noorqureshi/security-skills/code-review-dangerous-sinks

Dangerous sinks by language (grep catalog)

When it applies

You're reading source and want the fastest path to bugs: grep every dangerous sink, then trace each hit's argument back to user input.

Why it works

A small set of functions cause most severe bugs (command/code exec, SQL, deserialization, file access, SSRF). Enumerating them turns review into "find the sink → prove the source".

Sinks to grep (trace the argument to a user source)

• Command exec (RCE, CWE-78): PHP system exec shell_exec passthru proc_open · Python

os.system subprocess.*(shell=True) os.popen · Node child_process.exec execSync · Java Runtime.exec ProcessBuilder · Ruby ` system exec backticks %x() · Go exec.Command`.

• Code eval (CWE-94): eval (all), Python exec pickle.loads, Node Function() vm,

PHP eval assert create_function preg_replace/e, Ruby eval send.

• SQL (CWE-89): string-built queries / concatenation into query execute (all ORMs have a

raw path — grep raw, .query(, String.format near SQL).

• Deserialization (CWE-502): Python pickle yaml.load(!safe) marshal, Java `readObject

XMLDecoder, PHP unserialize, Ruby Marshal.load YAML.load, .NET BinaryFormatter`.

• File/path (CWE-22): open read include require fopen readFile sendFile with user paths;

archive extractors (zip-slip).

• SSRF (CWE-918): URL fetchers — `requests.get urllib curl file_get_contents http.get

HttpClient` taking a user URL.

• Template (SSTI): render_template_string, Twig/Freemarker string templates.
• Secrets: password= api_key= secret token= literals; private keys.

Method

rg -n "os\.system|subprocess|shell_exec|eval\(|unserialize|pickle\.loads|readObject|render_template_string" then for each hit trace the argument. Pair with semgrep --config auto for dataflow.

Gotchas

• Parameterized queries / allowlisted args = safe; confirm the source, don't report the grep hit.
• yaml.safe_load and framework-escaped ORMs are the safe variants — note which one is used.

References

OWASP Code Review Guide; GTFOBins (for the exec side); Semgrep registry.