├── .github ├── FUNDING.yml └── workflows │ └── codeql-analysis.yml ├── .gitignore ├── LICENSE ├── README.md ├── detection.py ├── functions.py ├── index.py ├── indicators.py ├── semgrep ├── assert-use.yaml ├── backticks-use.yaml ├── curl-ssl-verifypeer-off.yaml ├── deserialization.yaml ├── detected-generic-api-key.yaml ├── detected-generic-secret.yaml ├── detected-private-key.yaml ├── detected-username-and-password-in-uri.yaml ├── doctrine-dbal-dangerous-query.yaml ├── doctrine-orm-dangerous-query.yaml ├── eval-use.yaml ├── exec-use.yaml ├── extract-use.yaml ├── file-inclusion-oracle.yaml ├── file-inclusion.yaml ├── file-upload.yaml ├── ftp-use.yaml ├── laravel-api-route-sql-injection.yaml ├── laravel-blade-form-missing-csrf.yaml ├── laravel-dangerous-model-construction.yaml ├── laravel-sql-injection.yaml ├── laravel-unsafe-validator.yaml ├── ldap-bind-without-password.yaml ├── mb-ereg-replace-eval.yaml ├── mb-eregi-replace-eval.yaml ├── mcrypt-use.yaml ├── md5-loose-equality.yaml ├── md5-used-as-password.yaml ├── non-literal-header.yaml ├── openssl-cbc-static-iv.yaml ├── openssl-decrypt-validate.yaml ├── php-permissive-cors.yaml ├── php-ssrf.yaml ├── phpinfo-use.yaml ├── preg-replace-eval.yaml ├── source-leak.yaml ├── sqli-query-sink-1.yaml ├── sqli-query-sink-2.yaml ├── symfony-csrf-protection-disabled.yaml ├── symfony-non-literal-redirect.yaml ├── symfony-permissive-cors.yaml ├── tainted-callable.yaml ├── tainted-exec.yaml ├── tainted-filename.yaml ├── tainted-object-instantiation.yaml ├── tainted-session.yaml ├── tainted-sql-string.yaml ├── tainted-url-host.yaml ├── tainted-zip-extract.yaml ├── unlink-use.yaml ├── unserialize-use.yaml ├── weak-crypto.yaml └── xml-load-entity.yaml ├── utils └── export.sh └── vulns ├── assert-use.php ├── assert.php ├── backtick.php ├── backticks-use.php ├── configuration.php ├── cookies.php ├── curl-ssl-verifypeer-off.php ├── deserialization.php ├── doctrine-dbal-dangerous-query.php ├── doctrine-orm-dangerous-query.php ├── eval-use.php ├── exec-use.php ├── exec.php ├── extract.php ├── file-inclusion.php ├── filegetcontents.php ├── ftp-use.php ├── hash.php ├── include.php ├── info.php ├── laravel-api-route-sql-injection.php ├── laravel-blade-form-missing-csrf.blade.php ├── laravel-dangerous-model-construction.php ├── laravel-sql-injection.php ├── laravel-unsafe-validator.php ├── ldap-bind-without-password.php ├── ldap.php ├── mail.php ├── mb-ereg-replace-eval.php ├── mcrypt-use.php ├── md5-loose-equality.php ├── md5-used-as-password.php ├── non-literal-header.php ├── openssl-cbc-static-iv.php ├── openssl-decrypt-validate.php ├── pdo.php ├── pgsqli.php ├── php-permissive-cors.php ├── phpinfo-use.php ├── preg-replace-eval.php ├── preg_replace.php ├── require.php ├── sql-ip.php ├── sqli-req-concat.php ├── sqli.php ├── sqli2.php ├── ssrf.php ├── ssti.php ├── symfony-csrf-protection-disabled.php ├── symfony-non-literal-redirect.php ├── symfony-permissive-cors.php ├── tainted-filename.php ├── tainted-object-instantiation.php ├── tainted-sql-string.php ├── tainted-url-host.php ├── unlink-use.php ├── unserialize-use.php ├── unserialize.php ├── upload.php ├── weak-crypto.php ├── xpath.php ├── xss.php ├── xxe.php ├── xxe2.php ├── zip-extract-2.php └── zip-extract.php /.github/FUNDING.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/.github/FUNDING.yml -------------------------------------------------------------------------------- /.github/workflows/codeql-analysis.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/.github/workflows/codeql-analysis.yml -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.pyc 2 | www 3 | Report 4 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/LICENSE -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/README.md -------------------------------------------------------------------------------- /detection.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/detection.py -------------------------------------------------------------------------------- /functions.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/functions.py -------------------------------------------------------------------------------- /index.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/index.py -------------------------------------------------------------------------------- /indicators.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/indicators.py -------------------------------------------------------------------------------- /semgrep/assert-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/assert-use.yaml -------------------------------------------------------------------------------- /semgrep/backticks-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/backticks-use.yaml -------------------------------------------------------------------------------- /semgrep/curl-ssl-verifypeer-off.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/curl-ssl-verifypeer-off.yaml -------------------------------------------------------------------------------- /semgrep/deserialization.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/deserialization.yaml -------------------------------------------------------------------------------- /semgrep/detected-generic-api-key.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/detected-generic-api-key.yaml -------------------------------------------------------------------------------- /semgrep/detected-generic-secret.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/detected-generic-secret.yaml -------------------------------------------------------------------------------- /semgrep/detected-private-key.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/detected-private-key.yaml -------------------------------------------------------------------------------- /semgrep/detected-username-and-password-in-uri.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/detected-username-and-password-in-uri.yaml -------------------------------------------------------------------------------- /semgrep/doctrine-dbal-dangerous-query.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/doctrine-dbal-dangerous-query.yaml -------------------------------------------------------------------------------- /semgrep/doctrine-orm-dangerous-query.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/doctrine-orm-dangerous-query.yaml -------------------------------------------------------------------------------- /semgrep/eval-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/eval-use.yaml -------------------------------------------------------------------------------- /semgrep/exec-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/exec-use.yaml -------------------------------------------------------------------------------- /semgrep/extract-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/extract-use.yaml -------------------------------------------------------------------------------- /semgrep/file-inclusion-oracle.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/file-inclusion-oracle.yaml -------------------------------------------------------------------------------- /semgrep/file-inclusion.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/file-inclusion.yaml -------------------------------------------------------------------------------- /semgrep/file-upload.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/file-upload.yaml -------------------------------------------------------------------------------- /semgrep/ftp-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/ftp-use.yaml -------------------------------------------------------------------------------- /semgrep/laravel-api-route-sql-injection.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/laravel-api-route-sql-injection.yaml -------------------------------------------------------------------------------- /semgrep/laravel-blade-form-missing-csrf.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/laravel-blade-form-missing-csrf.yaml -------------------------------------------------------------------------------- /semgrep/laravel-dangerous-model-construction.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/laravel-dangerous-model-construction.yaml -------------------------------------------------------------------------------- /semgrep/laravel-sql-injection.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/laravel-sql-injection.yaml -------------------------------------------------------------------------------- /semgrep/laravel-unsafe-validator.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/laravel-unsafe-validator.yaml -------------------------------------------------------------------------------- /semgrep/ldap-bind-without-password.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/ldap-bind-without-password.yaml -------------------------------------------------------------------------------- /semgrep/mb-ereg-replace-eval.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/mb-ereg-replace-eval.yaml -------------------------------------------------------------------------------- /semgrep/mb-eregi-replace-eval.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/mb-eregi-replace-eval.yaml -------------------------------------------------------------------------------- /semgrep/mcrypt-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/mcrypt-use.yaml -------------------------------------------------------------------------------- /semgrep/md5-loose-equality.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/md5-loose-equality.yaml -------------------------------------------------------------------------------- /semgrep/md5-used-as-password.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/md5-used-as-password.yaml -------------------------------------------------------------------------------- /semgrep/non-literal-header.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/non-literal-header.yaml -------------------------------------------------------------------------------- /semgrep/openssl-cbc-static-iv.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/openssl-cbc-static-iv.yaml -------------------------------------------------------------------------------- /semgrep/openssl-decrypt-validate.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/openssl-decrypt-validate.yaml -------------------------------------------------------------------------------- /semgrep/php-permissive-cors.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/php-permissive-cors.yaml -------------------------------------------------------------------------------- /semgrep/php-ssrf.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/php-ssrf.yaml -------------------------------------------------------------------------------- /semgrep/phpinfo-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/phpinfo-use.yaml -------------------------------------------------------------------------------- /semgrep/preg-replace-eval.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/preg-replace-eval.yaml -------------------------------------------------------------------------------- /semgrep/source-leak.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/source-leak.yaml -------------------------------------------------------------------------------- /semgrep/sqli-query-sink-1.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/sqli-query-sink-1.yaml -------------------------------------------------------------------------------- /semgrep/sqli-query-sink-2.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/sqli-query-sink-2.yaml -------------------------------------------------------------------------------- /semgrep/symfony-csrf-protection-disabled.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/symfony-csrf-protection-disabled.yaml -------------------------------------------------------------------------------- /semgrep/symfony-non-literal-redirect.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/symfony-non-literal-redirect.yaml -------------------------------------------------------------------------------- /semgrep/symfony-permissive-cors.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/symfony-permissive-cors.yaml -------------------------------------------------------------------------------- /semgrep/tainted-callable.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/tainted-callable.yaml -------------------------------------------------------------------------------- /semgrep/tainted-exec.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/tainted-exec.yaml -------------------------------------------------------------------------------- /semgrep/tainted-filename.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/tainted-filename.yaml -------------------------------------------------------------------------------- /semgrep/tainted-object-instantiation.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/tainted-object-instantiation.yaml -------------------------------------------------------------------------------- /semgrep/tainted-session.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/tainted-session.yaml -------------------------------------------------------------------------------- /semgrep/tainted-sql-string.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/tainted-sql-string.yaml -------------------------------------------------------------------------------- /semgrep/tainted-url-host.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/tainted-url-host.yaml -------------------------------------------------------------------------------- /semgrep/tainted-zip-extract.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/tainted-zip-extract.yaml -------------------------------------------------------------------------------- /semgrep/unlink-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/unlink-use.yaml -------------------------------------------------------------------------------- /semgrep/unserialize-use.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/unserialize-use.yaml -------------------------------------------------------------------------------- /semgrep/weak-crypto.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/weak-crypto.yaml -------------------------------------------------------------------------------- /semgrep/xml-load-entity.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/semgrep/xml-load-entity.yaml -------------------------------------------------------------------------------- /utils/export.sh: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/utils/export.sh -------------------------------------------------------------------------------- /vulns/assert-use.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/vulns/assert-use.php -------------------------------------------------------------------------------- /vulns/assert.php: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/swisskyrepo/Vulny-Code-Static-Analysis/HEAD/vulns/assert.php -------------------------------------------------------------------------------- /vulns/backtick.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /vulns/backticks-use.php: -------------------------------------------------------------------------------- 1 |