OWASP Top 10 Coverage¶

- cursor.execute()
- connection.execute()
- session.query()
- raw() / execute_raw()
- MySQL, PostgreSQL, SQLite native APIs

# VULNERABLE CODE (DETECTED ✅)
@app.route('/user')
def get_user():
    user_id = request.args.get('id')  # TAINT SOURCE
    query = f"SELECT * FROM users WHERE id = {user_id}"  # TAINT PROPAGATION
    cursor.execute(query)  # DANGEROUS SINK ❌

# Code Scalpel Result:
# ❌ SQL Injection (CWE-89)
# Confidence: HIGH (0.95)
# Taint Path: request.args.get → f-string → cursor.execute
# Recommendation: Use parameterized queries

# SAFE CODE (NO ALERT ✅)
@app.route('/user')
def get_user():
    user_id = request.args.get('id')
    query = "SELECT * FROM users WHERE id = ?"
    cursor.execute(query, (user_id,))  # Parameterized ✅

- render_template_string()
- Markup() without escaping
- response.write()
- innerHTML assignment (JavaScript)
- document.write()

# VULNERABLE CODE (DETECTED ✅)
from flask import request, render_template_string

@app.route('/welcome')
def welcome():
    name = request.args.get('name')  # TAINT SOURCE
    template = f"<h1>Welcome {name}!</h1>"  # TAINT PROPAGATION
    return render_template_string(template)  # DANGEROUS SINK ❌

# Code Scalpel Result:
# ❌ Cross-Site Scripting (CWE-79)
# Confidence: HIGH (0.92)
# Taint Path: request.args.get → f-string → render_template_string
# Attack Vector: /welcome?name=<script>alert(1)</script>
# Recommendation: Use Jinja2 auto-escaping or sanitize input

# SAFE CODE (NO ALERT ✅)
from flask import request, render_template
from markupsafe import escape

@app.route('/welcome')
def welcome():
    name = escape(request.args.get('name'))  # SANITIZED ✅
    return render_template('welcome.html', name=name)

- os.system()
- subprocess.run() / Popen() with shell=True
- exec() / eval() with user input
- __import__() with user input

# VULNERABLE CODE (DETECTED ✅)
import subprocess

def backup_file(filename):
    # User-controlled filename
    subprocess.run(f"tar -czf backup.tar.gz {filename}", shell=True)  # ❌

# Code Scalpel Result:
# ❌ Command Injection (CWE-78)
# Confidence: CRITICAL (0.98)
# Taint Path: filename param → f-string → subprocess.run
# Attack Vector: filename="../etc/passwd; rm -rf /"
# Recommendation: Use subprocess with list arguments, avoid shell=True

# SAFE CODE (NO ALERT ✅)
import subprocess

def backup_file(filename):
    subprocess.run(['tar', '-czf', 'backup.tar.gz', filename])  # ✅

- open()
- Path()
- os.path.join()
- shutil operations

# VULNERABLE CODE (DETECTED ✅)
@app.route('/download')
def download():
    filename = request.args.get('file')  # TAINT SOURCE
    with open(f"/uploads/{filename}", 'r') as f:  # DANGEROUS SINK ❌
        return f.read()

# Code Scalpel Result:
# ❌ Path Traversal (CWE-22)
# Confidence: HIGH (0.91)
# Taint Path: request.args.get → f-string → open
# Attack Vector: /download?file=../../../etc/passwd
# Recommendation: Validate filename, use Path.resolve()

# SAFE CODE (NO ALERT ✅)
from pathlib import Path

@app.route('/download')
def download():
    filename = request.args.get('file')
    base_path = Path('/uploads').resolve()
    file_path = (base_path / filename).resolve()

    # Ensure file is within base_path
    if not str(file_path).startswith(str(base_path)):
        abort(403)

    with open(file_path, 'r') as f:
        return f.read()

- collection.find()
- collection.find_one()
- collection.update_one()
- collection.aggregate()

# VULNERABLE CODE (DETECTED ✅)
from pymongo import MongoClient

def find_user(username):
    query = {"username": username}  # TAINT PROPAGATION
    return db.users.find_one(query)  # POTENTIAL SINK ⚠️

# If called with: find_user({"$ne": None})
# Could bypass authentication!

# Code Scalpel Result:
# ⚠️ Potential NoSQL Injection (CWE-943)
# Confidence: MEDIUM (0.78)
# Taint Path: username param → dict → find_one
# Recommendation: Validate input type is string

- ldap.search_s()
- ldap.search_st()
- ldap.bind_s()

# routes.py (FILE 1)
from database import execute_query

@app.route('/search')
def search():
    term = request.args.get('q')  # TAINT SOURCE
    return execute_query(term)  # TAINT FLOWS ACROSS FILES

# database.py (FILE 2)
def execute_query(query):
    cursor.execute(f"SELECT * FROM items WHERE name LIKE '%{query}%'")  # SINK ❌
    return cursor.fetchall()

# Code Scalpel Result:
# ❌ Cross-File SQL Injection (CWE-89)
# Confidence: HIGH (0.93)
# Taint Path:
#   routes.py:4 request.args.get → term variable
#   routes.py:5 term → execute_query(term)
#   database.py:2 query parameter ← term
#   database.py:3 query → f-string → cursor.execute
# Files Involved: routes.py, database.py
# Recommendation: Sanitize in execute_query or use parameterized queries

- requests.get()
- urllib.request.urlopen()
- http.client.HTTPConnection()
- Webhook calls

# VULNERABLE CODE (DETECTED ✅)
import requests

@app.route('/fetch')
def fetch_url():
    url = request.args.get('url')  # TAINT SOURCE
    response = requests.get(url)  # DANGEROUS SINK ❌
    return response.text

# Code Scalpel Result:
# ❌ Server-Side Request Forgery (CWE-918)
# Confidence: HIGH (0.89)
# Taint Path: request.args.get → url → requests.get
# Attack Vector: /fetch?url=http://internal-service/admin
# Recommendation: Whitelist allowed domains, validate URL scheme

# SAFE CODE (NO ALERT ✅)
from urllib.parse import urlparse

ALLOWED_DOMAINS = ['example.com', 'api.example.com']

@app.route('/fetch')
def fetch_url():
    url = request.args.get('url')
    parsed = urlparse(url)

    if parsed.netloc not in ALLOWED_DOMAINS:
        abort(403)

    response = requests.get(url)  # ✅ Validated
    return response.text

- pickle.loads()
- yaml.load() (without safe loader)
- marshal.loads()
- eval() / exec()

# VULNERABLE CODE (DETECTED ✅)
import pickle

def load_user_session(session_data):
    return pickle.loads(session_data)  # ❌ CRITICAL

# Code Scalpel Result:
# ❌ Insecure Deserialization (CWE-502)
# Confidence: CRITICAL (0.97)
# Taint Path: session_data → pickle.loads
# Recommendation: Use JSON or implement signature verification

# 1. SOURCE
username = request.form.get('username')  # TAINT LEVEL: HIGH

# 2. PROPAGATION
sanitized = username.strip()  # TAINT LEVEL: HIGH (strip doesn't sanitize)
validated = escape(sanitized)  # TAINT LEVEL: LOW (escaped)

# 3. SINK
cursor.execute(f"SELECT * FROM users WHERE name = '{username}'")  # ❌ HIGH TAINT
render_template_string(f"<h1>{validated}</h1>")  # ✅ LOW TAINT (safe)