTop10_2025": [ "A07:2025" ], "owaspApiTop10_2023": [ "API2:2023" ], "capec": [ "CAPEC-12", "CAPEC-36", "CAPEC-216" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (API controller, before_action, OpenSSL::HMAC, ActiveSupport::SecurityUtils)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/ruby-rails/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "rb/missing-token-validation" }, { "tool": "CodeQL", "id": "rb/sensitive-get-query" } ] } }, { "key": "missing-authentication-php-laravel", "title": "Fix missing authentication in PHP and Laravel", "url": "https://softwaresecurity.com/fix/missing-authentication/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/missing-authentication-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/missing-authentication-php-laravel.zip", "weakness": { "key": "missing-authentication", "title": "Missing authentication for a critical function", "url": "https://softwaresecurity.com/fix/missing-authentication/" }, "identifiers": { "cwe": [ "CWE-306", "CWE-287", "CWE-288", "CWE-290" ], "owaspTop10_2025": [ "A07:2025" ], "owaspApiTop10_2023": [ "API2:2023" ], "capec": [ "CAPEC-12", "CAPEC-36", "CAPEC-216" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (route middleware, hash_hmac, hash_equals)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/missing-authentication/php-laravel/#scanner-rules", "rules": [] } }, { "key": "session-cookies-node-express", "title": "Fix session fixation and session cookies in Node.js and Express", "url": "https://softwaresecurity.com/fix/session-cookies/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/session-cookies-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/session-cookies-node-express.zip", "weakness": { "key": "session-cookies", "title": "Session fixation and session cookies", "url": "https://softwaresecurity.com/fix/session-cookies/" }, "identifiers": { "cwe": [ "CWE-384", "CWE-613", "CWE-614", "CWE-1004", "CWE-1275" ], "owaspTop10_2025": [ "A07:2025", "A02:2025", "A01:2025" ], "capec": [ "CAPEC-61", "CAPEC-60", "CAPEC-102" ], "asvs": [ "v5.0.0-7.2.4", "v5.0.0-7.3.1", "v5.0.0-7.3.2", "v5.0.0-3.3.1", "v5.0.0-3.3.2", "v5.0.0-3.3.3", "v5.0.0-3.3.4" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure" }, { "tool": "CodeQL", "id": "js/clear-text-cookie" }, { "tool": "CodeQL", "id": "js/client-exposed-cookie" }, { "tool": "CodeQL", "id": "js/session-fixation" } ] } }, { "key": "session-cookies-python-flask", "title": "Fix session fixation and session cookies in Python and Flask", "url": "https://softwaresecurity.com/fix/session-cookies/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/session-cookies-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/session-cookies-python-flask.zip", "weakness": { "key": "session-cookies", "title": "Session fixation and session cookies", "url": "https://softwaresecurity.com/fix/session-cookies/" }, "identifiers": { "cwe": [ "CWE-384", "CWE-613", "CWE-614", "CWE-1004", "CWE-1275" ], "owaspTop10_2025": [ "A07:2025", "A02:2025", "A01:2025" ], "capec": [ "CAPEC-61", "CAPEC-60", "CAPEC-102" ], "asvs": [ "v5.0.0-7.2.4", "v5.0.0-7.3.1", "v5.0.0-7.3.2", "v5.0.0-3.3.1", "v5.0.0-3.3.2", "v5.0.0-3.3.3", "v5.0.0-3.3.4" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3 with Flask-Session 0.8.0 (server-side sessions)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/session-cookies/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.flask.security.audit.secure-set-cookie.secure-set-cookie" }, { "tool": "CodeQL", "id": "py/client-exposed-cookie" }, { "tool": "CodeQL", "id": "py/insecure-cookie" }, { "tool": "Bandit", "id": "none" } ] } }, { "key": "session-cookies-java-spring", "title": "Fix session fixation and session cookies in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/session-cookies/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/session-cookies-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/session-cookies-java-spring.zip", "weakness": { "key": "session-cookies", "title": "Session fixation and session cookies", "url": "https://softwaresecurity.com/fix/session-cookies/" }, "identifiers": { "cwe": [ "CWE-384", "CWE-613", "CWE-614", "CWE-1004", "CWE-1275" ], "owaspTop10_2025": [ "A07:2025", "A02:2025", "A01:2025" ], "capec": [ "CAPEC-61", "CAPEC-60", "CAPEC-102" ], "asvs": [ "v5.0.0-7.2.4", "v5.0.0-7.3.1", "v5.0.0-7.3.2", "v5.0.0-3.3.1", "v5.0.0-3.3.2", "v5.0.0-3.3.3", "v5.0.0-3.3.4" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Security 7.1.1, Spring Framework 7.0.9, Spring MVC, embedded Tomcat 11.0.26)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/session-cookies/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly" }, { "tool": "Semgrep", "id": "java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag" }, { "tool": "CodeQL", "id": "java/insecure-cookie" }, { "tool": "CodeQL", "id": "java/sensitive-cookie-not-httponly" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "HTTPONLY_COOKIE" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "INSECURE_COOKIE" } ] } }, { "key": "session-cookies-csharp-aspnetcore", "title": "Fix session fixation and session cookies in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/session-cookies/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/session-cookies-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/session-cookies-csharp-aspnetcore.zip", "weakness": { "key": "session-cookies", "title": "Session fixation and session cookies", "url": "https://softwaresecurity.com/fix/session-cookies/" }, "identifiers": { "cwe": [ "CWE-384", "CWE-613", "CWE-614", "CWE-1004", "CWE-1275" ], "owaspTop10_2025": [ "A07:2025", "A02:2025", "A01:2025" ], "capec": [ "CAPEC-61", "CAPEC-60", "CAPEC-102" ], "asvs": [ "v5.0.0-7.2.4", "v5.0.0-7.3.1", "v5.0.0-7.3.2", "v5.0.0-3.3.1", "v5.0.0-3.3.2", "v5.0.0-3.3.3", "v5.0.0-3.3.4" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112, ASP.NET Core runtime 10.0.12)", "framework": "ASP.NET Core 10 minimal API with cookie authentication (fixed) or session state (vulnerable and wrong)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/session-cookies/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings" }, { "tool": "CodeQL", "id": "cs/session-reuse" }, { "tool": "CodeQL", "id": "cs/web/cookie-httponly-not-set" }, { "tool": "CodeQL", "id": "cs/web/cookie-secure-not-set" }, { "tool": ".NET code analysis", "id": "CA5382" } ] } }, { "key": "session-cookies-ruby-rails", "title": "Fix session fixation and cookies in Ruby on Rails", "url": "https://softwaresecurity.com/fix/session-cookies/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/session-cookies-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/session-cookies-ruby-rails.zip", "weakness": { "key": "session-cookies", "title": "Session fixation and session cookies", "url": "https://softwaresecurity.com/fix/session-cookies/" }, "identifiers": { "cwe": [ "CWE-384", "CWE-613", "CWE-614", "CWE-1004", "CWE-1275" ], "owaspTop10_2025": [ "A07:2025", "A02:2025", "A01:2025" ], "capec": [ "CAPEC-61", "CAPEC-60", "CAPEC-102" ], "asvs": [ "v5.0.0-7.2.4", "v5.0.0-7.3.1", "v5.0.0-7.3.2", "v5.0.0-3.3.1", "v5.0.0-3.3.2", "v5.0.0-3.3.3", "v5.0.0-3.3.4" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (ActionDispatch::Session::CacheStore)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/session-cookies/ruby-rails/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-cookie-store-session-security-attributes.check-cookie-store-session-security-attributes" }, { "tool": "CodeQL", "id": "rb/weak-cookie-configuration" }, { "tool": "Brakeman", "id": "SessionSettings" } ] } }, { "key": "session-cookies-php-laravel", "title": "Fix session fixation and session cookies in PHP and Laravel", "url": "https://softwaresecurity.com/fix/session-cookies/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/session-cookies-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/session-cookies-php-laravel.zip", "weakness": { "key": "session-cookies", "title": "Session fixation and session cookies", "url": "https://softwaresecurity.com/fix/session-cookies/" }, "identifiers": { "cwe": [ "CWE-384", "CWE-613", "CWE-614", "CWE-1004", "CWE-1275" ], "owaspTop10_2025": [ "A07:2025", "A02:2025", "A01:2025" ], "capec": [ "CAPEC-61", "CAPEC-60", "CAPEC-102" ], "asvs": [ "v5.0.0-7.2.4", "v5.0.0-7.3.1", "v5.0.0-7.3.2", "v5.0.0-3.3.1", "v5.0.0-3.3.2", "v5.0.0-3.3.3", "v5.0.0-3.3.4" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (sessions on SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/session-cookies/php-laravel/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "php.laravel.security.laravel-cookie-long-timeout.laravel-cookie-long-timeout" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-cookie-null-domain.laravel-cookie-null-domain" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-cookie-secure-set.laravel-cookie-secure-set" } ] } }, { "key": "deserialization-node-express", "title": "Fix insecure deserialization in Node.js and Express", "url": "https://softwaresecurity.com/fix/deserialization/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/deserialization-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/deserialization-node-express.zip", "weakness": { "key": "deserialization", "title": "Insecure deserialization", "url": "https://softwaresecurity.com/fix/deserialization/" }, "identifiers": { "cwe": [ "CWE-502" ], "owaspTop10_2025": [ "A08:2025" ], "capec": [ "CAPEC-586" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/deserialization/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop" }, { "tool": "CodeQL", "id": "js/prototype-polluting-assignment" }, { "tool": "CodeQL", "id": "js/unsafe-deserialization" } ] } }, { "key": "deserialization-python-flask", "title": "Fix insecure deserialization in Python and Flask", "url": "https://softwaresecurity.com/fix/deserialization/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/deserialization-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/deserialization-python-flask.zip", "weakness": { "key": "deserialization", "title": "Insecure deserialization", "url": "https://softwaresecurity.com/fix/deserialization/" }, "identifiers": { "cwe": [ "CWE-502" ], "owaspTop10_2025": [ "A08:2025" ], "capec": [ "CAPEC-586" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/deserialization/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load" }, { "tool": "Semgrep", "id": "python.lang.security.deserialization.pickle.avoid-pickle" }, { "tool": "CodeQL", "id": "py/unsafe-deserialization" }, { "tool": "Bandit", "id": "B301" }, { "tool": "Bandit", "id": "B506" } ] } }, { "key": "deserialization-java-spring", "title": "Fix insecure deserialization in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/deserialization/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/deserialization-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/deserialization-java-spring.zip", "weakness": { "key": "deserialization", "title": "Insecure deserialization", "url": "https://softwaresecurity.com/fix/deserialization/" }, "identifiers": { "cwe": [ "CWE-502" ], "owaspTop10_2025": [ "A08:2025" ], "capec": [ "CAPEC-586" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7, Spring MVC)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/deserialization/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.object-deserialization.object-deserialization" }, { "tool": "CodeQL", "id": "java/unsafe-deserialization" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "OBJECT_DESERIALIZATION" } ] } }, { "key": "deserialization-csharp-aspnetcore", "title": "Fix insecure deserialization in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/deserialization/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/deserialization-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/deserialization-csharp-aspnetcore.zip", "weakness": { "key": "deserialization", "title": "Insecure deserialization", "url": "https://softwaresecurity.com/fix/deserialization/" }, "identifiers": { "cwe": [ "CWE-502" ], "owaspTop10_2025": [ "A08:2025" ], "capec": [ "CAPEC-586" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/deserialization/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "cs/unsafe-deserialization" }, { "tool": ".NET code analysis", "id": "CA2326" }, { "tool": ".NET code analysis", "id": "CA2327" } ] } }, { "key": "deserialization-python-fastapi", "title": "Fix insecure deserialization in Python and FastAPI", "url": "https://softwaresecurity.com/fix/deserialization/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/deserialization-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/deserialization-python-fastapi.zip", "weakness": { "key": "deserialization", "title": "Insecure deserialization", "url": "https://softwaresecurity.com/fix/deserialization/" }, "identifiers": { "cwe": [ "CWE-502" ], "owaspTop10_2025": [ "A08:2025" ], "capec": [ "CAPEC-586" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/deserialization/python-fastapi/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load" }, { "tool": "Semgrep", "id": "python.lang.security.deserialization.pickle.avoid-pickle" }, { "tool": "CodeQL", "id": "py/unsafe-deserialization" }, { "tool": "Bandit", "id": "B301" }, { "tool": "Bandit", "id": "B506" } ] } }, { "key": "deserialization-ruby-rails", "title": "Fix insecure deserialization in Ruby on Rails", "url": "https://softwaresecurity.com/fix/deserialization/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/deserialization-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/deserialization-ruby-rails.zip", "weakness": { "key": "deserialization", "title": "Insecure deserialization", "url": "https://softwaresecurity.com/fix/deserialization/" }, "identifiers": { "cwe": [ "CWE-502" ], "owaspTop10_2025": [ "A08:2025" ], "capec": [ "CAPEC-586" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (API controller) with Marshal, Psych (YAML) and JSON" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/deserialization/ruby-rails/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "rb/unsafe-deserialization" }, { "tool": "Brakeman", "id": "Deserialize" } ] } }, { "key": "deserialization-php-laravel", "title": "Fix insecure deserialization in PHP and Laravel", "url": "https://softwaresecurity.com/fix/deserialization/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/deserialization-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/deserialization-php-laravel.zip", "weakness": { "key": "deserialization", "title": "Insecure deserialization", "url": "https://softwaresecurity.com/fix/deserialization/" }, "identifiers": { "cwe": [ "CWE-502" ], "owaspTop10_2025": [ "A08:2025" ], "capec": [ "CAPEC-586" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 with PHP unserialize (allowed_classes) and json_decode" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/deserialization/php-laravel/#scanner-rules", "rules": [] } }, { "key": "mass-assignment-node-express", "title": "Fix mass assignment (over-posting) in Node.js and Express", "url": "https://softwaresecurity.com/fix/mass-assignment/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-node-express.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/node-express/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.express-data-exfiltration.express-data-exfiltration" }, { "tool": "CodeQL", "id": "js/prototype-polluting-assignment" }, { "tool": "CodeQL", "id": "js/prototype-pollution" } ] } }, { "key": "mass-assignment-python-flask", "title": "Fix mass assignment (over-posting) in Python and Flask", "url": "https://softwaresecurity.com/fix/mass-assignment/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-python-flask.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/python-flask/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.mass-assignment.mass-assignment" } ] } }, { "key": "mass-assignment-java-spring", "title": "Fix mass assignment (over-posting) in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/mass-assignment/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-java-spring.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC, Jackson 3)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/java-spring/#scanner-rules", "rules": [ { "tool": "Find Security Bugs (SpotBugs)", "id": "ENTITY_MASS_ASSIGNMENT" } ] } }, { "key": "mass-assignment-csharp-aspnetcore", "title": "Fix mass assignment (over-posting) in C# and ASP.NET Core", "url": "https://softwaresecurity.com/fix/mass-assignment/csharp-aspnetcore/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-csharp-aspnetcore.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-csharp-aspnetcore.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "csharp-aspnetcore", "name": "C# and ASP.NET Core", "language": "C#", "framework": "ASP.NET Core" }, "tested": { "language": "C# 14", "runtime": ".NET 10.0.12 (SDK 10.0.112)", "framework": "ASP.NET Core 10 minimal API (System.Text.Json)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/csharp-aspnetcore/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "csharp.dotnet.security.audit.mass-assignment.mass-assignment" } ] } }, { "key": "mass-assignment-typescript-nextjs", "title": "Fix mass assignment in TypeScript and Next.js", "url": "https://softwaresecurity.com/fix/mass-assignment/typescript-nextjs/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-typescript-nextjs.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-typescript-nextjs.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "typescript-nextjs", "name": "TypeScript and Next.js", "language": "TypeScript", "framework": "Next.js" }, "tested": { "language": "TypeScript", "runtime": "Node.js 26.11.1", "framework": "Next.js 16.4.0 (App Router route handler and server action)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/typescript-nextjs/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "javascript.express.security.express-data-exfiltration.express-data-exfiltration" }, { "tool": "CodeQL", "id": "js/prototype-pollution" } ] } }, { "key": "mass-assignment-python-fastapi", "title": "Fix mass assignment in Python and FastAPI", "url": "https://softwaresecurity.com/fix/mass-assignment/python-fastapi/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-python-fastapi.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-python-fastapi.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "python-fastapi", "name": "Python and FastAPI", "language": "Python", "framework": "FastAPI" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "FastAPI 0.142.2 (Starlette 1.7.0, Pydantic 2.13.5)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/python-fastapi/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.mass-assignment.mass-assignment" } ] } }, { "key": "mass-assignment-python-django", "title": "Fix mass assignment in Python and Django", "url": "https://softwaresecurity.com/fix/mass-assignment/python-django/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-python-django.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-python-django.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "python-django", "name": "Python and Django", "language": "Python", "framework": "Django" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Django 6.1.2 (ModelForm, django.contrib.auth sessions)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/python-django/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "python.django.security.injection.mass-assignment.mass-assignment" } ] } }, { "key": "mass-assignment-go-nethttp", "title": "Fix mass assignment in Go and net/http", "url": "https://softwaresecurity.com/fix/mass-assignment/go-nethttp/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-go-nethttp.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-go-nethttp.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "go-nethttp", "name": "Go and net/http", "language": "Go", "framework": "net/http" }, "tested": { "language": "Go", "runtime": "Go 1.27.2 (golang:1.27.2-trixie, linux/arm64); also passes on Go 1.26.9", "framework": "Go standard library 1.27.2 (net/http, encoding/json)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/go-nethttp/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "go-security-extended" } ] } }, { "key": "mass-assignment-ruby-rails", "title": "Fix mass assignment in Ruby on Rails", "url": "https://softwaresecurity.com/fix/mass-assignment/ruby-rails/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-ruby-rails.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-ruby-rails.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "ruby-rails", "name": "Ruby on Rails", "language": "Ruby", "framework": "Rails" }, "tested": { "language": "Ruby", "runtime": "Ruby 4.0.7", "framework": "Ruby on Rails 8.1.4 (strong parameters, Active Record over SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/ruby-rails/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "ruby.lang.security.model-attr-accessible.model-attr-accessible" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-permit-attributes-high.check-permit-attributes-high" }, { "tool": "CodeQL", "id": "rb/insecure-mass-assignment" }, { "tool": "Brakeman", "id": "MassAssignment" }, { "tool": "Brakeman", "id": "PermitAttributes" } ] } }, { "key": "mass-assignment-php-laravel", "title": "Fix mass assignment (over-posting) in PHP and Laravel", "url": "https://softwaresecurity.com/fix/mass-assignment/php-laravel/", "api": "https://softwaresecurity.com/api/v1/fix-cards/mass-assignment-php-laravel.json", "download": "https://softwaresecurity.com/downloads/fixes/mass-assignment-php-laravel.zip", "weakness": { "key": "mass-assignment", "title": "Mass assignment (over-posting)", "url": "https://softwaresecurity.com/fix/mass-assignment/" }, "identifiers": { "cwe": [ "CWE-915" ], "owaspTop10_2025": [ "A08:2025" ], "owaspApiTop10_2023": [ "API3:2023" ], "capec": [], "asvs": [ "v5.0.0-15.3.3", "v5.0.0-8.2.3" ] }, "stack": { "key": "php-laravel", "name": "PHP and Laravel", "language": "PHP", "framework": "Laravel" }, "tested": { "language": "PHP", "runtime": "PHP 8.5.11 (CLI)", "framework": "Laravel 13.34.0 (Eloquent over SQLite)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/mass-assignment/php-laravel/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "php.laravel.security.laravel-dangerous-model-construction.laravel-dangerous-model-construction" } ] } }, { "key": "crlf-log-injection-node-express", "title": "Fix CRLF and log injection in Node.js and Express", "url": "https://softwaresecurity.com/fix/crlf-log-injection/node-express/", "api": "https://softwaresecurity.com/api/v1/fix-cards/crlf-log-injection-node-express.json", "download": "https://softwaresecurity.com/downloads/fixes/crlf-log-injection-node-express.zip", "weakness": { "key": "crlf-log-injection", "title": "CRLF injection in logs and response headers", "url": "https://softwaresecurity.com/fix/crlf-log-injection/" }, "identifiers": { "cwe": [ "CWE-117", "CWE-93", "CWE-113" ], "owaspTop10_2025": [ "A09:2025", "A05:2025" ], "capec": [ "CAPEC-93", "CAPEC-34" ], "asvs": [ "v5.0.0-16.4.1", "v5.0.0-1.2.1", "v5.0.0-1.3.3" ] }, "stack": { "key": "node-express", "name": "Node.js and Express", "language": "JavaScript", "framework": "Express" }, "tested": { "language": "JavaScript (ES modules)", "runtime": "Node.js 26.11.1", "framework": "Express 5.3.0" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/crlf-log-injection/node-express/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "js/log-injection" } ] } }, { "key": "crlf-log-injection-python-flask", "title": "Fix CRLF and log injection in Python and Flask", "url": "https://softwaresecurity.com/fix/crlf-log-injection/python-flask/", "api": "https://softwaresecurity.com/api/v1/fix-cards/crlf-log-injection-python-flask.json", "download": "https://softwaresecurity.com/downloads/fixes/crlf-log-injection-python-flask.zip", "weakness": { "key": "crlf-log-injection", "title": "CRLF injection in logs and response headers", "url": "https://softwaresecurity.com/fix/crlf-log-injection/" }, "identifiers": { "cwe": [ "CWE-117", "CWE-93", "CWE-113" ], "owaspTop10_2025": [ "A09:2025", "A05:2025" ], "capec": [ "CAPEC-93", "CAPEC-34" ], "asvs": [ "v5.0.0-16.4.1", "v5.0.0-1.2.1", "v5.0.0-1.3.3" ] }, "stack": { "key": "python-flask", "name": "Python and Flask", "language": "Python", "framework": "Flask" }, "tested": { "language": "Python", "runtime": "CPython 3.14.8", "framework": "Flask 3.1.3" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/crlf-log-injection/python-flask/#scanner-rules", "rules": [ { "tool": "CodeQL", "id": "py/http-response-splitting" }, { "tool": "CodeQL", "id": "py/log-injection" } ] } }, { "key": "crlf-log-injection-java-spring", "title": "Fix CRLF and log injection in Java and Spring Boot", "url": "https://softwaresecurity.com/fix/crlf-log-injection/java-spring/", "api": "https://softwaresecurity.com/api/v1/fix-cards/crlf-log-injection-java-spring.json", "download": "https://softwaresecurity.com/downloads/fixes/crlf-log-injection-java-spring.zip", "weakness": { "key": "crlf-log-injection", "title": "CRLF injection in logs and response headers", "url": "https://softwaresecurity.com/fix/crlf-log-injection/" }, "identifiers": { "cwe": [ "CWE-117", "CWE-93", "CWE-113" ], "owaspTop10_2025": [ "A09:2025", "A05:2025" ], "capec": [ "CAPEC-93", "CAPEC-34" ], "asvs": [ "v5.0.0-16.4.1", "v5.0.0-1.2.1", "v5.0.0-1.3.3" ] }, "stack": { "key": "java-spring", "name": "Java and Spring Boot", "language": "Java", "framework": "Spring Boot" }, "tested": { "language": "Java 21", "runtime": "OpenJDK 21.0.12.1 (Homebrew), Maven 3.9.16", "framework": "Spring Boot 4.1.1 (Spring Framework 7.0.9, Spring MVC on Tomcat 11.0.26, Logback)" }, "verified": "2026-10-11", "scannerRules": { "url": "https://softwaresecurity.com/fix/crlf-log-injection/java-spring/#scanner-rules", "rules": [ { "tool": "Semgrep", "id": "java.lang.security.audit.crlf-injection-logs.crlf-injection-logs" }, { "tool": "Semgrep", "id": "java.lang.security.audit.http-response-splitting.http-response-splitting" }, { "tool": "CodeQL", "id": "java/http-response-splitting" }, { "tool": "CodeQL", "id": "java/log-injection" } ] } } ], "rules": [ { "tool": "Semgrep", "id": "csharp.dotnet.security.audit.mass-assignment.mass-assignment", "aliases": [ "mass-assignment" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/dotnet/security/audit/mass-assignment.yaml", "cards": [ "mass-assignment-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/mass-assignment/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-dotnet-security-audit-mass-assignment-mass-assignment" }, { "tool": "Semgrep", "id": "csharp.dotnet.security.audit.missing-or-broken-authorization.missing-or-broken-authorization", "aliases": [ "missing-or-broken-authorization" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/dotnet/security/audit/missing-or-broken-authorization.yaml", "cards": [ "missing-authorization-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/missing-authorization/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-dotnet-security-audit-missing-or-broken-authorization-missing-or-broken-authorization" }, { "tool": "Semgrep", "id": "csharp.dotnet.security.audit.razor-use-of-htmlstring.razor-use-of-htmlstring", "aliases": [ "razor-use-of-htmlstring" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/dotnet/security/audit/razor-use-of-htmlstring.yaml", "cards": [ "xss-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/xss/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-dotnet-security-audit-razor-use-of-htmlstring-razor-use-of-htmlstring" }, { "tool": "Semgrep", "id": "csharp.dotnet.security.audit.xpath-injection.xpath-injection", "aliases": [ "xpath-injection" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/dotnet/security/audit/xpath-injection.yaml", "cards": [ "xpath-injection-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/xpath-injection/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-dotnet-security-audit-xpath-injection-xpath-injection" }, { "tool": "Semgrep", "id": "csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery", "aliases": [ "mvc-missing-antiforgery" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/dotnet/security/mvc-missing-antiforgery.yaml", "cards": [ "csrf-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/csrf/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-dotnet-security-mvc-missing-antiforgery-mvc-missing-antiforgery" }, { "tool": "Semgrep", "id": "csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings", "aliases": [ "web-config-insecure-cookie-settings" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/dotnet/security/web-config-insecure-cookie-settings.yaml", "cards": [ "session-cookies-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-dotnet-security-web-config-insecure-cookie-settings-web-config-insecure-cookie-settings" }, { "tool": "Semgrep", "id": "csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation", "aliases": [ "jwt-tokenvalidationparameters-no-expiry-validation" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/lang/security/ad/jwt-tokenvalidationparameters-no-expiry-validation.yaml", "cards": [ "jwt-validation-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-lang-security-ad-jwt-tokenvalidationparameters-no-expiry-validation-jwt-tokenvalidationparameters-no-expiry-validation" }, { "tool": "Semgrep", "id": "csharp.lang.security.cryptography.unsigned-security-token.unsigned-security-token", "aliases": [ "unsigned-security-token" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/lang/security/cryptography/unsigned-security-token.yaml", "cards": [ "jwt-validation-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-lang-security-cryptography-unsigned-security-token-unsigned-security-token" }, { "tool": "Semgrep", "id": "csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine", "aliases": [ "unsafe-path-combine" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/lang/security/filesystem/unsafe-path-combine.yaml", "cards": [ "path-traversal-csharp-aspnetcore", "file-upload-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-lang-security-filesystem-unsafe-path-combine-unsafe-path-combine", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-lang-security-filesystem-unsafe-path-combine-unsafe-path-combine" }, { "tool": "Semgrep", "id": "csharp.lang.security.open-redirect.open-redirect", "aliases": [ "open-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/lang/security/open-redirect.yaml", "cards": [ "open-redirect-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-lang-security-open-redirect-open-redirect" }, { "tool": "Semgrep", "id": "csharp.lang.security.sqli.csharp-sqli.csharp-sqli", "aliases": [ "csharp-sqli" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/csharp/lang/security/sqli/csharp-sqli.yaml", "cards": [ "sql-injection-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-csharp-lang-security-sqli-csharp-sqli-csharp-sqli" }, { "tool": "Semgrep", "id": "generic.html-templates.security.var-in-href.var-in-href", "aliases": [ "var-in-href" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/generic/html-templates/security/var-in-href.yaml", "cards": [ "xss-python-django" ], "helpUri": "https://softwaresecurity.com/fix/xss/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-generic-html-templates-security-var-in-href-var-in-href" }, { "tool": "Semgrep", "id": "generic.secrets.gitleaks.generic-api-key.generic-api-key", "aliases": [ "generic-api-key" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/gitleaks/generic-api-key.yaml", "cards": [ "hardcoded-secrets-node-express", "hardcoded-secrets-python-flask", "hardcoded-secrets-java-spring", "hardcoded-secrets-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-generic-secrets-gitleaks-generic-api-key-generic-api-key", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-generic-secrets-gitleaks-generic-api-key-generic-api-key" }, { "tool": "Semgrep", "id": "generic.secrets.security.detected-generic-api-key.detected-generic-api-key", "aliases": [ "detected-generic-api-key" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/generic/secrets/security/detected-generic-api-key.yaml", "cards": [ "hardcoded-secrets-node-express", "hardcoded-secrets-python-flask", "hardcoded-secrets-java-spring", "hardcoded-secrets-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-generic-secrets-security-detected-generic-api-key-detected-generic-api-key", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-generic-secrets-security-detected-generic-api-key-detected-generic-api-key" }, { "tool": "Semgrep", "id": "go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified", "aliases": [ "jwt-go-parse-unverified" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/jwt-go/security/audit/jwt-parse-unverified.yaml", "cards": [ "jwt-validation-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-jwt-go-security-audit-jwt-parse-unverified-jwt-go-parse-unverified" }, { "tool": "Semgrep", "id": "go.lang.security.audit.crypto.math_random.math-random-used", "aliases": [ "math-random-used" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/crypto/math_random.yaml", "cards": [ "insecure-randomness-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-crypto-math-random-math-random-used" }, { "tool": "Semgrep", "id": "go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion", "aliases": [ "missing-ssl-minversion" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/crypto/missing-ssl-minversion.yaml", "cards": [ "tls-certificate-validation-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-crypto-missing-ssl-minversion-missing-ssl-minversion" }, { "tool": "Semgrep", "id": "go.lang.security.audit.crypto.use_of_weak_rsa_key.use_of_weak_rsa_key", "aliases": [ "use_of_weak_rsa_key" ], "documentation": "https://github.com/semgrep/semgrep-rules/tree/develop/go/lang/security/audit/crypto", "cards": [ "missing-authentication-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/missing-authentication/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-crypto-use-of-weak-rsa-key-use-of-weak-rsa-key" }, { "tool": "Semgrep", "id": "go.lang.security.audit.dangerous-exec-cmd.dangerous-exec-cmd", "aliases": [ "dangerous-exec-cmd" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/dangerous-exec-cmd.yaml", "cards": [ "command-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-dangerous-exec-cmd-dangerous-exec-cmd" }, { "tool": "Semgrep", "id": "go.lang.security.audit.dangerous-exec-command.dangerous-exec-command", "aliases": [ "dangerous-exec-command" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/dangerous-exec-command.yaml", "cards": [ "command-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-dangerous-exec-command-dangerous-exec-command" }, { "tool": "Semgrep", "id": "go.lang.security.audit.database.string-formatted-query.string-formatted-query", "aliases": [ "string-formatted-query" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/database/string-formatted-query.yaml", "cards": [ "sql-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-database-string-formatted-query-string-formatted-query" }, { "tool": "Semgrep", "id": "go.lang.security.audit.md5-used-as-password.md5-used-as-password", "aliases": [ "md5-used-as-password" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/md5-used-as-password.yaml", "cards": [ "password-hashing-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-md5-used-as-password-md5-used-as-password" }, { "tool": "Semgrep", "id": "go.lang.security.audit.sqli.gosql-sqli.gosql-sqli", "aliases": [ "gosql-sqli" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/sqli/gosql-sqli.yaml", "cards": [ "sql-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-sqli-gosql-sqli-gosql-sqli" }, { "tool": "Semgrep", "id": "go.lang.security.audit.xss.import-text-template.import-text-template", "aliases": [ "import-text-template" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/xss/import-text-template.yaml", "cards": [ "xss-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/xss/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-xss-import-text-template-import-text-template" }, { "tool": "Semgrep", "id": "go.lang.security.audit.xss.no-fprintf-to-responsewriter.no-fprintf-to-responsewriter", "aliases": [ "no-fprintf-to-responsewriter" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/xss/no-fprintf-to-responsewriter.yaml", "cards": [ "xss-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/xss/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-xss-no-fprintf-to-responsewriter-no-fprintf-to-responsewriter" }, { "tool": "Semgrep", "id": "go.lang.security.audit.xss.template-html-does-not-escape.unsafe-template-type", "aliases": [ "unsafe-template-type" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/audit/xss/template-html-does-not-escape.yaml", "cards": [ "xss-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/xss/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-audit-xss-template-html-does-not-escape-unsafe-template-type" }, { "tool": "Semgrep", "id": "go.lang.security.filepath-clean-misuse.filepath-clean-misuse", "aliases": [ "filepath-clean-misuse" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/filepath-clean-misuse.yaml", "cards": [ "path-traversal-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-filepath-clean-misuse-filepath-clean-misuse" }, { "tool": "Semgrep", "id": "go.lang.security.injection.open-redirect.open-redirect", "aliases": [ "open-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/injection/open-redirect.yaml", "cards": [ "open-redirect-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-injection-open-redirect-open-redirect" }, { "tool": "Semgrep", "id": "go.lang.security.injection.tainted-sql-string.tainted-sql-string", "aliases": [ "tainted-sql-string" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/injection/tainted-sql-string.yaml", "cards": [ "sql-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-injection-tainted-sql-string-tainted-sql-string" }, { "tool": "Semgrep", "id": "go.lang.security.injection.tainted-url-host.tainted-url-host", "aliases": [ "tainted-url-host" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/go/lang/security/injection/tainted-url-host.yaml", "cards": [ "ssrf-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-go-lang-security-injection-tainted-url-host-tainted-url-host" }, { "tool": "Semgrep", "id": "java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify", "aliases": [ "java-jwt-decode-without-verify" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/java-jwt/security/audit/jwt-decode-without-verify.yaml", "cards": [ "jwt-validation-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-java-jwt-security-audit-jwt-decode-without-verify-java-jwt-decode-without-verify" }, { "tool": "Semgrep", "id": "java.lang.security.audit.command-injection-process-builder.command-injection-process-builder", "aliases": [ "command-injection-process-builder" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/command-injection-process-builder.yaml", "cards": [ "command-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-command-injection-process-builder-command-injection-process-builder" }, { "tool": "Semgrep", "id": "java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly", "aliases": [ "cookie-missing-httponly" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/cookie-missing-httponly.yaml", "cards": [ "session-cookies-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-cookie-missing-httponly-cookie-missing-httponly" }, { "tool": "Semgrep", "id": "java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag", "aliases": [ "cookie-missing-secure-flag" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/cookie-missing-secure-flag.yaml", "cards": [ "session-cookies-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-cookie-missing-secure-flag-cookie-missing-secure-flag" }, { "tool": "Semgrep", "id": "java.lang.security.audit.crlf-injection-logs.crlf-injection-logs", "aliases": [ "crlf-injection-logs" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/crlf-injection-logs.yaml", "cards": [ "crlf-log-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/crlf-log-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-crlf-injection-logs-crlf-injection-logs" }, { "tool": "Semgrep", "id": "java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager", "aliases": [ "insecure-trust-manager" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/crypto/ssl/insecure-trust-manager.yaml", "cards": [ "tls-certificate-validation-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-crypto-ssl-insecure-trust-manager-insecure-trust-manager" }, { "tool": "Semgrep", "id": "java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket", "aliases": [ "unencrypted-socket" ], "name": "Unencrypted socket (observed on the production dialer)", "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/crypto/unencrypted-socket.yaml", "cards": [ "ssrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-crypto-unencrypted-socket-unencrypted-socket" }, { "tool": "Semgrep", "id": "java.lang.security.audit.crypto.weak-random.weak-random", "aliases": [ "weak-random" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/crypto/weak-random.yaml", "cards": [ "insecure-randomness-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-crypto-weak-random-weak-random" }, { "tool": "Semgrep", "id": "java.lang.security.audit.http-response-splitting.http-response-splitting", "aliases": [ "http-response-splitting" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/http-response-splitting.yaml", "cards": [ "crlf-log-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/crlf-log-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-http-response-splitting-http-response-splitting" }, { "tool": "Semgrep", "id": "java.lang.security.audit.ldap-injection.ldap-injection", "aliases": [ "ldap-injection" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/ldap-injection.yaml", "cards": [ "ldap-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/ldap-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-ldap-injection-ldap-injection" }, { "tool": "Semgrep", "id": "java.lang.security.audit.md5-used-as-password.md5-used-as-password", "aliases": [ "md5-used-as-password" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/md5-used-as-password.yaml", "cards": [ "password-hashing-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-md5-used-as-password-md5-used-as-password" }, { "tool": "Semgrep", "id": "java.lang.security.audit.object-deserialization.object-deserialization", "aliases": [ "object-deserialization" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/object-deserialization.yaml", "cards": [ "deserialization-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-object-deserialization-object-deserialization" }, { "tool": "Semgrep", "id": "java.lang.security.audit.permissive-cors.permissive-cors", "aliases": [ "permissive-cors" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/permissive-cors.yaml", "cards": [ "cors-misconfiguration-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-permissive-cors-permissive-cors" }, { "tool": "Semgrep", "id": "java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request", "aliases": [ "tainted-ldapi-from-http-request" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/tainted-ldapi-from-http-request.yaml", "cards": [ "ldap-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/ldap-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-tainted-ldapi-from-http-request-tainted-ldapi-from-http-request" }, { "tool": "Semgrep", "id": "java.lang.security.audit.unvalidated-redirect.unvalidated-redirect", "aliases": [ "unvalidated-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/unvalidated-redirect.yaml", "cards": [ "open-redirect-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-unvalidated-redirect-unvalidated-redirect" }, { "tool": "Semgrep", "id": "java.lang.security.audit.weak-ssl-context.weak-ssl-context", "aliases": [ "weak-ssl-context" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/weak-ssl-context.yaml", "cards": [ "tls-certificate-validation-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-weak-ssl-context-weak-ssl-context" }, { "tool": "Semgrep", "id": "java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false", "aliases": [ "documentbuilderfactory-disallow-doctype-decl-false" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/xxe/documentbuilderfactory-disallow-doctype-decl-false.yaml", "cards": [ "xxe-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xxe/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-xxe-documentbuilderfactory-disallow-doctype-decl-false-documentbuilderfactory-disallow-doctype-decl-false" }, { "tool": "Semgrep", "id": "java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing", "aliases": [ "documentbuilderfactory-disallow-doctype-decl-missing" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/xxe/documentbuilderfactory-disallow-doctype-decl-missing.yaml", "cards": [ "xxe-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xxe/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-lang-security-audit-xxe-documentbuilderfactory-disallow-doctype-decl-missing-documentbuilderfactory-disallow-doctype-decl-missing" }, { "tool": "Semgrep", "id": "java.spring.security.audit.spel-injection.spel-injection", "aliases": [ "spel-injection" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/audit/spel-injection.yaml", "cards": [ "code-injection-java-spring", "template-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-audit-spel-injection-spel-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-audit-spel-injection-spel-injection" }, { "tool": "Semgrep", "id": "java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled", "aliases": [ "spring-csrf-disabled" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/audit/spring-csrf-disabled.yaml", "cards": [ "csrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/csrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-audit-spring-csrf-disabled-spring-csrf-disabled" }, { "tool": "Semgrep", "id": "java.spring.security.audit.spring-sqli.spring-sqli", "aliases": [ "spring-sqli" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/audit/spring-sqli.yaml", "cards": [ "sql-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-audit-spring-sqli-spring-sqli" }, { "tool": "Semgrep", "id": "java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect", "aliases": [ "spring-unvalidated-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/audit/spring-unvalidated-redirect.yaml", "cards": [ "open-redirect-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-audit-spring-unvalidated-redirect-spring-unvalidated-redirect" }, { "tool": "Semgrep", "id": "java.spring.security.injection.tainted-file-path.tainted-file-path", "aliases": [ "tainted-file-path" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/injection/tainted-file-path.yaml", "cards": [ "path-traversal-java-spring", "file-upload-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-injection-tainted-file-path-tainted-file-path", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-injection-tainted-file-path-tainted-file-path" }, { "tool": "Semgrep", "id": "java.spring.security.injection.tainted-sql-string.tainted-sql-string", "aliases": [ "tainted-sql-string" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/injection/tainted-sql-string.yaml", "cards": [ "sql-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-injection-tainted-sql-string-tainted-sql-string" }, { "tool": "Semgrep", "id": "java.spring.security.injection.tainted-url-host.tainted-url-host", "aliases": [ "tainted-url-host" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/injection/tainted-url-host.yaml", "cards": [ "ssrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-injection-tainted-url-host-tainted-url-host" }, { "tool": "Semgrep", "id": "java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping", "aliases": [ "unrestricted-request-mapping" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/unrestricted-request-mapping.yaml", "cards": [ "csrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/csrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-java-spring-security-unrestricted-request-mapping-unrestricted-request-mapping" }, { "tool": "Semgrep", "id": "javascript.argon2.security.unsafe-argon2-config.unsafe-argon2-config", "aliases": [ "unsafe-argon2-config" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/argon2/security/unsafe-argon2-config.yaml", "cards": [ "password-hashing-node-express" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-argon2-security-unsafe-argon2-config-unsafe-argon2-config" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage", "aliases": [ "express-check-csurf-middleware-usage" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-check-csurf-middleware-usage.yaml", "cards": [ "csrf-node-express" ], "helpUri": "https://softwaresecurity.com/fix/csrf/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-check-csurf-middleware-usage-express-check-csurf-middleware-usage" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name", "aliases": [ "express-cookie-session-default-name" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-cookie-settings.yaml", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-cookie-settings-express-cookie-session-default-name" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain", "aliases": [ "express-cookie-session-no-domain" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-cookie-settings.yaml", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-cookie-settings-express-cookie-session-no-domain" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires", "aliases": [ "express-cookie-session-no-expires" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-cookie-settings.yaml", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-cookie-settings-express-cookie-session-no-expires" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly", "aliases": [ "express-cookie-session-no-httponly" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-cookie-settings.yaml", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-cookie-settings-express-cookie-session-no-httponly" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path", "aliases": [ "express-cookie-session-no-path" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-cookie-settings.yaml", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-cookie-settings-express-cookie-session-no-path" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure", "aliases": [ "express-cookie-session-no-secure" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-cookie-settings.yaml", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-cookie-settings-express-cookie-session-no-secure" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-open-redirect.express-open-redirect", "aliases": [ "express-open-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-open-redirect.yaml", "cards": [ "open-redirect-node-express", "open-redirect-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-open-redirect-express-open-redirect", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-open-redirect-express-open-redirect" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal", "aliases": [ "express-path-join-resolve-traversal" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-path-join-resolve-traversal.yaml", "cards": [ "path-traversal-node-express", "file-upload-node-express" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-path-join-resolve-traversal-express-path-join-resolve-traversal", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-path-join-resolve-traversal-express-path-join-resolve-traversal" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.express-ssrf.express-ssrf", "aliases": [ "express-ssrf" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/express-ssrf.yaml", "cards": [ "ssrf-node-express", "ssrf-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-ssrf-express-ssrf", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-express-ssrf-express-ssrf" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.possible-user-input-redirect.unknown-value-in-redirect", "aliases": [ "unknown-value-in-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/possible-user-input-redirect.yaml", "cards": [ "open-redirect-node-express" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-possible-user-input-redirect-unknown-value-in-redirect" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape", "aliases": [ "template-explicit-unescape" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/xss/ejs/explicit-unescape.yaml", "cards": [ "xss-node-express" ], "helpUri": "https://softwaresecurity.com/fix/xss/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-xss-ejs-explicit-unescape-template-explicit-unescape" }, { "tool": "Semgrep", "id": "javascript.express.security.audit.xss.ejs.var-in-href.var-in-href", "aliases": [ "var-in-href" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/audit/xss/ejs/var-in-href.yaml", "cards": [ "xss-node-express" ], "helpUri": "https://softwaresecurity.com/fix/xss/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-audit-xss-ejs-var-in-href-var-in-href" }, { "tool": "Semgrep", "id": "javascript.express.security.cors-misconfiguration.cors-misconfiguration", "aliases": [ "cors-misconfiguration" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/cors-misconfiguration.yaml", "cards": [ "cors-misconfiguration-node-express" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-cors-misconfiguration-cors-misconfiguration" }, { "tool": "Semgrep", "id": "javascript.express.security.express-data-exfiltration.express-data-exfiltration", "aliases": [ "express-data-exfiltration" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/express-data-exfiltration.yaml", "cards": [ "mass-assignment-node-express", "mass-assignment-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-express-data-exfiltration-express-data-exfiltration", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-express-data-exfiltration-express-data-exfiltration" }, { "tool": "Semgrep", "id": "javascript.express.security.injection.tainted-sql-string.tainted-sql-string", "aliases": [ "tainted-sql-string" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/express/security/injection/tainted-sql-string.yaml", "cards": [ "sql-injection-node-express" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-express-security-injection-tainted-sql-string-tainted-sql-string" }, { "tool": "Semgrep", "id": "javascript.jose.security.jwt-none-alg.jwt-none-alg", "aliases": [ "jwt-none-alg" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/jose/security/jwt-none-alg.yaml", "cards": [ "jwt-validation-node-express", "jwt-validation-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-jose-security-jwt-none-alg-jwt-none-alg", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-jose-security-jwt-none-alg-jwt-none-alg" }, { "tool": "Semgrep", "id": "javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify", "aliases": [ "jwt-decode-without-verify" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/jsonwebtoken/security/audit/jwt-decode-without-verify.yaml", "cards": [ "jwt-validation-node-express", "jwt-validation-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-jsonwebtoken-security-audit-jwt-decode-without-verify-jwt-decode-without-verify", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-jsonwebtoken-security-audit-jwt-decode-without-verify-jwt-decode-without-verify" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.code-string-concat.code-string-concat", "aliases": [ "code-string-concat" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/lang/security/audit/code-string-concat.yaml", "cards": [ "template-injection-node-express" ], "helpUri": "https://softwaresecurity.com/fix/template-injection/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-audit-code-string-concat-code-string-concat" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename", "aliases": [ "detect-non-literal-fs-filename" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/lang/security/audit/detect-non-literal-fs-filename.yaml", "cards": [ "path-traversal-node-express", "path-traversal-typescript-nextjs", "file-upload-node-express" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-audit-detect-non-literal-fs-filename-detect-non-literal-fs-filename", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-audit-detect-non-literal-fs-filename-detect-non-literal-fs-filename" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp", "aliases": [ "detect-non-literal-regexp" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/lang/security/audit/detect-non-literal-regexp.yaml", "cards": [ "regex-dos-node-express" ], "helpUri": "https://softwaresecurity.com/fix/regex-dos/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-audit-detect-non-literal-regexp-detect-non-literal-regexp" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.md5-used-as-password.md5-used-as-password", "aliases": [ "md5-used-as-password" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/lang/security/audit/md5-used-as-password.yaml", "cards": [ "password-hashing-node-express" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-audit-md5-used-as-password-md5-used-as-password" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal", "aliases": [ "path-join-resolve-traversal" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/lang/security/audit/path-traversal/path-join-resolve-traversal.yaml", "cards": [ "path-traversal-node-express", "path-traversal-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-audit-path-traversal-path-join-resolve-traversal-path-join-resolve-traversal", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-audit-path-traversal-path-join-resolve-traversal-path-join-resolve-traversal" }, { "tool": "Semgrep", "id": "javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop", "aliases": [ "prototype-pollution-loop" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/lang/security/audit/prototype-pollution/prototype-pollution-loop.yaml", "cards": [ "deserialization-node-express" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-audit-prototype-pollution-prototype-pollution-loop" }, { "tool": "Semgrep", "id": "javascript.lang.security.detect-child-process.detect-child-process", "aliases": [ "detect-child-process" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/lang/security/detect-child-process.yaml", "cards": [ "command-injection-node-express", "command-injection-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-detect-child-process-detect-child-process", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-detect-child-process-detect-child-process" }, { "tool": "Semgrep", "id": "javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression", "aliases": [ "detect-eval-with-expression" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/javascript/lang/security/detect-eval-with-expression.yaml", "cards": [ "code-injection-node-express" ], "helpUri": "https://softwaresecurity.com/fix/code-injection/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-javascript-lang-security-detect-eval-with-expression-detect-eval-with-expression" }, { "tool": "Semgrep", "id": "php.lang.security.injection.echoed-request.echoed-request", "aliases": [ "echoed-request" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/lang/security/injection/echoed-request.yaml", "cards": [ "xss-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/xss/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-lang-security-injection-echoed-request-echoed-request" }, { "tool": "Semgrep", "id": "php.lang.security.injection.tainted-filename.tainted-filename", "aliases": [ "tainted-filename" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/lang/security/injection/tainted-filename.yaml", "cards": [ "path-traversal-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-lang-security-injection-tainted-filename-tainted-filename" }, { "tool": "Semgrep", "id": "php.lang.security.injection.tainted-sql-string.tainted-sql-string", "aliases": [ "tainted-sql-string" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/lang/security/injection/tainted-sql-string.yaml", "cards": [ "sql-injection-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-lang-security-injection-tainted-sql-string-tainted-sql-string" }, { "tool": "Semgrep", "id": "php.lang.security.md5-used-as-password.md5-used-as-password", "aliases": [ "md5-used-as-password" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/lang/security/md5-used-as-password.yaml", "cards": [ "password-hashing-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-lang-security-md5-used-as-password-md5-used-as-password" }, { "tool": "Semgrep", "id": "php.lang.security.redirect-to-request-uri.redirect-to-request-uri", "aliases": [ "redirect-to-request-uri" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/lang/security/redirect-to-request-uri.yaml", "cards": [ "open-redirect-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-lang-security-redirect-to-request-uri-redirect-to-request-uri" }, { "tool": "Semgrep", "id": "php.lang.security.weak-crypto.weak-crypto", "aliases": [ "weak-crypto" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/lang/security/weak-crypto.yaml", "cards": [ "password-hashing-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-lang-security-weak-crypto-weak-crypto" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-api-route-sql-injection.laravel-api-route-sql-injection", "aliases": [ "laravel-api-route-sql-injection" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/laravel/security/laravel-api-route-sql-injection.yaml", "cards": [ "sql-injection-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-laravel-security-laravel-api-route-sql-injection-laravel-api-route-sql-injection" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-blade-form-missing-csrf.laravel-blade-form-missing-csrf", "aliases": [ "laravel-blade-form-missing-csrf" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/laravel/security/laravel-blade-form-missing-csrf.yaml", "cards": [ "csrf-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/csrf/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-laravel-security-laravel-blade-form-missing-csrf-laravel-blade-form-missing-csrf" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-cookie-long-timeout.laravel-cookie-long-timeout", "aliases": [ "laravel-cookie-long-timeout" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/laravel/security/laravel-cookie-long-timeout.yaml", "cards": [ "session-cookies-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-laravel-security-laravel-cookie-long-timeout-laravel-cookie-long-timeout" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-cookie-null-domain.laravel-cookie-null-domain", "aliases": [ "laravel-cookie-null-domain" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/laravel/security/laravel-cookie-null-domain.yaml", "cards": [ "session-cookies-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-laravel-security-laravel-cookie-null-domain-laravel-cookie-null-domain" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-cookie-secure-set.laravel-cookie-secure-set", "aliases": [ "laravel-cookie-secure-set" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/laravel/security/laravel-cookie-secure-set.yaml", "cards": [ "session-cookies-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-laravel-security-laravel-cookie-secure-set-laravel-cookie-secure-set" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-dangerous-model-construction.laravel-dangerous-model-construction", "aliases": [ "laravel-dangerous-model-construction" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/laravel/security/laravel-dangerous-model-construction.yaml", "cards": [ "mass-assignment-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/mass-assignment/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-laravel-security-laravel-dangerous-model-construction-laravel-dangerous-model-construction" }, { "tool": "Semgrep", "id": "php.laravel.security.laravel-sql-injection.laravel-sql-injection", "aliases": [ "laravel-sql-injection" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/php/laravel/security/laravel-sql-injection.yaml", "cards": [ "sql-injection-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-php-laravel-security-laravel-sql-injection-laravel-sql-injection" }, { "tool": "Semgrep", "id": "problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification", "aliases": [ "bypass-tls-verification" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/problem-based-packs/insecure-transport/go-stdlib/bypass-tls-verification.yaml", "cards": [ "tls-certificate-validation-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-problem-based-packs-insecure-transport-go-stdlib-bypass-tls-verification-bypass-tls-verification" }, { "tool": "Semgrep", "id": "problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification", "aliases": [ "bypass-tls-verification" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/problem-based-packs/insecure-transport/java-stdlib/bypass-tls-verification.yaml", "cards": [ "tls-certificate-validation-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-problem-based-packs-insecure-transport-java-stdlib-bypass-tls-verification-bypass-tls-verification" }, { "tool": "Semgrep", "id": "problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification", "aliases": [ "bypass-tls-verification" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/problem-based-packs/insecure-transport/js-node/bypass-tls-verification.yaml", "cards": [ "tls-certificate-validation-node-express" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-problem-based-packs-insecure-transport-js-node-bypass-tls-verification-bypass-tls-verification" }, { "tool": "Semgrep", "id": "python.django.security.audit.csrf-exempt.no-csrf-exempt", "aliases": [ "no-csrf-exempt" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/csrf-exempt.yaml", "cards": [ "csrf-python-django" ], "helpUri": "https://softwaresecurity.com/fix/csrf/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-audit-csrf-exempt-no-csrf-exempt" }, { "tool": "Semgrep", "id": "python.django.security.audit.unvalidated-password.unvalidated-password", "aliases": [ "unvalidated-password" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/unvalidated-password.yaml", "cards": [ "password-hashing-python-django" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-audit-unvalidated-password-unvalidated-password" }, { "tool": "Semgrep", "id": "python.django.security.audit.xss.template-autoescape-off.template-autoescape-off", "aliases": [ "template-autoescape-off" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/audit/xss/template-autoescape-off.yaml", "cards": [ "xss-python-django" ], "helpUri": "https://softwaresecurity.com/fix/xss/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-audit-xss-template-autoescape-off-template-autoescape-off" }, { "tool": "Semgrep", "id": "python.django.security.injection.csv-writer-injection.csv-writer-injection", "aliases": [ "csv-writer-injection" ], "documentation": "https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection", "cards": [ "csv-formula-injection-python-django" ], "helpUri": "https://softwaresecurity.com/fix/csv-formula-injection/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-csv-writer-injection-csv-writer-injection" }, { "tool": "Semgrep", "id": "python.django.security.injection.mass-assignment.mass-assignment", "aliases": [ "mass-assignment" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/injection/mass-assignment.yaml", "cards": [ "mass-assignment-python-flask", "mass-assignment-python-fastapi", "mass-assignment-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-mass-assignment-mass-assignment", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-mass-assignment-mass-assignment" }, { "tool": "Semgrep", "id": "python.django.security.injection.open-redirect.open-redirect", "aliases": [ "open-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/injection/open-redirect.yaml", "cards": [ "open-redirect-python-django" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-open-redirect-open-redirect" }, { "tool": "Semgrep", "id": "python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name", "aliases": [ "path-traversal-file-name" ], "documentation": "https://github.com/semgrep/semgrep-rules/tree/develop/python/django/security/injection/path-traversal", "cards": [ "path-traversal-python-django" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-path-traversal-path-traversal-file-name-path-traversal-file-name" }, { "tool": "Semgrep", "id": "python.django.security.injection.path-traversal.path-traversal-join.path-traversal-join", "aliases": [ "path-traversal-join" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/injection/path-traversal/path-traversal-join.yaml", "cards": [ "path-traversal-python-django" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-path-traversal-path-traversal-join-path-traversal-join" }, { "tool": "Semgrep", "id": "python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open", "aliases": [ "path-traversal-open" ], "documentation": "https://github.com/semgrep/semgrep-rules/tree/develop/python/django/security/injection/path-traversal", "cards": [ "path-traversal-python-django" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-path-traversal-path-traversal-open-path-traversal-open" }, { "tool": "Semgrep", "id": "python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute", "aliases": [ "sql-injection-db-cursor-execute" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/injection/sql/sql-injection-using-db-cursor-execute.yaml", "cards": [ "sql-injection-python-django" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-sql-sql-injection-using-db-cursor-execute-sql-injection-db-cursor-execute" }, { "tool": "Semgrep", "id": "python.django.security.injection.ssrf.ssrf-injection-requests", "aliases": [ "ssrf-injection-requests" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/django/security/injection/ssrf/ssrf-injection-requests.yaml", "cards": [ "ssrf-python-flask", "ssrf-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-ssrf-ssrf-injection-requests", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-ssrf-ssrf-injection-requests" }, { "tool": "Semgrep", "id": "python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests", "aliases": [ "ssrf-injection-requests" ], "documentation": "https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests", "cards": [ "ssrf-python-django" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-django-security-injection-ssrf-ssrf-injection-requests-ssrf-injection-requests" }, { "tool": "Semgrep", "id": "python.flask.security.audit.flask-cors-misconfiguration.flask-cors-misconfiguration", "aliases": [ "flask-cors-misconfiguration" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/audit/flask-cors-misconfiguration.yaml", "cards": [ "cors-misconfiguration-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-audit-flask-cors-misconfiguration-flask-cors-misconfiguration" }, { "tool": "Semgrep", "id": "python.flask.security.audit.render-template-string.render-template-string", "aliases": [ "render-template-string" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/audit/render-template-string.yaml", "cards": [ "template-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/template-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-audit-render-template-string-render-template-string" }, { "tool": "Semgrep", "id": "python.flask.security.audit.secure-set-cookie.secure-set-cookie", "aliases": [ "secure-set-cookie" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/audit/secure-set-cookie.yaml", "cards": [ "session-cookies-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-audit-secure-set-cookie-secure-set-cookie" }, { "tool": "Semgrep", "id": "python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled", "aliases": [ "flask-wtf-csrf-disabled" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/audit/wtf-csrf-disabled.yaml", "cards": [ "csrf-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/csrf/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-audit-wtf-csrf-disabled-flask-wtf-csrf-disabled" }, { "tool": "Semgrep", "id": "python.flask.security.dangerous-template-string.dangerous-template-string", "aliases": [ "dangerous-template-string" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/dangerous-template-string.yaml", "cards": [ "template-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/template-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-dangerous-template-string-dangerous-template-string" }, { "tool": "Semgrep", "id": "python.flask.security.injection.csv-writer-injection.csv-writer-injection", "aliases": [ "csv-writer-injection" ], "documentation": "https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection", "cards": [ "csv-formula-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/csv-formula-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-injection-csv-writer-injection-csv-writer-injection" }, { "tool": "Semgrep", "id": "python.flask.security.injection.path-traversal-open.path-traversal-open", "aliases": [ "path-traversal-open" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/injection/path-traversal-open.yaml", "cards": [ "path-traversal-python-flask", "file-upload-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-injection-path-traversal-open-path-traversal-open", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-injection-path-traversal-open-path-traversal-open" }, { "tool": "Semgrep", "id": "python.flask.security.injection.tainted-sql-string.tainted-sql-string", "aliases": [ "tainted-sql-string" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/injection/tainted-sql-string.yaml", "cards": [ "sql-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-injection-tainted-sql-string-tainted-sql-string" }, { "tool": "Semgrep", "id": "python.flask.security.open-redirect.open-redirect", "aliases": [ "open-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/open-redirect.yaml", "cards": [ "open-redirect-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-open-redirect-open-redirect" }, { "tool": "Semgrep", "id": "python.flask.security.xss.audit.template-unescaped-with-safe.template-unescaped-with-safe", "aliases": [ "template-unescaped-with-safe" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/xss/audit/template-unescaped-with-safe.yaml", "cards": [ "xss-python-flask", "xss-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-xss-audit-template-unescaped-with-safe-template-unescaped-with-safe", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-xss-audit-template-unescaped-with-safe-template-unescaped-with-safe" }, { "tool": "Semgrep", "id": "python.flask.security.xss.audit.template-unquoted-attribute-var.template-unquoted-attribute-var", "aliases": [ "template-unquoted-attribute-var" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/flask/security/xss/audit/template-unquoted-attribute-var.yaml", "cards": [ "xss-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/xss/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-flask-security-xss-audit-template-unquoted-attribute-var-template-unquoted-attribute-var" }, { "tool": "Semgrep", "id": "python.jwt.security.jwt-none-alg.jwt-python-none-alg", "aliases": [ "jwt-python-none-alg" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/jwt/security/jwt-none-alg.yaml", "cards": [ "jwt-validation-python-flask", "jwt-validation-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-jwt-security-jwt-none-alg-jwt-python-none-alg", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-jwt-security-jwt-none-alg-jwt-python-none-alg" }, { "tool": "Semgrep", "id": "python.jwt.security.unverified-jwt-decode.unverified-jwt-decode", "aliases": [ "unverified-jwt-decode" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/jwt/security/unverified-jwt-decode.yaml", "cards": [ "jwt-validation-python-flask", "jwt-validation-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-jwt-security-unverified-jwt-decode-unverified-jwt-decode", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-jwt-security-unverified-jwt-decode-unverified-jwt-decode" }, { "tool": "Semgrep", "id": "python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit", "aliases": [ "dangerous-subprocess-use-audit" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/audit/dangerous-subprocess-use-audit.yaml", "cards": [ "command-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-dangerous-subprocess-use-audit-dangerous-subprocess-use-audit" }, { "tool": "Semgrep", "id": "python.lang.security.audit.eval-detected.eval-detected", "aliases": [ "eval-detected" ], "documentation": "https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected", "cards": [ "code-injection-python-flask", "code-injection-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-eval-detected-eval-detected", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-eval-detected-eval-detected" }, { "tool": "Semgrep", "id": "python.lang.security.audit.formatted-sql-query.formatted-sql-query", "aliases": [ "formatted-sql-query" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/audit/formatted-sql-query.yaml", "cards": [ "sql-injection-python-flask", "sql-injection-python-fastapi", "sql-injection-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-formatted-sql-query-formatted-sql-query", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-formatted-sql-query-formatted-sql-query" }, { "tool": "Semgrep", "id": "python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure", "aliases": [ "python-logger-credential-disclosure" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/audit/logging/logger-credential-leak.yaml", "cards": [ "hardcoded-secrets-python-flask", "jwt-validation-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-logging-logger-credential-leak-python-logger-credential-disclosure", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-logging-logger-credential-leak-python-logger-credential-disclosure" }, { "tool": "Semgrep", "id": "python.lang.security.audit.md5-used-as-password.md5-used-as-password", "aliases": [ "md5-used-as-password" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/audit/md5-used-as-password.yaml", "cards": [ "password-hashing-python-flask", "password-hashing-python-fastapi", "password-hashing-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-md5-used-as-password-md5-used-as-password", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-md5-used-as-password-md5-used-as-password" }, { "tool": "Semgrep", "id": "python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation", "aliases": [ "disabled-cert-validation" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/audit/network/disabled-cert-validation.yaml", "cards": [ "tls-certificate-validation-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-network-disabled-cert-validation-disabled-cert-validation" }, { "tool": "Semgrep", "id": "python.lang.security.audit.subprocess-shell-true.subprocess-shell-true", "aliases": [ "subprocess-shell-true" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/audit/subprocess-shell-true.yaml", "cards": [ "command-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-audit-subprocess-shell-true-subprocess-shell-true" }, { "tool": "Semgrep", "id": "python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load", "aliases": [ "avoid-pyyaml-load" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/deserialization/avoid-pyyaml-load.yaml", "cards": [ "deserialization-python-flask", "deserialization-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-deserialization-avoid-pyyaml-load-avoid-pyyaml-load", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-deserialization-avoid-pyyaml-load-avoid-pyyaml-load" }, { "tool": "Semgrep", "id": "python.lang.security.deserialization.pickle.avoid-pickle", "aliases": [ "avoid-pickle" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/deserialization/pickle.yaml", "cards": [ "deserialization-python-flask", "deserialization-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-deserialization-pickle-avoid-pickle", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-deserialization-pickle-avoid-pickle" }, { "tool": "Semgrep", "id": "python.lang.security.use-defused-xml.use-defused-xml", "aliases": [ "use-defused-xml" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/lang/security/use-defused-xml.yaml", "cards": [ "xxe-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/xxe/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-use-defused-xml-use-defused-xml" }, { "tool": "Semgrep", "id": "python.lang.security.use-defusedcsv.use-defusedcsv", "aliases": [ "use-defusedcsv" ], "documentation": "https://semgrep.dev/r/python.lang.security.use-defusedcsv.use-defusedcsv", "cards": [ "csv-formula-injection-python-flask", "csv-formula-injection-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-use-defusedcsv-use-defusedcsv", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-lang-security-use-defusedcsv-use-defusedcsv" }, { "tool": "Semgrep", "id": "python.requests.security.disabled-cert-validation.disabled-cert-validation", "aliases": [ "disabled-cert-validation" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/requests/security/disabled-cert-validation.yaml", "cards": [ "tls-certificate-validation-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-requests-security-disabled-cert-validation-disabled-cert-validation" }, { "tool": "Semgrep", "id": "python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text", "aliases": [ "avoid-sqlalchemy-text" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/sqlalchemy/security/audit/avoid-sqlalchemy-text.yaml", "cards": [ "sql-injection-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/python-fastapi/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-sqlalchemy-security-audit-avoid-sqlalchemy-text-avoid-sqlalchemy-text" }, { "tool": "Semgrep", "id": "python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query", "aliases": [ "sqlalchemy-execute-raw-query" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/python/sqlalchemy/security/sqlalchemy-execute-raw-query.yaml", "cards": [ "sql-injection-python-fastapi", "sql-injection-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#semgrep-python-sqlalchemy-security-sqlalchemy-execute-raw-query-sqlalchemy-execute-raw-query", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-python-sqlalchemy-security-sqlalchemy-execute-raw-query-sqlalchemy-execute-raw-query" }, { "tool": "Semgrep", "id": "ruby.lang.security.missing-csrf-protection.missing-csrf-protection", "aliases": [ "missing-csrf-protection" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/lang/security/missing-csrf-protection.yaml", "cards": [ "csrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/csrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-lang-security-missing-csrf-protection-missing-csrf-protection" }, { "tool": "Semgrep", "id": "ruby.lang.security.model-attr-accessible.model-attr-accessible", "aliases": [ "model-attr-accessible" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/lang/security/model-attr-accessible.yaml", "cards": [ "mass-assignment-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/mass-assignment/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-lang-security-model-attr-accessible-model-attr-accessible" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.avoid-tainted-file-access.avoid-tainted-file-access", "aliases": [ "avoid-tainted-file-access" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/audit/avoid-tainted-file-access.yaml", "cards": [ "path-traversal-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-audit-avoid-tainted-file-access-avoid-tainted-file-access" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection", "aliases": [ "rails-skip-forgery-protection" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/audit/rails-skip-forgery-protection.yaml", "cards": [ "csrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/csrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-audit-rails-skip-forgery-protection-rails-skip-forgery-protection" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.avoid-redirect.avoid-redirect", "aliases": [ "avoid-redirect" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/audit/xss/avoid-redirect.yaml", "cards": [ "open-redirect-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-audit-xss-avoid-redirect-avoid-redirect" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.templates.alias-for-html-safe.alias-for-html-safe", "aliases": [ "alias-for-html-safe" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/audit/xss/templates/alias-for-html-safe.yaml", "cards": [ "xss-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/xss/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-audit-xss-templates-alias-for-html-safe-alias-for-html-safe" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.templates.avoid-html-safe.avoid-html-safe", "aliases": [ "avoid-html-safe" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/audit/xss/templates/avoid-html-safe.yaml", "cards": [ "xss-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/xss/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-audit-xss-templates-avoid-html-safe-avoid-html-safe" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.templates.avoid-raw.avoid-raw", "aliases": [ "avoid-raw" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/audit/xss/templates/avoid-raw.yaml", "cards": [ "xss-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/xss/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-audit-xss-templates-avoid-raw-avoid-raw" }, { "tool": "Semgrep", "id": "ruby.rails.security.audit.xss.templates.dangerous-link-to.dangerous-link-to", "aliases": [ "dangerous-link-to" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/audit/xss/templates/dangerous-link-to.yaml", "cards": [ "xss-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/xss/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-audit-xss-templates-dangerous-link-to-dangerous-link-to" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-cookie-store-session-security-attributes.check-cookie-store-session-security-attributes", "aliases": [ "check-cookie-store-session-security-attributes" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/brakeman/check-cookie-store-session-security-attributes.yaml", "cards": [ "session-cookies-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-brakeman-check-cookie-store-session-security-attributes-check-cookie-store-session-security-attributes" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-permit-attributes-high.check-permit-attributes-high", "aliases": [ "check-permit-attributes-high" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/brakeman/check-permit-attributes-high.yaml", "cards": [ "mass-assignment-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/mass-assignment/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-brakeman-check-permit-attributes-high-check-permit-attributes-high" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-redirect-to.check-redirect-to", "aliases": [ "check-redirect-to" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/brakeman/check-redirect-to.yaml", "cards": [ "open-redirect-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-brakeman-check-redirect-to-check-redirect-to" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-send-file.check-send-file", "aliases": [ "check-send-file" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/brakeman/check-send-file.yaml", "cards": [ "path-traversal-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-brakeman-check-send-file-check-send-file" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-sql.check-sql", "aliases": [ "check-sql" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/brakeman/check-sql.yaml", "cards": [ "sql-injection-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-brakeman-check-sql-check-sql" }, { "tool": "Semgrep", "id": "ruby.rails.security.brakeman.check-unscoped-find.check-unscoped-find", "aliases": [ "check-unscoped-find" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/brakeman/check-unscoped-find.yaml", "cards": [ "missing-authorization-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/missing-authorization/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-brakeman-check-unscoped-find-check-unscoped-find" }, { "tool": "Semgrep", "id": "ruby.rails.security.injection.tainted-sql-string.tainted-sql-string", "aliases": [ "tainted-sql-string" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/ruby/rails/security/injection/tainted-sql-string.yaml", "cards": [ "sql-injection-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-ruby-rails-security-injection-tainted-sql-string-tainted-sql-string" }, { "tool": "Semgrep", "id": "typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard", "aliases": [ "cors-regex-wildcard" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/typescript/lang/security/audit/cors-regex-wildcard.yaml", "cards": [ "cors-misconfiguration-node-express" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-typescript-lang-security-audit-cors-regex-wildcard-cors-regex-wildcard" }, { "tool": "Semgrep", "id": "typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml", "aliases": [ "react-dangerouslysetinnerhtml" ], "documentation": "https://github.com/semgrep/semgrep-rules/blob/develop/typescript/react/security/audit/react-dangerouslysetinnerhtml.yaml", "cards": [ "xss-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/xss/typescript-nextjs/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#semgrep-typescript-react-security-audit-react-dangerouslysetinnerhtml-react-dangerouslysetinnerhtml" }, { "tool": "CodeQL", "id": "cs/cleartext-storage-of-sensitive-information", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-312/CleartextStorage.ql", "cards": [ "hardcoded-secrets-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-cleartext-storage-of-sensitive-information" }, { "tool": "CodeQL", "id": "cs/code-injection", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-094/CodeInjection.ql", "cards": [ "code-injection-csharp-aspnetcore", "template-injection-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-cs-code-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-code-injection" }, { "tool": "CodeQL", "id": "cs/command-line-injection", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-078/CommandInjection.ql", "cards": [ "command-injection-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-command-line-injection" }, { "tool": "CodeQL", "id": "cs/hardcoded-credentials", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-798/HardcodedCredentials.ql", "cards": [ "hardcoded-secrets-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-hardcoded-credentials" }, { "tool": "CodeQL", "id": "cs/hash-without-salt", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/experimental/Security%20Features/CWE-759/HashWithoutSalt.ql", "cards": [ "password-hashing-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-hash-without-salt" }, { "tool": "CodeQL", "id": "cs/json-webtoken-handler/delegated-security-validations-always-return-true", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/experimental/Security%20Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql", "cards": [ "jwt-validation-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-json-webtoken-handler-delegated-security-validations-always-return-true" }, { "tool": "CodeQL", "id": "cs/json-webtoken-handler/security-validations-disabled", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/experimental/Security%20Features/JsonWebTokenHandler/security-validation-disabled.ql", "cards": [ "jwt-validation-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-json-webtoken-handler-security-validations-disabled" }, { "tool": "CodeQL", "id": "cs/path-injection", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-022/TaintedPath.ql", "cards": [ "path-traversal-csharp-aspnetcore", "file-upload-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-cs-path-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-path-injection" }, { "tool": "CodeQL", "id": "cs/redos", "documentation": "https://codeql.github.com/codeql-query-help/csharp/cs-redos/", "cards": [ "regex-dos-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/regex-dos/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-redos" }, { "tool": "CodeQL", "id": "cs/request-forgery", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/experimental/CWE-918/RequestForgery.ql", "cards": [ "ssrf-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-request-forgery" }, { "tool": "CodeQL", "id": "cs/session-reuse", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-384/AbandonSession.ql", "cards": [ "session-cookies-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-session-reuse" }, { "tool": "CodeQL", "id": "cs/sql-injection", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-089/SqlInjection.ql", "cards": [ "sql-injection-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-sql-injection" }, { "tool": "CodeQL", "id": "cs/unsafe-deserialization", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-502/UnsafeDeserialization.ql", "cards": [ "deserialization-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-unsafe-deserialization" }, { "tool": "CodeQL", "id": "cs/web/cookie-httponly-not-set", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-1004/CookieWithoutHttpOnly.ql", "cards": [ "session-cookies-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-cookie-httponly-not-set" }, { "tool": "CodeQL", "id": "cs/web/cookie-secure-not-set", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-614/CookieWithoutSecure.ql", "cards": [ "session-cookies-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-cookie-secure-not-set" }, { "tool": "CodeQL", "id": "cs/web/file-upload", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Input%20Validation/UseOfFileUpload.ql", "cards": [ "file-upload-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/file-upload/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-file-upload" }, { "tool": "CodeQL", "id": "cs/web/insecure-direct-object-reference", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-639/InsecureDirectObjectReference.ql", "cards": [ "missing-authorization-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/missing-authorization/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-insecure-direct-object-reference" }, { "tool": "CodeQL", "id": "cs/web/missing-function-level-access-control", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-285/MissingAccessControl.ql", "cards": [ "missing-authorization-csharp-aspnetcore", "missing-authentication-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-missing-function-level-access-control", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-missing-function-level-access-control" }, { "tool": "CodeQL", "id": "cs/web/missing-token-validation", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-352/MissingAntiForgeryTokenValidation.ql", "cards": [ "csrf-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/csrf/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-missing-token-validation" }, { "tool": "CodeQL", "id": "cs/web/unvalidated-url-redirection", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-601/UrlRedirect.ql", "cards": [ "open-redirect-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-unvalidated-url-redirection" }, { "tool": "CodeQL", "id": "cs/web/xss", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-079/XSS.ql", "cards": [ "xss-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/xss/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-web-xss" }, { "tool": "CodeQL", "id": "cs/xml/insecure-dtd-handling", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-611/UntrustedDataInsecureXml.ql", "cards": [ "xxe-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/xxe/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-xml-insecure-dtd-handling" }, { "tool": "CodeQL", "id": "cs/xml/xpath-injection", "documentation": "https://github.com/github/codeql/blob/main/csharp/ql/src/Security%20Features/CWE-643/XPathInjection.ql", "cards": [ "xpath-injection-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/xpath-injection/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-cs-xml-xpath-injection" }, { "tool": "CodeQL", "id": "go-security-extended", "documentation": "https://github.com/github/codeql/tree/main/go/ql/src/codeql-suites", "cards": [ "missing-authorization-go-nethttp", "missing-authentication-go-nethttp", "mass-assignment-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-go-security-extended", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-security-extended" }, { "tool": "CodeQL", "id": "go/bad-redirect-check", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-601/BadRedirectCheck.ql", "cards": [ "open-redirect-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-bad-redirect-check" }, { "tool": "CodeQL", "id": "go/command-injection", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-078/CommandInjection.ql", "cards": [ "command-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-command-injection" }, { "tool": "CodeQL", "id": "go/disabled-certificate-check", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-295/DisabledCertificateCheck.ql", "cards": [ "tls-certificate-validation-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-disabled-certificate-check" }, { "tool": "CodeQL", "id": "go/html-template-escaping-bypass-xss", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-079/HtmlTemplateEscapingBypassXss.ql", "cards": [ "xss-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/xss/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-html-template-escaping-bypass-xss" }, { "tool": "CodeQL", "id": "go/insecure-randomness", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-338/InsecureRandomness.ql", "cards": [ "insecure-randomness-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-insecure-randomness" }, { "tool": "CodeQL", "id": "go/insecure-tls", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-327/InsecureTLS.ql", "cards": [ "tls-certificate-validation-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-insecure-tls" }, { "tool": "CodeQL", "id": "go/missing-jwt-signature-check", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-347/MissingJwtSignatureCheck.ql", "cards": [ "jwt-validation-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-missing-jwt-signature-check" }, { "tool": "CodeQL", "id": "go/path-injection", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-022/TaintedPath.ql", "cards": [ "path-traversal-go-nethttp", "file-upload-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-go-path-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-path-injection" }, { "tool": "CodeQL", "id": "go/reflected-xss", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-079/ReflectedXss.ql", "cards": [ "xss-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/xss/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-reflected-xss" }, { "tool": "CodeQL", "id": "go/request-forgery", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-918/RequestForgery.ql", "cards": [ "ssrf-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-request-forgery" }, { "tool": "CodeQL", "id": "go/sql-injection", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-089/SqlInjection.ql", "cards": [ "sql-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-sql-injection" }, { "tool": "CodeQL", "id": "go/uncontrolled-allocation-size", "documentation": "https://github.com/github/codeql/tree/main/go/ql/src", "cards": [ "resource-limits-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/resource-limits/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-uncontrolled-allocation-size" }, { "tool": "CodeQL", "id": "go/unvalidated-url-redirection", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-601/OpenUrlRedirect.ql", "cards": [ "open-redirect-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-unvalidated-url-redirection" }, { "tool": "CodeQL", "id": "go/weak-sensitive-data-hashing", "documentation": "https://github.com/github/codeql/blob/main/go/ql/src/Security/CWE-327/WeakSensitiveDataHashing.ql", "cards": [ "password-hashing-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-go-weak-sensitive-data-hashing" }, { "tool": "CodeQL", "id": "java/command-line-injection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql", "cards": [ "command-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-command-line-injection" }, { "tool": "CodeQL", "id": "java/concatenated-sql-query", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql", "cards": [ "sql-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-concatenated-sql-query" }, { "tool": "CodeQL", "id": "java/csrf-unprotected-request-type", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-352/CsrfUnprotectedRequestType.ql", "cards": [ "csrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/csrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-csrf-unprotected-request-type" }, { "tool": "CodeQL", "id": "java/hardcoded-credential-api-call", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-798/HardcodedCredentialsApiCall.ql", "cards": [ "hardcoded-secrets-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-hardcoded-credential-api-call" }, { "tool": "CodeQL", "id": "java/hash-without-salt", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.ql", "cards": [ "password-hashing-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-hash-without-salt" }, { "tool": "CodeQL", "id": "java/http-response-splitting", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-113/ResponseSplitting.ql", "cards": [ "crlf-log-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/crlf-log-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-http-response-splitting" }, { "tool": "CodeQL", "id": "java/insecure-cookie", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-614/InsecureCookie.ql", "cards": [ "session-cookies-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-insecure-cookie" }, { "tool": "CodeQL", "id": "java/insecure-randomness", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-330/InsecureRandomness.ql", "cards": [ "insecure-randomness-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-insecure-randomness" }, { "tool": "CodeQL", "id": "java/insecure-trustmanager", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-295/InsecureTrustManager.ql", "cards": [ "tls-certificate-validation-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-insecure-trustmanager" }, { "tool": "CodeQL", "id": "java/ldap-injection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-090/LdapInjection.ql", "cards": [ "ldap-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/ldap-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-ldap-injection" }, { "tool": "CodeQL", "id": "java/log-injection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-117/LogInjection.ql", "cards": [ "crlf-log-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/crlf-log-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-log-injection" }, { "tool": "CodeQL", "id": "java/missing-jwt-signature-check", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-347/MissingJWTSignatureCheck.ql", "cards": [ "jwt-validation-java-spring", "missing-authentication-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-java-missing-jwt-signature-check", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-missing-jwt-signature-check" }, { "tool": "CodeQL", "id": "java/partial-path-traversal-from-remote", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql", "cards": [ "path-traversal-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-partial-path-traversal-from-remote" }, { "tool": "CodeQL", "id": "java/path-injection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-022/TaintedPath.ql", "cards": [ "path-traversal-java-spring", "file-upload-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-java-path-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-path-injection" }, { "tool": "CodeQL", "id": "java/predictable-seed", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-335/PredictableSeed.ql", "cards": [ "insecure-randomness-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-predictable-seed" }, { "tool": "CodeQL", "id": "java/redos", "documentation": "https://codeql.github.com/codeql-query-help/java/java-redos/", "cards": [ "regex-dos-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/regex-dos/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-redos" }, { "tool": "CodeQL", "id": "java/sensitive-cookie-not-httponly", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-1004/SensitiveCookieNotHttpOnly.ql", "cards": [ "session-cookies-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-sensitive-cookie-not-httponly" }, { "tool": "CodeQL", "id": "java/sensitive-log", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-532/SensitiveInfoLog.ql", "cards": [ "hardcoded-secrets-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-sensitive-log" }, { "tool": "CodeQL", "id": "java/server-side-template-injection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-094/TemplateInjection.ql", "cards": [ "template-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/template-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-server-side-template-injection" }, { "tool": "CodeQL", "id": "java/spel-expression-injection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-094/SpelInjection.ql", "cards": [ "code-injection-java-spring", "template-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-java-spel-expression-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-spel-expression-injection" }, { "tool": "CodeQL", "id": "java/spring-disabled-csrf-protection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.ql", "cards": [ "csrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/csrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-spring-disabled-csrf-protection" }, { "tool": "CodeQL", "id": "java/sql-injection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-089/SqlTainted.ql", "cards": [ "sql-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-sql-injection" }, { "tool": "CodeQL", "id": "java/ssrf", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-918/RequestForgery.ql", "cards": [ "ssrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-ssrf" }, { "tool": "CodeQL", "id": "java/unsafe-deserialization", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql", "cards": [ "deserialization-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-unsafe-deserialization" }, { "tool": "CodeQL", "id": "java/unsafe-hostname-verification", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-297/UnsafeHostnameVerification.ql", "cards": [ "tls-certificate-validation-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-unsafe-hostname-verification" }, { "tool": "CodeQL", "id": "java/unvalidated-cors-origin-set", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql", "cards": [ "cors-misconfiguration-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-unvalidated-cors-origin-set" }, { "tool": "CodeQL", "id": "java/unvalidated-url-redirection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-601/UrlRedirect.ql", "cards": [ "open-redirect-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-unvalidated-url-redirection" }, { "tool": "CodeQL", "id": "java/xml/xpath-injection", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-643/XPathInjection.ql", "cards": [ "xpath-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xpath-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-xml-xpath-injection" }, { "tool": "CodeQL", "id": "java/xss", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-079/XSS.ql", "cards": [ "xss-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xss/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-xss" }, { "tool": "CodeQL", "id": "java/xxe", "documentation": "https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-611/XXE.ql", "cards": [ "xxe-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xxe/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-java-xxe" }, { "tool": "CodeQL", "id": "js/clear-text-cookie", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-614/ClearTextCookie.ql", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-clear-text-cookie" }, { "tool": "CodeQL", "id": "js/clear-text-logging", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-312/CleartextLogging.ql", "cards": [ "hardcoded-secrets-node-express" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-clear-text-logging" }, { "tool": "CodeQL", "id": "js/client-exposed-cookie", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-1004/ClientExposedCookie.ql", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-client-exposed-cookie" }, { "tool": "CodeQL", "id": "js/code-injection", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-094/CodeInjection.ql", "cards": [ "code-injection-node-express", "template-injection-node-express" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-code-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-code-injection" }, { "tool": "CodeQL", "id": "js/command-line-injection", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-078/CommandInjection.ql", "cards": [ "command-injection-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/typescript-nextjs/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-command-line-injection" }, { "tool": "CodeQL", "id": "js/cors-misconfiguration-for-credentials", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-346/CorsMisconfigurationForCredentials.ql", "cards": [ "cors-misconfiguration-node-express" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-cors-misconfiguration-for-credentials" }, { "tool": "CodeQL", "id": "js/cors-permissive-configuration", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-942/CorsPermissiveConfiguration.ql", "cards": [ "cors-misconfiguration-node-express" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-cors-permissive-configuration" }, { "tool": "CodeQL", "id": "js/decode-jwt-without-verification", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/experimental/Security/CWE-347/decodeJwtWithoutVerification.ql", "cards": [ "jwt-validation-node-express", "jwt-validation-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-decode-jwt-without-verification", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-decode-jwt-without-verification" }, { "tool": "CodeQL", "id": "js/disabling-certificate-validation", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-295/DisablingCertificateValidation.ql", "cards": [ "tls-certificate-validation-node-express" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-disabling-certificate-validation" }, { "tool": "CodeQL", "id": "js/hardcoded-credentials", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-798/HardcodedCredentials.ql", "cards": [ "hardcoded-secrets-node-express" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-hardcoded-credentials" }, { "tool": "CodeQL", "id": "js/http-to-file-access", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql", "cards": [ "file-upload-node-express", "file-upload-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-http-to-file-access", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-http-to-file-access" }, { "tool": "CodeQL", "id": "js/insecure-randomness", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-338/InsecureRandomness.ql", "cards": [ "insecure-randomness-node-express" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-insecure-randomness" }, { "tool": "CodeQL", "id": "js/insufficient-password-hash", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-916/InsufficientPasswordHash.ql", "cards": [ "password-hashing-node-express" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-insufficient-password-hash" }, { "tool": "CodeQL", "id": "js/jwt-missing-verification", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-347/MissingJWTKeyVerification.ql", "cards": [ "jwt-validation-node-express" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-jwt-missing-verification" }, { "tool": "CodeQL", "id": "js/log-injection", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-117/LogInjection.ql", "cards": [ "crlf-log-injection-node-express" ], "helpUri": "https://softwaresecurity.com/fix/crlf-log-injection/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-log-injection" }, { "tool": "CodeQL", "id": "js/missing-token-validation", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-352/MissingCsrfMiddleware.ql", "cards": [ "csrf-node-express" ], "helpUri": "https://softwaresecurity.com/fix/csrf/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-missing-token-validation" }, { "tool": "CodeQL", "id": "js/path-injection", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-022/TaintedPath.ql", "cards": [ "path-traversal-node-express", "path-traversal-typescript-nextjs", "file-upload-node-express" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-path-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-path-injection" }, { "tool": "CodeQL", "id": "js/prototype-polluting-assignment", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-915/PrototypePollutingAssignment.ql", "cards": [ "deserialization-node-express", "mass-assignment-node-express" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-prototype-polluting-assignment", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-prototype-polluting-assignment" }, { "tool": "CodeQL", "id": "js/prototype-pollution", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-915/PrototypePollutingMergeCall.ql", "cards": [ "mass-assignment-node-express", "mass-assignment-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-prototype-pollution", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-prototype-pollution" }, { "tool": "CodeQL", "id": "js/redos", "documentation": "https://codeql.github.com/codeql-query-help/javascript/js-redos/", "cards": [ "regex-dos-node-express" ], "helpUri": "https://softwaresecurity.com/fix/regex-dos/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-redos" }, { "tool": "CodeQL", "id": "js/reflected-xss", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-079/ReflectedXss.ql", "cards": [ "xss-node-express" ], "helpUri": "https://softwaresecurity.com/fix/xss/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-reflected-xss" }, { "tool": "CodeQL", "id": "js/request-forgery", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-918/RequestForgery.ql", "cards": [ "ssrf-node-express", "ssrf-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-request-forgery", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-request-forgery" }, { "tool": "CodeQL", "id": "js/second-order-command-line-injection", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-078/SecondOrderCommandInjection.ql", "cards": [ "command-injection-node-express", "command-injection-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-second-order-command-line-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-second-order-command-line-injection" }, { "tool": "CodeQL", "id": "js/server-side-unvalidated-url-redirection", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-601/ServerSideUrlRedirect.ql", "cards": [ "open-redirect-node-express", "open-redirect-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-server-side-unvalidated-url-redirection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-server-side-unvalidated-url-redirection" }, { "tool": "CodeQL", "id": "js/session-fixation", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-384/SessionFixation.ql", "cards": [ "session-cookies-node-express" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-session-fixation" }, { "tool": "CodeQL", "id": "js/shell-command-injection-from-environment", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql", "cards": [ "command-injection-node-express" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-shell-command-injection-from-environment" }, { "tool": "CodeQL", "id": "js/sql-injection", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-089/SqlInjection.ql", "cards": [ "nosql-injection-node-express", "sql-injection-node-express", "sql-injection-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-js-sql-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-sql-injection" }, { "tool": "CodeQL", "id": "js/unsafe-deserialization", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-502/UnsafeDeserialization.ql", "cards": [ "deserialization-node-express" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-unsafe-deserialization" }, { "tool": "CodeQL", "id": "js/xss", "documentation": "https://github.com/github/codeql/blob/main/javascript/ql/src/Security/CWE-079/Xss.ql", "cards": [ "xss-typescript-nextjs" ], "helpUri": "https://softwaresecurity.com/fix/xss/typescript-nextjs/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-js-xss" }, { "tool": "CodeQL", "id": "py/clear-text-logging-sensitive-data", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-312/CleartextLogging.ql", "cards": [ "hardcoded-secrets-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-clear-text-logging-sensitive-data" }, { "tool": "CodeQL", "id": "py/client-exposed-cookie", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-1004/NonHttpOnlyCookie.ql", "cards": [ "session-cookies-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-client-exposed-cookie" }, { "tool": "CodeQL", "id": "py/code-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-094/CodeInjection.ql", "cards": [ "code-injection-python-flask", "code-injection-python-fastapi", "template-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-code-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-code-injection" }, { "tool": "CodeQL", "id": "py/command-line-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-078/CommandInjection.ql", "cards": [ "command-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-command-line-injection" }, { "tool": "CodeQL", "id": "py/cors-bypass", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/experimental/Security/CWE-346/CorsBypass.ql", "cards": [ "cors-misconfiguration-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-cors-bypass" }, { "tool": "CodeQL", "id": "py/cors-misconfiguration-with-credentials", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/experimental/Security/CWE-942/CorsMisconfigurationMiddleware.ql", "cards": [ "cors-misconfiguration-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-cors-misconfiguration-with-credentials" }, { "tool": "CodeQL", "id": "py/csrf-protection-disabled", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-352/CSRFProtectionDisabled.ql", "cards": [ "csrf-python-flask", "csrf-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-csrf-protection-disabled", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-csrf-protection-disabled" }, { "tool": "CodeQL", "id": "py/full-ssrf", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-918/FullServerSideRequestForgery.ql", "cards": [ "ssrf-python-flask", "ssrf-python-fastapi", "ssrf-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-full-ssrf", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-full-ssrf" }, { "tool": "CodeQL", "id": "py/hardcoded-credentials", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-798/HardcodedCredentials.ql", "cards": [ "hardcoded-secrets-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-hardcoded-credentials" }, { "tool": "CodeQL", "id": "py/http-response-splitting", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-113/HeaderInjection.ql", "cards": [ "crlf-log-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/crlf-log-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-http-response-splitting" }, { "tool": "CodeQL", "id": "py/insecure-cookie", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-614/InsecureCookie.ql", "cards": [ "session-cookies-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-insecure-cookie" }, { "tool": "CodeQL", "id": "py/jwt-missing-verification", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/experimental/Security/CWE-347/JWTMissingSecretOrPublicKeyVerification.ql", "cards": [ "jwt-validation-python-flask", "jwt-validation-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-jwt-missing-verification", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-jwt-missing-verification" }, { "tool": "CodeQL", "id": "py/ldap-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-090/LdapInjection.ql", "cards": [ "ldap-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/ldap-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-ldap-injection" }, { "tool": "CodeQL", "id": "py/log-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-117/LogInjection.ql", "cards": [ "crlf-log-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/crlf-log-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-log-injection" }, { "tool": "CodeQL", "id": "py/nosql-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-943/NoSqlInjection.ql", "cards": [ "nosql-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/nosql-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-nosql-injection" }, { "tool": "CodeQL", "id": "py/path-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-022/PathInjection.ql", "cards": [ "path-traversal-python-flask", "path-traversal-python-fastapi", "path-traversal-python-django", "file-upload-python-flask", "file-upload-python-fastapi", "file-upload-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-path-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-path-injection" }, { "tool": "CodeQL", "id": "py/redos", "documentation": "https://codeql.github.com/codeql-query-help/python/py-redos/", "cards": [ "regex-dos-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/regex-dos/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-redos" }, { "tool": "CodeQL", "id": "py/reflective-xss", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-079/ReflectedXss.ql", "cards": [ "xss-python-flask", "xss-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-reflective-xss", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-reflective-xss" }, { "tool": "CodeQL", "id": "py/request-without-cert-validation", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-295/RequestWithoutValidation.ql", "cards": [ "tls-certificate-validation-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-request-without-cert-validation" }, { "tool": "CodeQL", "id": "py/sql-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-089/SqlInjection.ql", "cards": [ "sql-injection-python-flask", "sql-injection-python-fastapi", "sql-injection-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-sql-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-sql-injection" }, { "tool": "CodeQL", "id": "py/template-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-074/TemplateInjection.ql", "cards": [ "template-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/template-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-template-injection" }, { "tool": "CodeQL", "id": "py/unsafe-deserialization", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-502/UnsafeDeserialization.ql", "cards": [ "deserialization-python-flask", "deserialization-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-unsafe-deserialization", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-unsafe-deserialization" }, { "tool": "CodeQL", "id": "py/url-redirection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-601/UrlRedirect.ql", "cards": [ "open-redirect-python-flask", "open-redirect-python-fastapi", "open-redirect-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-url-redirection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-url-redirection" }, { "tool": "CodeQL", "id": "py/weak-sensitive-data-hashing", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-327/WeakSensitiveDataHashing.ql", "cards": [ "password-hashing-python-flask", "password-hashing-python-fastapi", "password-hashing-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-py-weak-sensitive-data-hashing", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-weak-sensitive-data-hashing" }, { "tool": "CodeQL", "id": "py/xpath-injection", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-643/XpathInjection.ql", "cards": [ "xpath-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/xpath-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-xpath-injection" }, { "tool": "CodeQL", "id": "py/xxe", "documentation": "https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-611/Xxe.ql", "cards": [ "xxe-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/xxe/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-py-xxe" }, { "tool": "CodeQL", "id": "rb/csrf-protection-disabled", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-352/CSRFProtectionDisabled.ql", "cards": [ "csrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/csrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-csrf-protection-disabled" }, { "tool": "CodeQL", "id": "rb/csrf-protection-not-enabled", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-352/CSRFProtectionNotEnabled.ql", "cards": [ "csrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/csrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-csrf-protection-not-enabled" }, { "tool": "CodeQL", "id": "rb/csv-injection", "documentation": "https://github.com/github/codeql/tree/main/ruby/ql/src/queries/security", "cards": [ "csv-formula-injection-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/csv-formula-injection/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-csv-injection" }, { "tool": "CodeQL", "id": "rb/insecure-mass-assignment", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-915/MassAssignment.ql", "cards": [ "mass-assignment-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/mass-assignment/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-insecure-mass-assignment" }, { "tool": "CodeQL", "id": "rb/missing-token-validation", "documentation": "https://github.com/github/codeql/tree/main/ruby/ql/src/queries/security", "cards": [ "missing-authentication-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/missing-authentication/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-missing-token-validation" }, { "tool": "CodeQL", "id": "rb/path-injection", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-022/PathInjection.ql", "cards": [ "path-traversal-ruby-rails", "file-upload-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/rules/#codeql-rb-path-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-path-injection" }, { "tool": "CodeQL", "id": "rb/reflected-xss", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-079/ReflectedXSS.ql", "cards": [ "xss-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/xss/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-reflected-xss" }, { "tool": "CodeQL", "id": "rb/request-forgery", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-918/ServerSideRequestForgery.ql", "cards": [ "ssrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-request-forgery" }, { "tool": "CodeQL", "id": "rb/sensitive-get-query", "documentation": "https://github.com/github/codeql/tree/main/ruby/ql/src/queries/security", "cards": [ "missing-authentication-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/missing-authentication/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-sensitive-get-query" }, { "tool": "CodeQL", "id": "rb/sql-injection", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-089/SqlInjection.ql", "cards": [ "sql-injection-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-sql-injection" }, { "tool": "CodeQL", "id": "rb/unsafe-deserialization", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-502/UnsafeDeserialization.ql", "cards": [ "deserialization-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-unsafe-deserialization" }, { "tool": "CodeQL", "id": "rb/url-redirection", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-601/UrlRedirect.ql", "cards": [ "open-redirect-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-url-redirection" }, { "tool": "CodeQL", "id": "rb/weak-cookie-configuration", "documentation": "https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-732/WeakCookieConfiguration.ql", "cards": [ "session-cookies-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#codeql-rb-weak-cookie-configuration" }, { "tool": "gosec", "id": "G107", "name": "URL provided to HTTP request as taint input", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "ssrf-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g107" }, { "tool": "gosec", "id": "G123", "name": "TLS resumption may bypass VerifyPeerCertificate when VerifyConnection is unset", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "tls-certificate-validation-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g123" }, { "tool": "gosec", "id": "G124", "name": "Insecure HTTP cookie configuration", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "open-redirect-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g124" }, { "tool": "gosec", "id": "G201", "name": "SQL query construction using format string", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "sql-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g201" }, { "tool": "gosec", "id": "G202", "name": "SQL query construction using string concatenation", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "sql-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g202" }, { "tool": "gosec", "id": "G203", "name": "Use of unescaped data in HTML templates", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "xss-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/xss/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g203" }, { "tool": "gosec", "id": "G204", "name": "Audit use of command execution", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "command-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g204" }, { "tool": "gosec", "id": "G304", "name": "File path provided as taint input", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "path-traversal-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g304" }, { "tool": "gosec", "id": "G401", "name": "Detect the usage of MD5 or SHA1", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "password-hashing-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g401" }, { "tool": "gosec", "id": "G402", "name": "Look for bad TLS connection settings", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "tls-certificate-validation-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g402" }, { "tool": "gosec", "id": "G404", "name": "Insecure random number source (rand)", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "insecure-randomness-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g404" }, { "tool": "gosec", "id": "G701", "name": "SQL injection via taint analysis", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "sql-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g701" }, { "tool": "gosec", "id": "G702", "name": "Command injection via taint analysis", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "command-injection-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g702" }, { "tool": "gosec", "id": "G703", "name": "Path traversal via taint analysis", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "path-traversal-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g703" }, { "tool": "gosec", "id": "G704", "name": "SSRF via taint analysis", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "ssrf-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g704" }, { "tool": "gosec", "id": "G708", "name": "Server-side template injection via text/template", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "xss-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/xss/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g708" }, { "tool": "gosec", "id": "G710", "name": "Open redirect via taint analysis", "documentation": "https://github.com/securego/gosec/blob/v2.29.0/RULES.md", "cards": [ "open-redirect-go-nethttp" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/go-nethttp/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#gosec-g710" }, { "tool": "Bandit", "id": "B104", "name": "hardcoded_bind_all_interfaces (no SSRF plugin exists)", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/b104_hardcoded_bind_all_interfaces.html", "cards": [ "ssrf-python-fastapi", "ssrf-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#bandit-b104", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b104" }, { "tool": "Bandit", "id": "B105", "name": "blacklist: eval; hardcoded_password_string", "documentation": "https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b307-eval", "cards": [ "code-injection-python-flask", "code-injection-python-fastapi", "hardcoded-secrets-python-flask", "missing-authentication-python-flask", "missing-authentication-python-fastapi", "missing-authentication-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#bandit-b105", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b105" }, { "tool": "Bandit", "id": "B301", "name": "pickle (loads of untrusted data)", "documentation": "https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b301-pickle", "cards": [ "deserialization-python-flask", "deserialization-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#bandit-b301", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b301" }, { "tool": "Bandit", "id": "B307", "name": "blacklist: eval; hardcoded_password_string", "documentation": "https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b307-eval", "cards": [ "code-injection-python-flask", "code-injection-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#bandit-b307", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b307" }, { "tool": "Bandit", "id": "B308", "name": "mark_safe and django_mark_safe", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/b703_django_mark_safe.html", "cards": [ "xss-python-django" ], "helpUri": "https://softwaresecurity.com/fix/xss/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b308" }, { "tool": "Bandit", "id": "B311", "documentation": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random", "cards": [ "insecure-randomness-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b311" }, { "tool": "Bandit", "id": "B324", "name": "hashlib_insecure_functions", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/b324_hashlib.html", "cards": [ "password-hashing-python-flask", "password-hashing-python-fastapi", "password-hashing-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#bandit-b324", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b324" }, { "tool": "Bandit", "id": "B405", "name": "import/use of xml.etree (blacklist)", "documentation": "https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b405-import-xml-etree", "cards": [ "xxe-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/xxe/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b405" }, { "tool": "Bandit", "id": "B501", "name": "request_with_no_cert_validation", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/b501_request_with_no_cert_validation.html", "cards": [ "tls-certificate-validation-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b501" }, { "tool": "Bandit", "id": "B506", "name": "yaml_load", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/b506_yaml_load.html", "cards": [ "deserialization-python-flask", "deserialization-python-fastapi" ], "helpUri": "https://softwaresecurity.com/fix/rules/#bandit-b506", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b506" }, { "tool": "Bandit", "id": "B602", "name": "subprocess_popen_with_shell_equals_true", "documentation": "https://bandit.readthedocs.io/en/1.9.4/plugins/b602_subprocess_popen_with_shell_equals_true.html", "cards": [ "command-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b602" }, { "tool": "Bandit", "id": "B608", "name": "hardcoded_sql_expressions", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/b608_hardcoded_sql_expressions.html", "cards": [ "sql-injection-python-flask", "sql-injection-python-fastapi", "sql-injection-python-django" ], "helpUri": "https://softwaresecurity.com/fix/rules/#bandit-b608", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b608" }, { "tool": "Bandit", "id": "B701", "name": "jinja2_autoescape_false", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html", "cards": [ "xss-python-flask", "template-injection-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/rules/#bandit-b701", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b701" }, { "tool": "Bandit", "id": "B703", "name": "mark_safe and django_mark_safe", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/b703_django_mark_safe.html", "cards": [ "xss-python-django" ], "helpUri": "https://softwaresecurity.com/fix/xss/python-django/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-b703" }, { "tool": "Bandit", "id": "none", "name": "No Bandit test covers session cookies or session fixation", "documentation": "https://bandit.readthedocs.io/en/latest/plugins/index.html", "cards": [ "session-cookies-python-flask" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/python-flask/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#bandit-none" }, { "tool": "Brakeman", "id": "CrossSiteScripting", "name": "Cross-site scripting", "documentation": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting/", "cards": [ "xss-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/xss/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-crosssitescripting" }, { "tool": "Brakeman", "id": "CSRFTokenForgeryCVE", "name": "Cross-site request forgery", "documentation": "https://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/", "cards": [ "csrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/csrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-csrftokenforgerycve" }, { "tool": "Brakeman", "id": "Deserialize", "name": "Brakeman 8.1.0", "documentation": "https://brakemanscanner.org/docs/warning_types/unsafe_deserialization/", "cards": [ "deserialization-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-deserialize" }, { "tool": "Brakeman", "id": "FileAccess", "name": "Brakeman 8.1.0", "documentation": "https://brakemanscanner.org/docs/warning_types/file_access/", "cards": [ "file-upload-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/file-upload/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-fileaccess" }, { "tool": "Brakeman", "id": "ForgerySetting", "name": "Cross-site request forgery", "documentation": "https://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/", "cards": [ "csrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/csrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-forgerysetting" }, { "tool": "Brakeman", "id": "LinkToHref", "name": "Cross-site scripting", "documentation": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting/", "cards": [ "xss-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/xss/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-linktohref" }, { "tool": "Brakeman", "id": "MassAssignment", "name": "Mass assignment", "documentation": "https://brakemanscanner.org/docs/warning_types/mass_assignment/", "cards": [ "mass-assignment-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/mass-assignment/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-massassignment" }, { "tool": "Brakeman", "id": "Pathname", "name": "File access, path traversal", "documentation": "https://brakemanscanner.org/docs/warning_types/file_access/", "cards": [ "path-traversal-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-pathname" }, { "tool": "Brakeman", "id": "PermitAttributes", "name": "Mass assignment", "documentation": "https://brakemanscanner.org/docs/warning_types/mass_assignment/", "cards": [ "mass-assignment-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/mass-assignment/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-permitattributes" }, { "tool": "Brakeman", "id": "Redirect", "name": "Redirect", "documentation": "https://brakemanscanner.org/docs/warning_types/redirect/", "cards": [ "open-redirect-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-redirect" }, { "tool": "Brakeman", "id": "SendFile", "name": "File access, path traversal", "documentation": "https://brakemanscanner.org/docs/warning_types/file_access/", "cards": [ "path-traversal-ruby-rails", "file-upload-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/rules/#brakeman-sendfile", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-sendfile" }, { "tool": "Brakeman", "id": "SessionSettings", "name": "Session settings", "documentation": "https://brakemanscanner.org/docs/warning_types/session_setting/", "cards": [ "session-cookies-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-sessionsettings" }, { "tool": "Brakeman", "id": "SkipBeforeFilter", "name": "Cross-site request forgery", "documentation": "https://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/", "cards": [ "csrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/csrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-skipbeforefilter" }, { "tool": "Brakeman", "id": "SQL", "name": "SQL injection", "documentation": "https://brakemanscanner.org/docs/warning_types/sql_injection/", "cards": [ "sql-injection-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-sql" }, { "tool": "Brakeman", "id": "SSRF", "name": "Brakeman 8.1.0", "documentation": "https://brakemanscanner.org/docs/warning_types/", "cards": [ "ssrf-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-ssrf" }, { "tool": "Brakeman", "id": "UnscopedFind", "name": "Unscoped find", "documentation": "https://brakemanscanner.org/docs/warning_types/unscoped_find/", "cards": [ "missing-authorization-ruby-rails" ], "helpUri": "https://softwaresecurity.com/fix/missing-authorization/ruby-rails/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#brakeman-unscopedfind" }, { "tool": "Psalm", "id": "TaintedFile", "name": "Psalm taint analysis with the Laravel plugin", "documentation": "https://psalm.dev/docs/security_analysis/", "cards": [ "path-traversal-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#psalm-taintedfile" }, { "tool": "Psalm", "id": "TaintedHeader", "name": "Psalm taint analysis with the Laravel plugin", "documentation": "https://psalm.dev/docs/security_analysis/", "cards": [ "open-redirect-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#psalm-taintedheader" }, { "tool": "Psalm", "id": "TaintedHtml", "name": "Psalm taint analysis with the Laravel plugin", "documentation": "https://psalm.dev/docs/security_analysis/", "cards": [ "xss-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/xss/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#psalm-taintedhtml" }, { "tool": "Psalm", "id": "TaintedSql", "name": "Psalm taint analysis with the Laravel plugin", "documentation": "https://psalm.dev/docs/security_analysis/", "cards": [ "sql-injection-php-laravel" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/php-laravel/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#psalm-taintedsql" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "COMMAND_INJECTION", "name": "Potential Command Injection", "documentation": "https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION", "cards": [ "command-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-command-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "ENTITY_MASS_ASSIGNMENT", "name": "Mass assignment", "documentation": "https://find-sec-bugs.github.io/bugs.htm#ENTITY_MASS_ASSIGNMENT", "cards": [ "mass-assignment-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/mass-assignment/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-entity-mass-assignment" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "FILE_UPLOAD_FILENAME", "name": "Tainted filename read", "documentation": "https://find-sec-bugs.github.io/bugs.htm#FILE_UPLOAD_FILENAME", "cards": [ "file-upload-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/file-upload/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-file-upload-filename" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "HARD_CODE_PASSWORD", "name": "Hard coded password (and HARD_CODE_KEY)", "documentation": "https://find-sec-bugs.github.io/bugs.htm#HARD_CODE_PASSWORD", "cards": [ "hardcoded-secrets-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-hard-code-password" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "HTTPONLY_COOKIE", "name": "Cookie without the HttpOnly flag", "documentation": "https://find-sec-bugs.github.io/bugs.htm#HTTPONLY_COOKIE", "cards": [ "session-cookies-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-httponly-cookie" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "INSECURE_COOKIE", "name": "Cookie without the secure flag", "documentation": "https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE", "cards": [ "session-cookies-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-insecure-cookie" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "LDAP_INJECTION", "name": "Potential LDAP Injection", "documentation": "https://find-sec-bugs.github.io/bugs.htm#LDAP_INJECTION", "cards": [ "ldap-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/ldap-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-ldap-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "OBJECT_DESERIALIZATION", "name": "Object deserialization is used (untrusted data)", "documentation": "https://find-sec-bugs.github.io/bugs.htm#OBJECT_DESERIALIZATION", "cards": [ "deserialization-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-object-deserialization" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "PATH_TRAVERSAL_IN", "name": "Potential Path Traversal (file read)", "documentation": "https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN", "cards": [ "path-traversal-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/path-traversal/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-path-traversal-in" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "PERMISSIVE_CORS", "name": "Overly permissive CORS policy", "documentation": "https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS", "cards": [ "cors-misconfiguration-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-permissive-cors" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPEL_INJECTION", "name": "Potential code injection when using Spring Expression", "documentation": "https://find-sec-bugs.github.io/bugs.htm#SPEL_INJECTION", "cards": [ "code-injection-java-spring", "template-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-spel-injection", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-spel-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPRING_CSRF_PROTECTION_DISABLED", "name": "Spring CSRF protection disabled", "documentation": "https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_PROTECTION_DISABLED", "cards": [ "csrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/csrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-spring-csrf-protection-disabled" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING", "name": "Spring CSRF unrestricted RequestMapping", "documentation": "https://find-sec-bugs.github.io/bugs.htm#SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING", "cards": [ "csrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/csrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-spring-csrf-unrestricted-request-mapping" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPRING_ENDPOINT", "name": "Found Spring endpoint", "documentation": "https://find-sec-bugs.github.io/bugs.htm#SPRING_ENDPOINT", "cards": [ "missing-authorization-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/missing-authorization/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-spring-endpoint" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SPRING_UNVALIDATED_REDIRECT", "name": "Spring Unvalidated Redirect (and UNVALIDATED_REDIRECT for sendRedirect)", "documentation": "https://find-sec-bugs.github.io/bugs.htm#SPRING_UNVALIDATED_REDIRECT", "cards": [ "open-redirect-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-spring-unvalidated-redirect" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "SQL_INJECTION_SPRING_JDBC", "name": "Potential JDBC Injection (Spring JDBC)", "documentation": "https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION_SPRING_JDBC", "cards": [ "sql-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-sql-injection-spring-jdbc" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "UNSAFE_HASH_EQUALS", "name": "Unsafe hash equals", "documentation": "https://find-sec-bugs.github.io/bugs.htm#UNSAFE_HASH_EQUALS", "cards": [ "password-hashing-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-unsafe-hash-equals" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "URLCONNECTION_SSRF_FD", "name": "URLConnection Server-Side Request Forgery and File Disclosure", "documentation": "https://find-sec-bugs.github.io/bugs.htm#URLCONNECTION_SSRF_FD", "cards": [ "ssrf-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/ssrf/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-urlconnection-ssrf-fd" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "WEAK_TRUST_MANAGER", "name": "TrustManager that accept any certificates (SECWTM, CWE-295)", "documentation": "https://find-sec-bugs.github.io/bugs.htm#WEAK_TRUST_MANAGER", "cards": [ "tls-certificate-validation-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-weak-trust-manager" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "XPATH_INJECTION", "name": "Potential XPath Injection", "documentation": "https://find-sec-bugs.github.io/bugs.htm#XPATH_INJECTION", "cards": [ "xpath-injection-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xpath-injection/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-xpath-injection" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "XSS_JSP_PRINT", "name": "XSS bug patterns", "documentation": "https://find-sec-bugs.github.io/bugs.htm", "cards": [ "xss-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xss/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-xss-jsp-print" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "XSS_SERVLET", "name": "XSS bug patterns", "documentation": "https://find-sec-bugs.github.io/bugs.htm", "cards": [ "xss-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xss/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-xss-servlet" }, { "tool": "Find Security Bugs (SpotBugs)", "id": "XXE_DOCUMENT", "name": "XML parsing vulnerable to XXE (DocumentBuilder)", "documentation": "https://find-sec-bugs.github.io/bugs.htm#XXE_DOCUMENT", "cards": [ "xxe-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/xxe/java-spring/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#find-sec-bugs-xxe-document" }, { "tool": ".NET code analysis", "id": "CA2100", "name": "Review SQL queries for security vulnerabilities", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca2100", "cards": [ "sql-injection-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/sql-injection/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca2100" }, { "tool": ".NET code analysis", "id": "CA2326", "name": "Do not use TypeNameHandling values other than None", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca2326", "cards": [ "deserialization-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca2326" }, { "tool": ".NET code analysis", "id": "CA2327", "name": "Do not use insecure JsonSerializerSettings", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca2327", "cards": [ "deserialization-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/deserialization/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca2327" }, { "tool": ".NET code analysis", "id": "CA3003", "name": "Review code for file path injection vulnerabilities", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca3003", "cards": [ "path-traversal-csharp-aspnetcore", "file-upload-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca3003", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca3003" }, { "tool": ".NET code analysis", "id": "CA3006", "name": "Review code for process command injection vulnerabilities", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca3006", "cards": [ "command-injection-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca3006" }, { "tool": ".NET code analysis", "id": "CA3007", "name": "Review code for open redirect vulnerabilities", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca3007", "cards": [ "open-redirect-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/open-redirect/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca3007" }, { "tool": ".NET code analysis", "id": "CA3075", "name": "Insecure DTD processing in XML", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca3075", "cards": [ "xxe-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/xxe/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca3075" }, { "tool": ".NET code analysis", "id": "CA3147", "name": "Mark verb handlers with ValidateAntiForgeryToken", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca3147", "cards": [ "csrf-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/csrf/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca3147" }, { "tool": ".NET code analysis", "id": "CA5350", "name": "Do not use weak / broken cryptographic algorithms", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5351", "cards": [ "password-hashing-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5350" }, { "tool": ".NET code analysis", "id": "CA5351", "name": "Do not use weak / broken cryptographic algorithms", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5351", "cards": [ "password-hashing-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5351" }, { "tool": ".NET code analysis", "id": "CA5359", "name": "Do not disable certificate validation", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5359", "cards": [ "tls-certificate-validation-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/tls-certificate-validation/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5359" }, { "tool": ".NET code analysis", "id": "CA5382", "name": "Use secure cookies in ASP.NET Core", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5382", "cards": [ "session-cookies-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/session-cookies/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5382" }, { "tool": ".NET code analysis", "id": "CA5387", "name": "Do not use weak key derivation function with insufficient iteration count", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5387", "cards": [ "password-hashing-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5387" }, { "tool": ".NET code analysis", "id": "CA5388", "name": "Do not use weak key derivation function with insufficient iteration count", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5387", "cards": [ "password-hashing-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/password-hashing/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5388" }, { "tool": ".NET code analysis", "id": "CA5390", "name": "Do not hard-code encryption key", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5390", "cards": [ "hardcoded-secrets-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/hardcoded-secrets/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5390" }, { "tool": ".NET code analysis", "id": "CA5394", "documentation": "https://learn.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/ca5394", "cards": [ "insecure-randomness-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/insecure-randomness/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5394" }, { "tool": ".NET code analysis", "id": "CA5404", "name": "Do not disable token validation checks", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5404", "cards": [ "jwt-validation-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5404" }, { "tool": ".NET code analysis", "id": "CA5405", "name": "Do not always skip token validation in delegates", "documentation": "https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5405", "cards": [ "jwt-validation-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/jwt-validation/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#dotnet-analyzers-ca5405" }, { "tool": "SonarQube", "id": "S2631", "aliases": [ "RSPEC-2631" ], "name": "Regular expressions should not be vulnerable to Denial of Service attacks", "documentation": "https://next.sonarqube.com/sonarqube/coding_rules?open=roslyn.sonaranalyzer.security.cs%3AS2631&rule_key=roslyn.sonaranalyzer.security.cs%3AS2631", "cards": [ "regex-dos-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/regex-dos/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#sonar-s2631" }, { "tool": "SonarQube", "id": "S5122", "aliases": [ "RSPEC-5122" ], "name": "Cross-Origin Resource Sharing (CORS) policy should be restricted to trusted origins", "documentation": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/src/SonarAnalyzer.CSharp/Rules/PermissiveCors.cs", "cards": [ "cors-misconfiguration-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/cors-misconfiguration/csharp-aspnetcore/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#sonar-s5122" }, { "tool": "SonarQube", "id": "S5852", "aliases": [ "RSPEC-5852" ], "name": "Regular expressions should not cause catastrophic backtracking", "documentation": "https://next.sonarqube.com/sonarqube/coding_rules?open=javascript%3AS5852&rule_key=javascript%3AS5852", "cards": [ "regex-dos-node-express", "regex-dos-java-spring" ], "helpUri": "https://softwaresecurity.com/fix/rules/#sonar-s5852", "rulesUrl": "https://softwaresecurity.com/fix/rules/#sonar-s5852" }, { "tool": "ESLint (security plugin)", "id": "security/detect-child-process", "aliases": [ "detect-child-process" ], "name": "detect-child-process", "documentation": "https://github.com/eslint-community/eslint-plugin-security/blob/main/docs/rules/detect-child-process.md", "cards": [ "command-injection-node-express" ], "helpUri": "https://softwaresecurity.com/fix/command-injection/node-express/#scanner-rules", "rulesUrl": "https://softwaresecurity.com/fix/rules/#eslint-security-security-detect-child-process" }, { "tool": "detect-secrets", "id": "KeywordDetector", "name": "Secret Keyword", "documentation": "https://github.com/Yelp/detect-secrets", "cards": [ "hardcoded-secrets-node-express", "hardcoded-secrets-python-flask", "hardcoded-secrets-java-spring", "hardcoded-secrets-csharp-aspnetcore" ], "helpUri": "https://softwaresecurity.com/fix/rules/#detect-secrets-keyworddetector", "rulesUrl": "https://softwaresecurity.com/fix/rules/#detect-secrets-keyworddetector" } ] }