Zennoxa Shield

Security Rules Reference

Browse all 221 static-analysis (SAST) rules Zennoxa Shield checks across 14 languages and 51 CWE classes — each with what it detects, severity, CWE, CVSS and how to fix it.

221SAST rules
14languages
51CWE classes

What these rules check

Zennoxa Shield ships 221 static-analysis (SAST) rules across 14 languages. Each rule is a deterministic pattern — matched with regex and, where it matters, intra-file taint tracking that follows untrusted input from a source to a dangerous sink across lines. A match becomes a finding tagged with a severity, a CWE class, a CVSS base vector, and a concrete fix.

How to read a rule

  • Severity — critical, high, medium or low, from the impact if the pattern is exploited.
  • CWE — the Common Weakness Enumeration class it maps to (e.g. CWE-89, SQL injection). These rules cover 51 distinct CWEs.
  • CVSS — a base vector so findings are comparable.
  • Fix — every rule carries a specific remediation, not just a warning.

At scan time, findings are re-ranked by reachability — whether untrusted input can actually reach the vulnerable line — so the exploitable ones rise to the top. Accuracy is measured on the public OWASP Benchmark and reproducible with the free CLI.

221 rules14 languages51 CWE classes66 critical112 high40 medium

Ruby · 23 rules

SHIELD-RUBY-001
SQL injection via string interpolation in where
User input interpolated directly into an ActiveRecord where clause allows SQL injection.
critical · CWE-89
SHIELD-RUBY-002
SQL injection via find_by_sql interpolation
Interpolating variables into find_by_sql builds a query vulnerable to SQL injection.
critical · CWE-89
SHIELD-RUBY-003
SQL injection via execute interpolation
Interpolating input into connection.execute allows arbitrary SQL execution.
critical · CWE-89
SHIELD-RUBY-004
Command injection via system or exec with interpolation
Passing an interpolated string to system or exec runs it through a shell, enabling command injection.
critical · CWE-78
SHIELD-RUBY-005
Command injection via backticks or %x with interpolation
Interpolating variables inside backticks or %x() executes attacker-controlled shell commands.
critical · CWE-78
SHIELD-RUBY-006
Command injection via Open3 or spawn with variable
Passing a single interpolated string to Open3 or Kernel.spawn invokes a shell and permits injection.
high · CWE-78
SHIELD-RUBY-007
Code injection via eval
Passing a variable or interpolated string to eval executes arbitrary Ruby code.
critical · CWE-95
SHIELD-RUBY-008
Code injection via instance_eval or class_eval
instance_eval or class_eval on dynamic input executes arbitrary code in an object or class context.
high · CWE-95
SHIELD-RUBY-009
Unsafe method dispatch via send with user input
Calling send or public_send with a params-derived method name lets attackers invoke arbitrary methods.
high · CWE-94
SHIELD-RUBY-010
Mass assignment via permit bang
Calling permit!
high · CWE-915
SHIELD-RUBY-011
Mass assignment via update with raw params
Passing unfiltered params directly to update or update_attributes allows mass assignment.
high · CWE-915
SHIELD-RUBY-012
Unsafe deserialization via Marshal.load
Marshal.load on untrusted data can instantiate arbitrary objects and execute code.
critical · CWE-502
SHIELD-RUBY-013
Unsafe deserialization via YAML.load or Oj object mode
YAML.load or Oj in object mode on untrusted input can instantiate arbitrary Ruby objects.
critical · CWE-502
SHIELD-RUBY-014
SSRF via open-uri or Net::HTTP with variable URL
Opening a URL built from user input allows server-side request forgery to internal services.
high · CWE-918
SHIELD-RUBY-015
Path traversal via File or send_file with params
Building a file path from params in File.read, File.open, or send_file enables path traversal.
high · CWE-22
SHIELD-RUBY-016
XSS via raw or html_safe on dynamic data
Marking interpolated or variable content as raw or html_safe outputs unescaped HTML, enabling XSS.
high · CWE-79
SHIELD-RUBY-017
XSS via unescaped ERB output tag
The unescaped ERB output tag renders content without HTML escaping and can inject attacker markup.
high · CWE-79
SHIELD-RUBY-018
Weak hashing with MD5 or SHA1
Using MD5 or SHA1 for passwords or integrity is cryptographically broken.
medium · CWE-327
SHIELD-RUBY-019
Hardcoded secret or password
Assigning a literal password, secret key, or API key in source code exposes credentials.
high · CWE-798
SHIELD-RUBY-020
Insecure randomness for tokens
Using rand or Random for security tokens produces predictable values.
medium · CWE-330
SHIELD-RUBY-021
Open redirect via redirect_to with params
Redirecting to a URL taken from params lets attackers send users to arbitrary sites.
medium · CWE-601
SHIELD-RUBY-022
Remote code execution via constantize with user input
Calling constantize or qualified_const_get on params can instantiate unintended classes.
high · CWE-470
SHIELD-RUBY-023
Regex denial of service via interpolated pattern
Building a Regexp from unsanitized user input can create catastrophic backtracking patterns.
medium · CWE-1333

JavaScript / TypeScript · 22 rules

SHIELD-JS-001
SQL Injection via string concatenation
Detected SQL query built by string concatenation with user input, which may allow SQL injection.
critical · CWE-89
SHIELD-JS-002
SQL Injection via template literal
SQL query constructed with template literal interpolation may allow injection.
critical · CWE-89
SHIELD-JS-003
Cross-Site Scripting (XSS) via innerHTML
Setting innerHTML with user-controlled data can lead to XSS attacks.
high · CWE-79
SHIELD-JS-004
Cross-Site Scripting (XSS) via document.write
document.write with user input can allow script injection.
high · CWE-79
SHIELD-JS-005
Dangerous eval() usage
eval() executes arbitrary code and is a common attack vector.
critical · CWE-95
SHIELD-JS-006
Dangerous Function() constructor
new Function() dynamically compiles code and is equivalent to eval().
high · CWE-95
SHIELD-JS-007
Prototype pollution via merge/assign
Merging user-controlled objects into a target without key filtering can pollute Object.prototype.
high · CWE-1321
SHIELD-JS-008
Path traversal via user input
Constructing file paths from user input without sanitization allows directory traversal.
high · CWE-22
SHIELD-JS-009
Command injection via exec/spawn
Executing shell commands with unsanitized user input allows command injection.
critical · CWE-78
SHIELD-JS-010
Insecure random number generation
Math.random() is not cryptographically secure and should not be used for security-sensitive operations.
medium · CWE-338
SHIELD-JS-011
Hardcoded password or secret
Hardcoded credentials in source code can be extracted by attackers.
high · CWE-798
SHIELD-JS-012
Insecure HTTP usage (non-HTTPS)
Using HTTP instead of HTTPS exposes data to interception.
medium · CWE-319
SHIELD-JS-013
Open redirect via res.redirect
Redirecting to user-controlled URLs without validation allows open redirect attacks.
medium · CWE-601
SHIELD-JS-014
Disabled TLS/SSL certificate verification
Disabling certificate verification makes the connection vulnerable to MITM attacks.
high · CWE-295
SHIELD-JS-015
Sensitive data in console.log
Logging sensitive information such as passwords or tokens can leak data.
medium · CWE-532
SHIELD-JS-016
Server-Side Request Forgery (SSRF) via user-controlled URL
Fetching URLs from user input without validation can allow SSRF attacks.
high · CWE-918
SHIELD-JS-017
Regex Denial of Service (ReDoS) — catastrophic backtracking
Regex patterns with nested quantifiers may cause exponential backtracking on crafted input.
medium · CWE-1333
SHIELD-JS-018
Insecure deserialization (node-serialize)
node-serialize's unserialize() executes embedded function bodies (`$$ND_FUNC$$`) — deserializing untrusted input is remote code…
critical · CWE-502
SHIELD-JS-019
XML External Entity (XXE) — entity expansion enabled
Parsing XML with noent:true (libxmljs) substitutes external entities, allowing file read / SSRF via a crafted DTD.
high · CWE-611
SHIELD-JS-020
NoSQL injection via user-controlled query object
Passing req.params/query/body straight into a Mongo query lets an attacker inject operators ($ne, $gt, $where) to bypass auth o…
high · CWE-943
SHIELD-JS-021
Weak hash (MD5) used for a security value
MD5 is fast and broken; deriving a token/password/reset value from it (e.g.
high · CWE-916
SHIELD-JS-022
Cookie set without HttpOnly/Secure flags
A session/auth cookie without httpOnly is readable by XSS; without secure it is sent over plaintext HTTP.
medium · CWE-1004

C/C++ · 21 rules

SHIELD-CPP-001
Unbounded strcpy buffer overflow
strcpy copies without a length limit and can overflow the destination buffer.
high · CWE-120
SHIELD-CPP-002
Unbounded strcat buffer overflow
strcat appends without checking remaining destination capacity.
high · CWE-120
SHIELD-CPP-003
Unbounded sprintf buffer overflow
sprintf writes formatted output without a size limit and can overflow the buffer.
high · CWE-120
SHIELD-CPP-004
Use of gets is inherently unsafe
gets performs an unbounded read from stdin and always risks buffer overflow.
critical · CWE-242
SHIELD-CPP-005
Unbounded scanf %s read
scanf with %s reads into a buffer without a width limit and can overflow it.
high · CWE-120
SHIELD-CPP-006
Non-constant format string
printf-family called with a variable format string enables format string attacks.
high · CWE-134
SHIELD-CPP-007
Non-constant format string with stream target
fprintf or sprintf using a variable as the format argument enables format string attacks.
high · CWE-134
SHIELD-CPP-008
Command injection via system
system called with a variable or concatenated string can execute attacker-controlled commands.
critical · CWE-78
SHIELD-CPP-009
Command injection via popen
popen with a variable or concatenated command string can execute injected shell commands.
critical · CWE-78
SHIELD-CPP-010
Exec with untrusted path
execl or execlp invoked with a variable program path may run attacker-controlled binaries.
high · CWE-78
SHIELD-CPP-011
Integer overflow in malloc size
malloc with a multiplied size can overflow and allocate too little memory.
medium · CWE-190
SHIELD-CPP-012
Dangerous alloca or VLA with variable size
alloca with a variable size can exhaust the stack and cause overflow.
medium · CWE-770
SHIELD-CPP-013
Weak cryptographic primitive
Use of DES, MD5, or SHA1 provides broken or deprecated cryptographic strength.
high · CWE-327
SHIELD-CPP-014
Insecure ECB cipher mode
ECB mode leaks plaintext structure and is not semantically secure.
high · CWE-327
SHIELD-CPP-015
Hardcoded credential literal
A password or secret assigned a string literal embeds a credential in source.
high · CWE-798
SHIELD-CPP-016
Insecure temporary file creation
mktemp and tmpnam generate predictable names vulnerable to symlink and race attacks.
medium · CWE-377
SHIELD-CPP-017
File open with untrusted path
fopen or open with a variable path may allow path traversal to unintended files.
medium · CWE-22
SHIELD-CPP-018
TOCTOU race with access then open
Checking permissions with access before open creates a time-of-check to time-of-use race.
medium · CWE-367
SHIELD-CPP-019
memcpy with unchecked length
memcpy or memmove with a variable length from input can overflow the destination buffer.
high · CWE-120
SHIELD-CPP-020
strncpy without null termination
strncpy may leave the destination without a null terminator when the source fills the buffer.
medium · CWE-170
SHIELD-CPP-021
Insecure random for security tokens
rand or random is not cryptographically secure and must not generate keys or tokens.
high · CWE-338

C# · 21 rules

SHIELD-CSHARP-001
SQL injection via string concatenation in SqlCommand
A SqlCommand is built by concatenating untrusted strings directly into the query text.
critical · CWE-89
SHIELD-CSHARP-002
SQL injection via string.Format or interpolation into query
A SQL query is assembled with string.Format or an interpolated string that embeds untrusted values.
critical · CWE-89
SHIELD-CSHARP-003
SQL injection via ExecuteReader on interpolated string
ExecuteReader or ExecuteScalar runs a command whose text was built with an interpolated string containing variables.
critical · CWE-89
SHIELD-CSHARP-004
Command injection via Process.Start with concatenation
Process.Start is invoked with a command or argument string built from concatenated untrusted input.
critical · CWE-78
SHIELD-CSHARP-005
Command injection via ProcessStartInfo.Arguments from variable
ProcessStartInfo.Arguments is assigned a value derived from concatenation or a raw variable.
high · CWE-78
SHIELD-CSHARP-006
Insecure deserialization via BinaryFormatter and similar formatters
BinaryFormatter or a comparable formatter Deserialize call allows arbitrary type instantiation and remote code execution.
critical · CWE-502
SHIELD-CSHARP-007
Insecure deserialization via Json.NET TypeNameHandling
Json.NET is configured with TypeNameHandling.All or Auto, enabling type-confusion deserialization attacks.
critical · CWE-502
SHIELD-CSHARP-008
Insecure deserialization via JavaScriptSerializer SimpleTypeResolver
JavaScriptSerializer is constructed with a SimpleTypeResolver, permitting arbitrary type deserialization.
high · CWE-502
SHIELD-CSHARP-009
XXE via unsafe DtdProcessing or XmlResolver
An XML reader enables DtdProcessing.Parse or assigns an XmlResolver, exposing the parser to XXE attacks.
high · CWE-611
SHIELD-CSHARP-010
XXE via XmlTextReader without resolver hardening
An XmlTextReader is created from a variable source without disabling DTD processing, allowing external entity resolution.
high · CWE-611
SHIELD-CSHARP-011
Weak or broken cryptographic algorithm
A weak cipher or hash such as DES, TripleDES, RC2, MD5, or SHA1 is instantiated for security-sensitive use.
high · CWE-327
SHIELD-CSHARP-012
Insecure ECB cipher mode
A symmetric cipher is configured to use ECB mode, which leaks plaintext patterns.
high · CWE-327
SHIELD-CSHARP-013
Path traversal from request input into file API
A file read or stream is opened using a path derived directly from HTTP request input.
high · CWE-22
SHIELD-CSHARP-014
SSRF via request from variable-controlled URL
An HTTP request target is built from a variable, allowing server-side request forgery to internal endpoints.
high · CWE-918
SHIELD-CSHARP-015
Hardcoded credential in source
A password or connection string secret is embedded as a literal in the source code.
high · CWE-798
SHIELD-CSHARP-016
Insecure random used for security tokens
System.Random is used to generate values that appear to be security tokens or keys.
medium · CWE-338
SHIELD-CSHARP-017
LDAP injection via DirectorySearcher filter
A DirectorySearcher filter is built by concatenating untrusted input into the LDAP query.
high · CWE-90
SHIELD-CSHARP-018
Reflected XSS via Response.Write or Html.Raw
Untrusted request input is written to the response without encoding, or rendered with Html.Raw.
high · CWE-79
SHIELD-CSHARP-019
Trust-all TLS certificate validation
A certificate validation callback is overridden to always return true, disabling TLS trust checks.
high · CWE-295
SHIELD-CSHARP-020
Open redirect from request input
Response.Redirect targets a URL taken directly from HTTP request input, enabling open redirect.
medium · CWE-601
SHIELD-CSHARP-021
Unsafe reflection from user-controlled type name
Type.GetType or Activator.CreateInstance is invoked with a variable type name from untrusted input.
high · CWE-470

Java · 18 rules

SHIELD-JAVA-001
SQL Injection via String Concatenation
SQL query built by concatenating input into a Statement execution call allows SQL injection.
critical · CWE-89
SHIELD-JAVA-002
OS Command Injection via Runtime.exec
Runtime.getRuntime().exec called with a concatenated string permits command injection.
critical · CWE-78
SHIELD-JAVA-003
OS Command Injection via ProcessBuilder
ProcessBuilder constructed with concatenated arguments permits command injection.
critical · CWE-78
SHIELD-JAVA-004
Insecure Java Deserialization
ObjectInputStream.readObject or readUnshared on untrusted data enables remote code execution.
critical · CWE-502
SHIELD-JAVA-005
Insecure Deserialization via XMLDecoder
XMLDecoder deserializes arbitrary objects and can execute attacker-supplied code.
critical · CWE-502
SHIELD-JAVA-006
XXE via DocumentBuilderFactory
DocumentBuilderFactory created without disabling external entities is vulnerable to XXE.
high · CWE-611
SHIELD-JAVA-007
XXE via SAXParserFactory
SAXParserFactory created without disabling external entities is vulnerable to XXE.
high · CWE-611
SHIELD-JAVA-008
Weak Cipher Algorithm
Cipher.getInstance using DES, RC4, or ECB mode provides inadequate confidentiality.
high · CWE-327
SHIELD-JAVA-009
Weak Hash Algorithm
MessageDigest using MD5 or SHA-1 is cryptographically broken and unsuitable for security use.
medium · CWE-328
SHIELD-JAVA-010
Hardcoded Credentials
A password, secret, or API key assigned as a string literal exposes credentials in source.
high · CWE-798
SHIELD-JAVA-011
Path Traversal via File Construction
Constructing a File from request-derived input without validation enables path traversal.
high · CWE-22
SHIELD-JAVA-012
SSRF via URL openConnection
Opening a connection to a URL built from a variable host allows server-side request forgery.
high · CWE-918
SHIELD-JAVA-013
LDAP Injection via Concatenated Filter
An LDAP search filter built with string concatenation permits LDAP injection.
high · CWE-90
SHIELD-JAVA-014
Trust-All TLS HostnameVerifier
A HostnameVerifier that returns true unconditionally disables TLS host validation.
critical · CWE-295
SHIELD-JAVA-015
Insecure Randomness for Security Tokens
Using java.util.Random or Math.random to generate tokens or secrets yields predictable values.
medium · CWE-330
SHIELD-JAVA-016
Unsafe Reflection via Class.forName with Variable
Class.forName loading a class from a variable enables attacker-controlled class loading.
high · CWE-470
SHIELD-JAVA-017
SpEL or OGNL Expression Injection
Parsing an expression built from concatenated input allows SpEL or OGNL injection.
critical · CWE-917
SHIELD-JAVA-018
Log4Shell JNDI Lookup Injection
A jndi lookup pattern in logged data can trigger remote code execution via Log4j.
critical · CWE-917

Kotlin · 18 rules

SHIELD-KOTLIN-001
SQL injection via string interpolation in rawQuery/execSQL
SQLiteDatabase rawQuery or execSQL called with a Kotlin string template interpolating a variable allows SQL injection.
critical · CWE-89
SHIELD-KOTLIN-002
SQL injection via string concatenation in query APIs
Building a SQL string with the + operator and passing it to rawQuery, execSQL, or executeQuery permits SQL injection.
critical · CWE-89
SHIELD-KOTLIN-003
Command injection via Runtime.exec with variable
Runtime.getRuntime().exec invoked with an interpolated or concatenated variable allows OS command injection.
critical · CWE-78
SHIELD-KOTLIN-004
Command injection via ProcessBuilder with variable
ProcessBuilder constructed with an interpolated or concatenated variable can execute attacker-controlled commands.
critical · CWE-78
SHIELD-KOTLIN-005
WebView addJavascriptInterface exposes native code to JS
WebView.addJavascriptInterface bridges JavaScript to native objects and can allow remote code execution on older APIs.
high · CWE-749
SHIELD-KOTLIN-006
JavaScript injection via WebView loadUrl/evaluateJavascript
Concatenating or interpolating a variable into a WebView loadUrl('javascript:') or evaluateJavascript call enables JS injection.
high · CWE-79
SHIELD-KOTLIN-007
Insecure deserialization via ObjectInputStream.readObject
Calling ObjectInputStream.readObject on untrusted data can trigger remote code execution through gadget chains.
critical · CWE-502
SHIELD-KOTLIN-008
Weak or ECB-mode cipher via Cipher.getInstance
Requesting DES, RC4, or AES in ECB mode from Cipher.getInstance provides inadequate confidentiality.
high · CWE-327
SHIELD-KOTLIN-009
Weak hash algorithm via MessageDigest.getInstance
MessageDigest.getInstance with MD5 or SHA-1 uses a broken hash unsuitable for security purposes.
medium · CWE-327
SHIELD-KOTLIN-010
Hardcoded secret in source
A password, API key, secret, or token assigned a literal string constant embeds credentials in the app binary.
high · CWE-798
SHIELD-KOTLIN-011
Path traversal via File/FileInputStream with request input
Constructing a File or FileInputStream from request-derived input allows path traversal outside the intended directory.
high · CWE-22
SHIELD-KOTLIN-012
SSRF via URL(variable).openConnection
Opening a connection to a URL built from a variable can let an attacker reach internal services (SSRF).
high · CWE-918
SHIELD-KOTLIN-013
Insecure random used for security tokens
java.util.Random or kotlin.random.Random is predictable and must not be used to generate tokens, keys, or nonces.
medium · CWE-338
SHIELD-KOTLIN-014
Trust-all TrustManager or HostnameVerifier disables TLS validation
An empty checkServerTrusted implementation or a HostnameVerifier that always returns true disables certificate validation and e…
critical · CWE-295
SHIELD-KOTLIN-015
World-readable or world-writable file mode
Using MODE_WORLD_READABLE or MODE_WORLD_WRITEABLE exposes app files and preferences to other applications.
high · CWE-732
SHIELD-KOTLIN-016
Sensitive data logged via Log statements
Passing a password, token, or secret to Log.d/Log.e/Log.i leaks credentials into device logs.
medium · CWE-532
SHIELD-KOTLIN-017
Password stored in plaintext SharedPreferences
Writing a password or secret into standard SharedPreferences stores it unencrypted on the device.
high · CWE-312
SHIELD-KOTLIN-018
WebView JavaScript enabled with file access
Enabling JavaScript together with file access on a WebView can allow local file exfiltration by malicious scripts.
high · CWE-749

PHP · 18 rules

SHIELD-PHP-001
SQL injection via string concatenation or interpolation
Query built by concatenating or interpolating variables into mysqli/PDO query calls allows SQL injection.
critical · CWE-89
SHIELD-PHP-002
SQL injection via mysql_query with user input
Legacy mysql_query call includes request superglobals or concatenated variables in the SQL string.
critical · CWE-89
SHIELD-PHP-003
OS command injection via shell execution functions
A variable is passed to a shell command execution function enabling arbitrary command execution.
critical · CWE-78
SHIELD-PHP-004
Command injection via backtick shell operator
The backtick execution operator runs a shell command containing a variable.
critical · CWE-78
SHIELD-PHP-005
Code injection via eval or assert on variables
eval, assert, or create_function receives a variable allowing arbitrary PHP code execution.
critical · CWE-95
SHIELD-PHP-006
Code injection via preg_replace /e modifier
preg_replace with the deprecated /e modifier evaluates the replacement as PHP code.
critical · CWE-95
SHIELD-PHP-007
File inclusion (LFI/RFI) via dynamic path
include/require with a variable path enables local or remote file inclusion.
critical · CWE-98
SHIELD-PHP-008
Reflected XSS via echo of request data
Request superglobal is echoed or printed without output encoding, enabling cross-site scripting.
high · CWE-79
SHIELD-PHP-009
Unsafe deserialization of user input
unserialize is called on request data allowing object injection and remote code execution.
critical · CWE-502
SHIELD-PHP-010
Path traversal via file read with request data
File read function receives request data directly, allowing path traversal to arbitrary files.
high · CWE-22
SHIELD-PHP-011
Server-side request forgery via dynamic URL
curl target or remote file_get_contents URL is built from a variable, enabling SSRF.
high · CWE-918
SHIELD-PHP-012
Weak hashing algorithm for passwords
md5 or sha1 is used to hash sensitive values such as passwords, which is cryptographically weak.
high · CWE-916
SHIELD-PHP-013
Insecure legacy encryption (mcrypt DES/ECB)
Deprecated mcrypt with DES or ECB mode provides weak, insecure encryption.
high · CWE-327
SHIELD-PHP-014
Hardcoded credentials in source
A password or secret is assigned or defined as a literal string constant in code.
high · CWE-798
SHIELD-PHP-015
Insecure randomness for security tokens
rand or mt_rand is used to generate a token or key, producing predictable values.
medium · CWE-338
SHIELD-PHP-016
Type juggling in loose comparison of hashes
A loose == comparison against a hash function result allows type juggling authentication bypass.
high · CWE-697
SHIELD-PHP-017
HTTP header injection via dynamic header value
A variable is passed to header(), allowing response splitting or header injection.
medium · CWE-113
SHIELD-PHP-018
Variable overwrite via extract on request data
extract() applied to request superglobals lets attackers overwrite arbitrary local variables.
high · CWE-621

Python · 17 rules

SHIELD-PY-001
SQL Injection via string formatting
SQL query built with % formatting or .format() may allow injection.
critical · CWE-89
SHIELD-PY-002
SQL Injection via f-string interpolation
Using f-strings to construct SQL queries allows injection attacks.
critical · CWE-89
SHIELD-PY-003
Dangerous pickle deserialization
Deserializing untrusted data with pickle can lead to arbitrary code execution.
critical · CWE-502
SHIELD-PY-004
Dangerous exec() usage
exec() runs arbitrary Python code and is a major attack vector.
critical · CWE-95
SHIELD-PY-005
Shell injection via os.system
os.system() with user input allows arbitrary command execution.
critical · CWE-78
SHIELD-PY-006
Shell injection via subprocess with shell=True
Using shell=True with subprocess passes the command to the shell, allowing injection.
high · CWE-78
SHIELD-PY-007
Server-Side Request Forgery (SSRF) via requests with user input
Making HTTP requests to user-controlled URLs may allow SSRF.
high · CWE-918
SHIELD-PY-008
Insecure use of eval()
eval() with user input allows arbitrary Python code execution.
critical · CWE-95
SHIELD-PY-009
Path traversal via open()
Opening files with user-controlled paths allows directory traversal.
high · CWE-22
SHIELD-PY-010
Weak MD5 or SHA1 hash usage
MD5 and SHA1 are cryptographically broken and should not be used for security.
medium · CWE-327
SHIELD-PY-011
Hardcoded password or secret
Hardcoded credentials in source code can be extracted by attackers.
high · CWE-798
SHIELD-PY-012
Flask debug mode enabled
Running Flask in debug mode in production exposes an interactive debugger.
high · CWE-94
SHIELD-PY-013
YAML deserialization with yaml.load (unsafe)
yaml.load() without Loader can deserialize arbitrary Python objects.
high · CWE-502
SHIELD-PY-014
Insecure random number for security purposes
random.random() and random module are not cryptographically secure.
medium · CWE-338
SHIELD-PY-015
XML External Entity (XXE) injection
Parsing an in-memory XML string/bytes value with a default parser may allow XXE attacks.
high · CWE-611
SHIELD-PY-016
Insecure deserialization with marshal
marshal.loads() on untrusted data can cause crashes or arbitrary code execution.
high · CWE-502
SHIELD-PY-017
Timing attack in string comparison
Using == for secret comparison is vulnerable to timing attacks.
medium · CWE-208

Swift · 17 rules

SHIELD-SWIFT-001
SQL injection via string interpolation
SQLite query built with Swift string interpolation allows SQL injection.
critical · CWE-89
SHIELD-SWIFT-002
SQL injection via string concatenation
A raw SQL query is assembled with the concatenation operator on variable input.
critical · CWE-89
SHIELD-SWIFT-003
Command injection via Process arguments
Process/NSTask is launched with arguments derived from variable interpolation.
critical · CWE-78
SHIELD-SWIFT-004
Command injection via system call
A shell command is executed through system() or a shell with interpolated data.
critical · CWE-78
SHIELD-SWIFT-005
WebView JavaScript injection
evaluateJavaScript is called with a string containing interpolated variable data.
high · CWE-79
SHIELD-SWIFT-006
WebView HTML injection via loadHTMLString
loadHTMLString renders HTML built from interpolated variable data.
high · CWE-79
SHIELD-SWIFT-007
Weak hash for password
MD5 or SHA1 is used to hash passwords, which is cryptographically broken.
high · CWE-327
SHIELD-SWIFT-008
Insecure DES or ECB cipher
DES algorithm or ECB mode is used, both of which are insecure.
high · CWE-327
SHIELD-SWIFT-009
Hardcoded secret in source
A password, API key, or token is assigned a hardcoded string literal.
high · CWE-798
SHIELD-SWIFT-010
Insecure TLS trust bypass
A URLSession delegate returns a credential from serverTrust without validation.
critical · CWE-295
SHIELD-SWIFT-011
Arbitrary insecure HTTP loads allowed
App Transport Security is disabled via NSAllowsArbitraryLoads or insecure HTTP exceptions.
high · CWE-319
SHIELD-SWIFT-012
Sensitive data stored in UserDefaults
A password or token is persisted in UserDefaults, which is unencrypted.
high · CWE-922
SHIELD-SWIFT-013
Path traversal via file read
A file is read from a path built with interpolated variable data.
high · CWE-22
SHIELD-SWIFT-014
SSRF via dynamic URL request
A URLSession request targets a URL constructed from variable input.
high · CWE-918
SHIELD-SWIFT-015
Insecure random for security token
arc4random or a non-cryptographic random source is used to generate a token.
high · CWE-338
SHIELD-SWIFT-016
Sensitive data copied to pasteboard
A password or secret is written to the general UIPasteboard, exposing it to other apps.
medium · CWE-200
SHIELD-SWIFT-017
Keychain item without access control
A Keychain item is added with an insecure always-accessible protection class.
medium · CWE-311

Rust · 15 rules

SHIELD-RUST-001
SQL injection via format! in query
Building a SQL string with format!
critical · CWE-89
SHIELD-RUST-002
SQL injection via diesel sql_query with format!
diesel::sql_query built from format!
critical · CWE-89
SHIELD-RUST-003
SQL injection via string concatenation
Concatenating variables into a SQL string with + or push_str allows injection.
high · CWE-89
SHIELD-RUST-004
Command injection via interpolated argument
Passing a format!-built string as a process argument can inject commands or flags.
critical · CWE-78
SHIELD-RUST-005
Command execution via shell interpreter
Spawning a shell (sh -c / bash -c) with a constructed command enables command injection.
critical · CWE-78
SHIELD-RUST-006
Unsafe block requires review
unsafe blocks bypass Rust memory-safety guarantees and must be manually audited.
medium · CWE-119
SHIELD-RUST-007
Insecure deserialization of untrusted bytes
Deserializing attacker-controlled bytes with bincode/rmp without validation is risky.
medium · CWE-502
SHIELD-RUST-008
Weak cryptographic hash
MD5/SHA-1/DES are cryptographically broken and unsuitable for security use.
high · CWE-327
SHIELD-RUST-009
Hardcoded credential
A password, secret, or API key literal embedded in source is a leaked credential.
high · CWE-798
SHIELD-RUST-010
Insecure randomness for security value
rand::random / thread_rng is not a CSPRNG guarantee for tokens, keys, or nonces.
medium · CWE-338
SHIELD-RUST-011
SSRF via user-controlled request URL
Fetching a format!-built URL lets an attacker steer requests to internal hosts.
high · CWE-918
SHIELD-RUST-012
Path traversal via user-controlled file path
Opening a format!-built path can escape the intended directory (../).
high · CWE-22
SHIELD-RUST-013
TLS certificate verification disabled
danger_accept_invalid_certs/hostnames disables TLS validation, enabling MITM.
critical · CWE-295
SHIELD-RUST-014
Potential integer overflow in allocation size
with_capacity/Vec sizing from a multiplication of untrusted values can overflow.
low · CWE-190
SHIELD-RUST-015
SQL statement built with format!
A SQL query assembled with format!
high · CWE-89

Dart · 14 rules

SHIELD-DART-001
SQL injection via raw query interpolation
Raw SQL executed with string-interpolated or concatenated user input allows SQL injection.
critical · CWE-89
SHIELD-DART-002
Command injection via shell process execution
Process.run or Process.start invoked through a shell can execute injected commands.
critical · CWE-78
SHIELD-DART-003
Command injection via interpolated process arguments
A Process call whose arguments contain interpolated variables can be manipulated to run arbitrary commands.
high · CWE-78
SHIELD-DART-004
WebView JavaScript injection
Evaluating or running JavaScript built from variables inside a WebView enables script injection.
high · CWE-79
SHIELD-DART-005
Insecure certificate validation bypass
A badCertificateCallback returning true disables TLS validation and enables man-in-the-middle attacks.
critical · CWE-295
SHIELD-DART-006
Insecure cleartext HTTP endpoint
Using a cleartext http:// URL transmits data without encryption and exposes it to interception.
medium · CWE-319
SHIELD-DART-007
Weak cryptographic hash
MD5 or SHA-1 from the crypto package is broken and unsuitable for passwords or integrity.
high · CWE-327
SHIELD-DART-008
Hardcoded secret credential
A password, API key, or token assigned a literal string embeds a secret in source code.
high · CWE-798
SHIELD-DART-009
Sensitive data in insecure storage
Storing passwords or tokens in SharedPreferences saves them in plaintext accessible to other processes.
high · CWE-312
SHIELD-DART-010
Path traversal via unsanitized file path
Building a File from request-derived input allows reading or writing files outside the intended directory.
high · CWE-22
SHIELD-DART-011
SSRF via user-controlled request URL
Passing a variable URL into an HTTP request lets an attacker force requests to internal services.
high · CWE-918
SHIELD-DART-012
Insecure random for security tokens
The default Random() is not cryptographically secure and must not generate tokens or secrets.
medium · CWE-338
SHIELD-DART-013
Sensitive data logged to console
Printing passwords or tokens via print or debugPrint leaks secrets into device and crash logs.
medium · CWE-532
SHIELD-DART-014
WebView with unrestricted JavaScript mode
A WebView using unrestricted JavaScript mode exposes loaded content to full script execution and local access.
high · CWE-749

Go · 12 rules

SHIELD-GO-001
SQL Injection via string formatting
SQL query built with fmt.Sprintf or string concatenation may allow SQL injection.
critical · CWE-89
SHIELD-GO-002
SQL Injection via string concatenation
Building SQL with + concatenation allows injection.
critical · CWE-89
SHIELD-GO-003
Weak cryptographic hash (MD5)
MD5 is cryptographically broken and should not be used for security.
high · CWE-327
SHIELD-GO-004
Weak cryptographic hash (SHA1)
SHA1 is cryptographically weak and unsuitable for security-sensitive operations.
high · CWE-327
SHIELD-GO-005
Insecure random number generation via math/rand
math/rand is not cryptographically secure and must not be used for security operations.
medium · CWE-338
SHIELD-GO-006
Path traversal via user-controlled filepath
Using user input in file paths without sanitization allows directory traversal.
high · CWE-22
SHIELD-GO-007
Command injection via exec.Command with user input
Passing user-controlled data to exec.Command allows command injection.
critical · CWE-78
SHIELD-GO-008
TLS InsecureSkipVerify enabled
Setting InsecureSkipVerify: true disables certificate validation, allowing MITM attacks.
high · CWE-295
SHIELD-GO-009
Hardcoded password or secret
Hardcoded credentials in Go source code can be extracted by attackers.
high · CWE-798
SHIELD-GO-010
Server-Side Request Forgery via http.Get with user input
Fetching user-controlled URLs with http.Get or http.Post may allow SSRF.
high · CWE-918
SHIELD-GO-011
Open redirect via http.Redirect with user input
Redirecting to a user-controlled URL without validation enables open redirect.
medium · CWE-601
SHIELD-GO-012
Use of deprecated ioutil package
ioutil functions are deprecated since Go 1.16 and should use io/os equivalents.
low · CWE-477

General · 3 rules

SHIELD-GEN-001
Hardcoded IP address
Hardcoded IP addresses can expose internal network topology and are inflexible.
medium · CWE-284
SHIELD-GEN-002
Security-sensitive TODO/FIXME comment
TODO or FIXME comments mentioning security topics indicate unresolved security debt.
low · CWE-1068
SHIELD-GEN-010
Disabled SSL/TLS verify in curl command
Using -k or --insecure with curl disables certificate validation.
medium · CWE-295

CI/CD · 2 rules

SHIELD-CI-001
GitHub Actions dependency pinned to a mutable tag
Referencing a GitHub Action by a mutable tag (e.g.
high · CWE-1357
SHIELD-CI-002
GitHub Actions script injection via untrusted event input
Interpolating an attacker-controlled event field (issue/PR title or body, comment/review body, commit message) directly into a…
high · CWE-94

Common questions

What is a SAST rule?

A SAST (static application security testing) rule is a pattern that flags a class of security bug in source code without running it. Each Zennoxa Shield rule maps a code pattern to a CWE weakness class, a severity, a CVSS base vector, and a concrete fix.

How does Shield decide a rule’s severity?

Severity (critical, high, medium, low) reflects the impact if the pattern is exploited, aligned to the rule’s CWE class and a CVSS base vector. At scan time, findings are then re-ranked by reachability — whether untrusted input can actually reach the vulnerable line — so exploitable issues rise above theoretical ones.

Which CWEs does Shield cover?

Shield’s 221 rules span 51 distinct CWE classes across 14 languages, including SQL injection (CWE-89), cross-site scripting (CWE-79), command injection (CWE-78), path traversal (CWE-22), hardcoded credentials (CWE-798) and weak cryptography (CWE-327).

Can I reproduce these findings?

Yes. The Shield CLI is free and MIT-licensed and runs fully offline. Its accuracy is measured on the public OWASP Benchmark and reproducible with a single command, so you can verify the rules against your own code and against the labelled test suite.

Security Rules Reference — 221 SAST rules across 14 languages — Zennoxa Shield