CodeQL Scanning Skill

Identify security vulnerability patterns in TypeScript/JavaScript code using static analysis techniques inspired by CodeQL queries.

When to Use

• When reviewing code for security vulnerabilities
• Before merging PRs that handle user input or external data
• When auditing authentication, authorization, or crypto code
• When analyzing data flow from sources to sinks

Vulnerability Patterns

Injection Flaws (CWE-89, CWE-78, CWE-79)

SQL Injection: User input concatenated into SQL queries.

// BAD: string concatenation
const query = `SELECT * FROM users WHERE id = '${userId}'`;
// GOOD: parameterized query
const query = `SELECT * FROM users WHERE id = $1`;

Command Injection: User input passed to shell commands.

// BAD: unsanitized input in exec
exec(`git clone ${repoUrl}`);
// GOOD: use execFile with argument array
execFile("git", ["clone", repoUrl]);

XSS: User input rendered without escaping in HTML responses.

Prototype Pollution (CWE-1321)

• Object.assign or spread with untrusted objects
• Deep merge utilities without prototype checks
• __proto__ or constructor.prototype in user input

Unsafe Deserialization (CWE-502)

• JSON.parse of untrusted input without schema validation
• eval or Function() with dynamic input
• YAML/XML parsing without safe mode

Path Traversal (CWE-22)

• File paths constructed with user input without sanitization
• Missing checks for ../ sequences
• Symlink following without validation

Insecure Crypto (CWE-327, CWE-330)

• MD5 or SHA1 for password hashing (use bcrypt/scrypt/argon2)
• Math.random() for security-sensitive values
• Hardcoded encryption keys or IVs

SSRF (CWE-918)

• HTTP requests to user-supplied URLs without allowlist
• DNS rebinding exposure
• Internal network access via URL manipulation

Cacti-Specific Patterns

• OpenAPI endpoint auth: Endpoints in openapi.json missing security scheme definitions.
• Gateway protocol: SATP Hermes messages accepted without signature verification or session validation.
• Ledger connector: Private keys logged or stored insecurely.
• Test tooling in prod: cactus-test-tooling imported in main source.

Data Flow Analysis

For each finding, trace the data flow:

1. Source: Where does untrusted data enter? (HTTP request, file read, environment variable, database query result)
2. Propagation: How does the data flow through the code? (variable assignment, function parameters, object properties)
3. Sink: Where is the data used in a security-sensitive operation? (SQL query, shell command, file path, HTTP response)
4. Sanitizers: Are there any validation or encoding steps between source and sink?

Output Format

## CodeQL-Style Scan: [Package/Scope]

### Findings

#### [CWE-XXX] [Vulnerability Name]
- **Severity**: Critical/High/Medium/Low
- **Source**: [file:line] — [description of data entry point]
- **Sink**: [file:line] — [description of dangerous operation]
- **Flow**: source → [intermediate steps] → sink
- **Sanitizer**: [present/missing]
- **Fix**: [specific remediation steps]

### Summary
- Critical: [count]
- High: [count]
- Medium: [count]
- Low: [count]