---
name: vulnerability-patterns
description: "Code vulnerability pattern database. An extension skill for security-analyst that provides language-specific (Python/JS/Java/Go) vulnerable code patterns, CWE classification, safe alternative code, and severity assessment criteria. Use when performing security reviews involving 'vulnerability patterns', 'CWE', 'SQL Injection', 'XSS', 'security vulnerabilities', 'secure coding', 'vulnerable code', etc. Note: penetration testing execution and WAF configuration are outside the scope of this skill."
---

# Vulnerability Patterns — Code Vulnerability Pattern Database

A reference of vulnerable code patterns, CWE classification, and safe alternatives used by the security-analyst agent during security reviews.

## Target Agent

`security-analyst` — Directly applies the vulnerability patterns from this skill to code security analysis.

## Vulnerability Classification System (CWE Top 25)

### Priority Detection Targets

| CWE | Name | Severity | Frequency |
|-----|------|----------|-----------|
| CWE-79 | XSS (Cross-Site Scripting) | High | Very high |
| CWE-89 | SQL Injection | Critical | High |
| CWE-78 | OS Command Injection | Critical | Medium |
| CWE-22 | Path Traversal | High | Medium |
| CWE-352 | CSRF | High | High |
| CWE-798 | Hardcoded Credentials | Critical | High |
| CWE-862 | Missing Authorization | Critical | High |
| CWE-306 | Missing Authentication | Critical | Medium |
| CWE-502 | Deserialization | Critical | Medium |
| CWE-918 | SSRF | High | Medium |

## Language-Specific Vulnerable Code Patterns

### Python

#### SQL Injection (CWE-89)
```python
# Vulnerable
query = f"SELECT * FROM users WHERE name = '{user_input}'"
cursor.execute(query)

# Safe
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))
# Or use ORM (SQLAlchemy, Django ORM)
```

#### Command Injection (CWE-78)
```python
# Vulnerable
os.system(f"ping {user_input}")
subprocess.call(f"ls {user_input}", shell=True)

# Safe
subprocess.run(["ping", user_input], shell=False)
# shlex.quote() for escaping (if unavoidable)
```

#### Path Traversal (CWE-22)
```python
# Vulnerable
file_path = os.path.join(BASE_DIR, user_input)
open(file_path).read()

# Safe
file_path = os.path.realpath(os.path.join(BASE_DIR, user_input))
if not file_path.startswith(os.path.realpath(BASE_DIR)):
    raise ValueError("Invalid path")
```

#### YAML Deserialization (CWE-502)
```python
# Vulnerable
data = yaml.load(user_input)  # Arbitrary code execution possible

# Safe
data = yaml.safe_load(user_input)
```

### JavaScript/TypeScript

#### XSS (CWE-79)
```javascript
// Vulnerable (React)
<div dangerouslySetInnerHTML={{__html: userInput}} />

// Safe
<div>{userInput}</div>  // React auto-escapes
// When needed, use DOMPurify
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userInput)}} />
```

#### Prototype Pollution (CWE-1321)
```javascript
// Vulnerable
function merge(target, source) {
  for (let key in source) {
    target[key] = source[key];  // __proto__ pollution possible
  }
}

// Safe
function merge(target, source) {
  for (let key of Object.keys(source)) {
    if (key === '__proto__' || key === 'constructor') continue;
    target[key] = source[key];
  }
}
// Or use Object.create(null)
```

#### ReDoS (CWE-1333)
```javascript
// Vulnerable (Catastrophic Backtracking)
const regex = /^(a+)+$/;
regex.test("aaaaaaaaaaaaaaaaaaaaaaaaaaaaab");  // Exponential time

// Safe: Use non-backtracking patterns
const regex = /^a+$/;  // Remove nested repetition
```

#### eval/Function Execution (CWE-95)
```javascript
// Vulnerable
eval(userInput);
new Function(userInput)();
setTimeout(userInput, 1000);

// Safe: Never use eval; use alternative logic
```

### Java

#### SQL Injection (CWE-89)
```java
// Vulnerable
String query = "SELECT * FROM users WHERE id = " + userId;
Statement stmt = conn.createStatement();
stmt.executeQuery(query);

// Safe
PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
ps.setInt(1, userId);
ps.executeQuery();
```

#### XXE (CWE-611)
```java
// Vulnerable
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
db.parse(userInput);

// Safe
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
```

#### Deserialization (CWE-502)
```java
// Vulnerable
ObjectInputStream ois = new ObjectInputStream(userInputStream);
Object obj = ois.readObject();  // Arbitrary code execution possible

// Safe: Use JSON/XML serialization (Jackson, Gson)
// Use ObjectInputFilter (Java 9+)
```

### Go

#### SQL Injection (CWE-89)
```go
// Vulnerable
query := fmt.Sprintf("SELECT * FROM users WHERE name = '%s'", userInput)
db.Query(query)

// Safe
db.Query("SELECT * FROM users WHERE name = $1", userInput)
```

#### Path Traversal (CWE-22)
```go
// Vulnerable
http.ServeFile(w, r, filepath.Join(baseDir, r.URL.Path))

// Safe
cleanPath := filepath.Clean(r.URL.Path)
fullPath := filepath.Join(baseDir, cleanPath)
if !strings.HasPrefix(fullPath, baseDir) {
    http.Error(w, "Forbidden", 403)
    return
}
```

## Severity Assessment Criteria

### CVSS v3.1-Based Assessment

| Factor | Weight | Criteria |
|--------|--------|----------|
| Attack Vector | High | Network (remote) > Local |
| Attack Complexity | High | Low complexity > High complexity |
| Privileges Required | Medium | None > Low > High |
| User Interaction | Medium | None > Required |
| Impact (CIA) | High | Each confidentiality/integrity/availability |

### Practical Exploitability Assessment

| Factor | High Risk | Low Risk |
|--------|----------|---------|
| Input source | External user input | Internal config |
| Data sensitivity | PII, credentials | Public data |
| Authentication | Unauthenticated | Admin only |
| Exploit complexity | Simple string injection | Multi-step chain |
| Existing defenses | None | WAF, input validation present |