Security Rules Reference

Browse all 221 static-analysis (SAST) rules Zennoxa Shield checks across 14 languages — each with what it detects, severity, CWE, and how to fix it.

221SAST rules
14languages
1scan, all layers

Ruby · 23 rules

SHIELD-RUBY-001
SQL injection via string interpolation in where
critical · CWE-89
SHIELD-RUBY-002
SQL injection via find_by_sql interpolation
critical · CWE-89
SHIELD-RUBY-003
SQL injection via execute interpolation
critical · CWE-89
SHIELD-RUBY-004
Command injection via system or exec with interpolation
critical · CWE-78
SHIELD-RUBY-005
Command injection via backticks or %x with interpolation
critical · CWE-78
SHIELD-RUBY-006
Command injection via Open3 or spawn with variable
high · CWE-78
SHIELD-RUBY-007
Code injection via eval
critical · CWE-95
SHIELD-RUBY-008
Code injection via instance_eval or class_eval
high · CWE-95
SHIELD-RUBY-009
Unsafe method dispatch via send with user input
high · CWE-94
SHIELD-RUBY-010
Mass assignment via permit bang
high · CWE-915
SHIELD-RUBY-011
Mass assignment via update with raw params
high · CWE-915
SHIELD-RUBY-012
Unsafe deserialization via Marshal.load
critical · CWE-502
SHIELD-RUBY-013
Unsafe deserialization via YAML.load or Oj object mode
critical · CWE-502
SHIELD-RUBY-014
SSRF via open-uri or Net::HTTP with variable URL
high · CWE-918
SHIELD-RUBY-015
Path traversal via File or send_file with params
high · CWE-22
SHIELD-RUBY-016
XSS via raw or html_safe on dynamic data
high · CWE-79
SHIELD-RUBY-017
XSS via unescaped ERB output tag
high · CWE-79
SHIELD-RUBY-018
Weak hashing with MD5 or SHA1
medium · CWE-327
SHIELD-RUBY-019
Hardcoded secret or password
high · CWE-798
SHIELD-RUBY-020
Insecure randomness for tokens
medium · CWE-330
SHIELD-RUBY-021
Open redirect via redirect_to with params
medium · CWE-601
SHIELD-RUBY-022
Remote code execution via constantize with user input
high · CWE-470
SHIELD-RUBY-023
Regex denial of service via interpolated pattern
medium · CWE-1333

JavaScript / TypeScript · 22 rules

SHIELD-JS-001
SQL Injection via string concatenation
critical · CWE-89
SHIELD-JS-002
SQL Injection via template literal
critical · CWE-89
SHIELD-JS-003
Cross-Site Scripting (XSS) via innerHTML
high · CWE-79
SHIELD-JS-004
Cross-Site Scripting (XSS) via document.write
high · CWE-79
SHIELD-JS-005
Dangerous eval() usage
critical · CWE-95
SHIELD-JS-006
Dangerous Function() constructor
high · CWE-95
SHIELD-JS-007
Prototype pollution via merge/assign
high · CWE-1321
SHIELD-JS-008
Path traversal via user input
high · CWE-22
SHIELD-JS-009
Command injection via exec/spawn
critical · CWE-78
SHIELD-JS-010
Insecure random number generation
medium · CWE-338
SHIELD-JS-011
Hardcoded password or secret
high · CWE-798
SHIELD-JS-012
Insecure HTTP usage (non-HTTPS)
medium · CWE-319
SHIELD-JS-013
Open redirect via res.redirect
medium · CWE-601
SHIELD-JS-014
Disabled TLS/SSL certificate verification
high · CWE-295
SHIELD-JS-015
Sensitive data in console.log
medium · CWE-532
SHIELD-JS-016
Server-Side Request Forgery (SSRF) via user-controlled URL
high · CWE-918
SHIELD-JS-017
Regex Denial of Service (ReDoS) — catastrophic backtracking
medium · CWE-1333
SHIELD-JS-018
Insecure deserialization (node-serialize)
critical · CWE-502
SHIELD-JS-019
XML External Entity (XXE) — entity expansion enabled
high · CWE-611
SHIELD-JS-020
NoSQL injection via user-controlled query object
high · CWE-943
SHIELD-JS-021
Weak hash (MD5) used for a security value
high · CWE-916
SHIELD-JS-022
Cookie set without HttpOnly/Secure flags
medium · CWE-1004

C/C++ · 21 rules

SHIELD-CPP-001
Unbounded strcpy buffer overflow
high · CWE-120
SHIELD-CPP-002
Unbounded strcat buffer overflow
high · CWE-120
SHIELD-CPP-003
Unbounded sprintf buffer overflow
high · CWE-120
SHIELD-CPP-004
Use of gets is inherently unsafe
critical · CWE-242
SHIELD-CPP-005
Unbounded scanf %s read
high · CWE-120
SHIELD-CPP-006
Non-constant format string
high · CWE-134
SHIELD-CPP-007
Non-constant format string with stream target
high · CWE-134
SHIELD-CPP-008
Command injection via system
critical · CWE-78
SHIELD-CPP-009
Command injection via popen
critical · CWE-78
SHIELD-CPP-010
Exec with untrusted path
high · CWE-78
SHIELD-CPP-011
Integer overflow in malloc size
medium · CWE-190
SHIELD-CPP-012
Dangerous alloca or VLA with variable size
medium · CWE-770
SHIELD-CPP-013
Weak cryptographic primitive
high · CWE-327
SHIELD-CPP-014
Insecure ECB cipher mode
high · CWE-327
SHIELD-CPP-015
Hardcoded credential literal
high · CWE-798
SHIELD-CPP-016
Insecure temporary file creation
medium · CWE-377
SHIELD-CPP-017
File open with untrusted path
medium · CWE-22
SHIELD-CPP-018
TOCTOU race with access then open
medium · CWE-367
SHIELD-CPP-019
memcpy with unchecked length
high · CWE-120
SHIELD-CPP-020
strncpy without null termination
medium · CWE-170
SHIELD-CPP-021
Insecure random for security tokens
high · CWE-338

C# · 21 rules

SHIELD-CSHARP-001
SQL injection via string concatenation in SqlCommand
critical · CWE-89
SHIELD-CSHARP-002
SQL injection via string.Format or interpolation into query
critical · CWE-89
SHIELD-CSHARP-003
SQL injection via ExecuteReader on interpolated string
critical · CWE-89
SHIELD-CSHARP-004
Command injection via Process.Start with concatenation
critical · CWE-78
SHIELD-CSHARP-005
Command injection via ProcessStartInfo.Arguments from variable
high · CWE-78
SHIELD-CSHARP-006
Insecure deserialization via BinaryFormatter and similar formatters
critical · CWE-502
SHIELD-CSHARP-007
Insecure deserialization via Json.NET TypeNameHandling
critical · CWE-502
SHIELD-CSHARP-008
Insecure deserialization via JavaScriptSerializer SimpleTypeResolver
high · CWE-502
SHIELD-CSHARP-009
XXE via unsafe DtdProcessing or XmlResolver
high · CWE-611
SHIELD-CSHARP-010
XXE via XmlTextReader without resolver hardening
high · CWE-611
SHIELD-CSHARP-011
Weak or broken cryptographic algorithm
high · CWE-327
SHIELD-CSHARP-012
Insecure ECB cipher mode
high · CWE-327
SHIELD-CSHARP-013
Path traversal from request input into file API
high · CWE-22
SHIELD-CSHARP-014
SSRF via request from variable-controlled URL
high · CWE-918
SHIELD-CSHARP-015
Hardcoded credential in source
high · CWE-798
SHIELD-CSHARP-016
Insecure random used for security tokens
medium · CWE-338
SHIELD-CSHARP-017
LDAP injection via DirectorySearcher filter
high · CWE-90
SHIELD-CSHARP-018
Reflected XSS via Response.Write or Html.Raw
high · CWE-79
SHIELD-CSHARP-019
Trust-all TLS certificate validation
high · CWE-295
SHIELD-CSHARP-020
Open redirect from request input
medium · CWE-601
SHIELD-CSHARP-021
Unsafe reflection from user-controlled type name
high · CWE-470

Java · 18 rules

SHIELD-JAVA-001
SQL Injection via String Concatenation
critical · CWE-89
SHIELD-JAVA-002
OS Command Injection via Runtime.exec
critical · CWE-78
SHIELD-JAVA-003
OS Command Injection via ProcessBuilder
critical · CWE-78
SHIELD-JAVA-004
Insecure Java Deserialization
critical · CWE-502
SHIELD-JAVA-005
Insecure Deserialization via XMLDecoder
critical · CWE-502
SHIELD-JAVA-006
XXE via DocumentBuilderFactory
high · CWE-611
SHIELD-JAVA-007
XXE via SAXParserFactory
high · CWE-611
SHIELD-JAVA-008
Weak Cipher Algorithm
high · CWE-327
SHIELD-JAVA-009
Weak Hash Algorithm
medium · CWE-328
SHIELD-JAVA-010
Hardcoded Credentials
high · CWE-798
SHIELD-JAVA-011
Path Traversal via File Construction
high · CWE-22
SHIELD-JAVA-012
SSRF via URL openConnection
high · CWE-918
SHIELD-JAVA-013
LDAP Injection via Concatenated Filter
high · CWE-90
SHIELD-JAVA-014
Trust-All TLS HostnameVerifier
critical · CWE-295
SHIELD-JAVA-015
Insecure Randomness for Security Tokens
medium · CWE-330
SHIELD-JAVA-016
Unsafe Reflection via Class.forName with Variable
high · CWE-470
SHIELD-JAVA-017
SpEL or OGNL Expression Injection
critical · CWE-917
SHIELD-JAVA-018
Log4Shell JNDI Lookup Injection
critical · CWE-917

Kotlin · 18 rules

SHIELD-KOTLIN-001
SQL injection via string interpolation in rawQuery/execSQL
critical · CWE-89
SHIELD-KOTLIN-002
SQL injection via string concatenation in query APIs
critical · CWE-89
SHIELD-KOTLIN-003
Command injection via Runtime.exec with variable
critical · CWE-78
SHIELD-KOTLIN-004
Command injection via ProcessBuilder with variable
critical · CWE-78
SHIELD-KOTLIN-005
WebView addJavascriptInterface exposes native code to JS
high · CWE-749
SHIELD-KOTLIN-006
JavaScript injection via WebView loadUrl/evaluateJavascript
high · CWE-79
SHIELD-KOTLIN-007
Insecure deserialization via ObjectInputStream.readObject
critical · CWE-502
SHIELD-KOTLIN-008
Weak or ECB-mode cipher via Cipher.getInstance
high · CWE-327
SHIELD-KOTLIN-009
Weak hash algorithm via MessageDigest.getInstance
medium · CWE-327
SHIELD-KOTLIN-010
Hardcoded secret in source
high · CWE-798
SHIELD-KOTLIN-011
Path traversal via File/FileInputStream with request input
high · CWE-22
SHIELD-KOTLIN-012
SSRF via URL(variable).openConnection
high · CWE-918
SHIELD-KOTLIN-013
Insecure random used for security tokens
medium · CWE-338
SHIELD-KOTLIN-014
Trust-all TrustManager or HostnameVerifier disables TLS validation
critical · CWE-295
SHIELD-KOTLIN-015
World-readable or world-writable file mode
high · CWE-732
SHIELD-KOTLIN-016
Sensitive data logged via Log statements
medium · CWE-532
SHIELD-KOTLIN-017
Password stored in plaintext SharedPreferences
high · CWE-312
SHIELD-KOTLIN-018
WebView JavaScript enabled with file access
high · CWE-749

PHP · 18 rules

SHIELD-PHP-001
SQL injection via string concatenation or interpolation
critical · CWE-89
SHIELD-PHP-002
SQL injection via mysql_query with user input
critical · CWE-89
SHIELD-PHP-003
OS command injection via shell execution functions
critical · CWE-78
SHIELD-PHP-004
Command injection via backtick shell operator
critical · CWE-78
SHIELD-PHP-005
Code injection via eval or assert on variables
critical · CWE-95
SHIELD-PHP-006
Code injection via preg_replace /e modifier
critical · CWE-95
SHIELD-PHP-007
File inclusion (LFI/RFI) via dynamic path
critical · CWE-98
SHIELD-PHP-008
Reflected XSS via echo of request data
high · CWE-79
SHIELD-PHP-009
Unsafe deserialization of user input
critical · CWE-502
SHIELD-PHP-010
Path traversal via file read with request data
high · CWE-22
SHIELD-PHP-011
Server-side request forgery via dynamic URL
high · CWE-918
SHIELD-PHP-012
Weak hashing algorithm for passwords
high · CWE-916
SHIELD-PHP-013
Insecure legacy encryption (mcrypt DES/ECB)
high · CWE-327
SHIELD-PHP-014
Hardcoded credentials in source
high · CWE-798
SHIELD-PHP-015
Insecure randomness for security tokens
medium · CWE-338
SHIELD-PHP-016
Type juggling in loose comparison of hashes
high · CWE-697
SHIELD-PHP-017
HTTP header injection via dynamic header value
medium · CWE-113
SHIELD-PHP-018
Variable overwrite via extract on request data
high · CWE-621

Python · 17 rules

SHIELD-PY-001
SQL Injection via string formatting
critical · CWE-89
SHIELD-PY-002
SQL Injection via f-string interpolation
critical · CWE-89
SHIELD-PY-003
Dangerous pickle deserialization
critical · CWE-502
SHIELD-PY-004
Dangerous exec() usage
critical · CWE-95
SHIELD-PY-005
Shell injection via os.system
critical · CWE-78
SHIELD-PY-006
Shell injection via subprocess with shell=True
high · CWE-78
SHIELD-PY-007
Server-Side Request Forgery (SSRF) via requests with user input
high · CWE-918
SHIELD-PY-008
Insecure use of eval()
critical · CWE-95
SHIELD-PY-009
Path traversal via open()
high · CWE-22
SHIELD-PY-010
Weak MD5 or SHA1 hash usage
medium · CWE-327
SHIELD-PY-011
Hardcoded password or secret
high · CWE-798
SHIELD-PY-012
Flask debug mode enabled
high · CWE-94
SHIELD-PY-013
YAML deserialization with yaml.load (unsafe)
high · CWE-502
SHIELD-PY-014
Insecure random number for security purposes
medium · CWE-338
SHIELD-PY-015
XML External Entity (XXE) injection
high · CWE-611
SHIELD-PY-016
Insecure deserialization with marshal
high · CWE-502
SHIELD-PY-017
Timing attack in string comparison
medium · CWE-208

Swift · 17 rules

SHIELD-SWIFT-001
SQL injection via string interpolation
critical · CWE-89
SHIELD-SWIFT-002
SQL injection via string concatenation
critical · CWE-89
SHIELD-SWIFT-003
Command injection via Process arguments
critical · CWE-78
SHIELD-SWIFT-004
Command injection via system call
critical · CWE-78
SHIELD-SWIFT-005
WebView JavaScript injection
high · CWE-79
SHIELD-SWIFT-006
WebView HTML injection via loadHTMLString
high · CWE-79
SHIELD-SWIFT-007
Weak hash for password
high · CWE-327
SHIELD-SWIFT-008
Insecure DES or ECB cipher
high · CWE-327
SHIELD-SWIFT-009
Hardcoded secret in source
high · CWE-798
SHIELD-SWIFT-010
Insecure TLS trust bypass
critical · CWE-295
SHIELD-SWIFT-011
Arbitrary insecure HTTP loads allowed
high · CWE-319
SHIELD-SWIFT-012
Sensitive data stored in UserDefaults
high · CWE-922
SHIELD-SWIFT-013
Path traversal via file read
high · CWE-22
SHIELD-SWIFT-014
SSRF via dynamic URL request
high · CWE-918
SHIELD-SWIFT-015
Insecure random for security token
high · CWE-338
SHIELD-SWIFT-016
Sensitive data copied to pasteboard
medium · CWE-200
SHIELD-SWIFT-017
Keychain item without access control
medium · CWE-311

Rust · 15 rules

SHIELD-RUST-001
SQL injection via format! in query
critical · CWE-89
SHIELD-RUST-002
SQL injection via diesel sql_query with format!
critical · CWE-89
SHIELD-RUST-003
SQL injection via string concatenation
high · CWE-89
SHIELD-RUST-004
Command injection via interpolated argument
critical · CWE-78
SHIELD-RUST-005
Command execution via shell interpreter
critical · CWE-78
SHIELD-RUST-006
Unsafe block requires review
medium · CWE-119
SHIELD-RUST-007
Insecure deserialization of untrusted bytes
medium · CWE-502
SHIELD-RUST-008
Weak cryptographic hash
high · CWE-327
SHIELD-RUST-009
Hardcoded credential
high · CWE-798
SHIELD-RUST-010
Insecure randomness for security value
medium · CWE-338
SHIELD-RUST-011
SSRF via user-controlled request URL
high · CWE-918
SHIELD-RUST-012
Path traversal via user-controlled file path
high · CWE-22
SHIELD-RUST-013
TLS certificate verification disabled
critical · CWE-295
SHIELD-RUST-014
Potential integer overflow in allocation size
low · CWE-190
SHIELD-RUST-015
SQL statement built with format!
high · CWE-89

Dart · 14 rules

SHIELD-DART-001
SQL injection via raw query interpolation
critical · CWE-89
SHIELD-DART-002
Command injection via shell process execution
critical · CWE-78
SHIELD-DART-003
Command injection via interpolated process arguments
high · CWE-78
SHIELD-DART-004
WebView JavaScript injection
high · CWE-79
SHIELD-DART-005
Insecure certificate validation bypass
critical · CWE-295
SHIELD-DART-006
Insecure cleartext HTTP endpoint
medium · CWE-319
SHIELD-DART-007
Weak cryptographic hash
high · CWE-327
SHIELD-DART-008
Hardcoded secret credential
high · CWE-798
SHIELD-DART-009
Sensitive data in insecure storage
high · CWE-312
SHIELD-DART-010
Path traversal via unsanitized file path
high · CWE-22
SHIELD-DART-011
SSRF via user-controlled request URL
high · CWE-918
SHIELD-DART-012
Insecure random for security tokens
medium · CWE-338
SHIELD-DART-013
Sensitive data logged to console
medium · CWE-532
SHIELD-DART-014
WebView with unrestricted JavaScript mode
high · CWE-749

Go · 12 rules

SHIELD-GO-001
SQL Injection via string formatting
critical · CWE-89
SHIELD-GO-002
SQL Injection via string concatenation
critical · CWE-89
SHIELD-GO-003
Weak cryptographic hash (MD5)
high · CWE-327
SHIELD-GO-004
Weak cryptographic hash (SHA1)
high · CWE-327
SHIELD-GO-005
Insecure random number generation via math/rand
medium · CWE-338
SHIELD-GO-006
Path traversal via user-controlled filepath
high · CWE-22
SHIELD-GO-007
Command injection via exec.Command with user input
critical · CWE-78
SHIELD-GO-008
TLS InsecureSkipVerify enabled
high · CWE-295
SHIELD-GO-009
Hardcoded password or secret
high · CWE-798
SHIELD-GO-010
Server-Side Request Forgery via http.Get with user input
high · CWE-918
SHIELD-GO-011
Open redirect via http.Redirect with user input
medium · CWE-601
SHIELD-GO-012
Use of deprecated ioutil package
low · CWE-477

General · 3 rules

SHIELD-GEN-001
Hardcoded IP address
medium · CWE-284
SHIELD-GEN-002
Security-sensitive TODO/FIXME comment
low · CWE-1068
SHIELD-GEN-010
Disabled SSL/TLS verify in curl command
medium · CWE-295

CI/CD · 2 rules

SHIELD-CI-001
GitHub Actions dependency pinned to a mutable tag
high · CWE-1357
SHIELD-CI-002
GitHub Actions script injection via untrusted event input
high · CWE-94
Security Rules Reference — 221 SAST rules across 14 languages — Zennoxa Shield