@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/language-specific/python-security.yaml

@@ -0,0 +1,295 @@
+metadata:
+  skill: security
+  domain: python_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: python-security.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - cve_reference
+  - example_vuln
+  - example_fix
+patterns:
+- id: PY-01
+  name: Pickle Deserialization RCE
+  severity: CRITICAL
+  category: Deserialization
+  description: pickle.load on untrusted data leads to arbitrary code execution
+  detection_pattern: (pickle\\.load|pickle\\.loads|cPickle\\.load)(?!.*trusted)
+  fix_pattern: Use JSON safetensors or restrict classes with pickle.Unpickler
+  cwe: CWE-502
+  cve_reference: CVE-2024-50050,CVE-2025-3108
+  example_vuln: data = pickle.loads(request.data)
+  example_fix: 'data = json.loads(request.data) # or safetensors'
+- id: PY-02
+  name: SSTI Jinja2 RCE
+  severity: CRITICAL
+  category: Injection
+  description: render_template_string with user input leads to RCE
+  detection_pattern: render_template_string.*request|Template\\(.*input
+  fix_pattern: Use render_template with static templates never string input
+  cwe: CWE-94
+  cve_reference: CVE-2024-56085
+  example_vuln: render_template_string(user_input)
+  example_fix: render_template('safe.html', data=user_input)
+- id: PY-03
+  name: subprocess Shell Injection
+  severity: CRITICAL
+  category: Injection
+  description: shell=True with user input allows command injection
+  detection_pattern: subprocess\\.(run|call|Popen).*shell\\s*=\\s*True.*input
+  fix_pattern: Use list arguments never shell=True with user input
+  cwe: CWE-78
+  cve_reference: CVE-2024-3126
+  example_vuln: subprocess.run(f'echo {user}', shell=True)
+  example_fix: subprocess.run(['echo', user], shell=False)
+- id: PY-04
+  name: eval/exec RCE
+  severity: CRITICAL
+  category: Injection
+  description: eval or exec with user input leads to arbitrary code execution
+  detection_pattern: (eval|exec)\\s*\\(.*request|input|user
+  fix_pattern: Never use eval/exec with user input use ast.literal_eval
+  cwe: CWE-94
+  cve_reference: n/a
+  example_vuln: result = eval(request.form['expr'])
+  example_fix: import ast; result = ast.literal_eval(safe_expr)
+- id: PY-05
+  name: tarfile Path Traversal
+  severity: HIGH
+  category: File
+  description: tarfile extractall without filter allows path traversal
+  detection_pattern: tarfile\\.(open|extractall)(?!.*filter)
+  fix_pattern: Use extractall with filter parameter (Python 3.12+)
+  cwe: CWE-22
+  cve_reference: CVE-2024-12718,CVE-2025-4138
+  example_vuln: tar.extractall(path)
+  example_fix: 'tar.extractall(path, filter=''data'') # Python 3.12+'
+- id: PY-06
+  name: yaml.unsafe_load RCE
+  severity: CRITICAL
+  category: Deserialization
+  description: yaml.load without SafeLoader allows code execution
+  detection_pattern: yaml\\.load\\s*\\([^)]*(?!Loader=yaml\\.SafeLoader)
+  fix_pattern: Always use yaml.safe_load or specify SafeLoader
+  cwe: CWE-502
+  cve_reference: n/a
+  example_vuln: data = yaml.load(file)
+  example_fix: data = yaml.safe_load(file)
+- id: PY-07
+  name: os.system Injection
+  severity: CRITICAL
+  category: Injection
+  description: os.system with user input allows command injection
+  detection_pattern: os\\.system\\s*\\(.*input|request|user
+  fix_pattern: Use subprocess.run with list arguments
+  cwe: CWE-78
+  cve_reference: n/a
+  example_vuln: os.system('grep ' + user_input)
+  example_fix: subprocess.run(['grep', user_input])
+- id: PY-08
+  name: SQLAlchemy Raw Query
+  severity: HIGH
+  category: Injection
+  description: text() with string concatenation allows SQL injection
+  detection_pattern: (text|execute)\\s*\\(.*\\+.*input|f['\].*select"
+  fix_pattern: Use bound parameters with text() or ORM methods
+  cwe: CWE-89
+  cve_reference: n/a
+  example_vuln: db.execute(text(f'SELECT * WHERE id={id}'))
+  example_fix: 'db.execute(text(''SELECT * WHERE id=:id''), {''id'': id})'
+- id: PY-09
+  name: Flask Debug Mode Production
+  severity: HIGH
+  category: Configuration
+  description: Debug mode enabled in production exposes Werkzeug console
+  detection_pattern: app\\.run\\(.*debug\\s*=\\s*True(?!.*if.*__name__)
+  fix_pattern: Disable debug mode in production use environment config
+  cwe: CWE-200
+  cve_reference: n/a
+  example_vuln: app.run(debug=True)
+  example_fix: app.run(debug=os.getenv('FLASK_DEBUG', False))
+- id: PY-10
+  name: format String Injection
+  severity: MEDIUM
+  category: Injection
+  description: format() or f-strings with user input can leak data
+  detection_pattern: (format|f['\]).*\\{.*input|\\.format\\(.*request"
+  fix_pattern: Validate input or use safe template engines
+  cwe: CWE-134
+  cve_reference: n/a
+  example_vuln: 'msg = f''{user_input}'' # May contain {__class__}'
+  example_fix: 'msg = safe_format(user_input) # Validate first'
+- id: PY-11
+  name: Insecure Random
+  severity: HIGH
+  category: Cryptography
+  description: random module used for security-sensitive values
+  detection_pattern: import\\s+random(?!.*secrets)|random\\.(randint|choice).*token
+  fix_pattern: Use secrets module for cryptographic randomness
+  cwe: CWE-330
+  cve_reference: n/a
+  example_vuln: token = random.randint(0, 999999)
+  example_fix: token = secrets.token_urlsafe(32)
+- id: PY-12
+  name: Hardcoded Credentials
+  severity: HIGH
+  category: Secrets
+  description: Password or API key hardcoded in source
+  detection_pattern: (password|api_key|secret)\\s*=\\s*['\][^'\"]+['\"]"
+  fix_pattern: Use environment variables or secrets manager
+  cwe: CWE-798
+  cve_reference: n/a
+  example_vuln: API_KEY = 'sk-1234567890'
+  example_fix: API_KEY = os.getenv('API_KEY')
+- id: PY-13
+  name: Path Traversal os.path
+  severity: HIGH
+  category: File
+  description: User input in file path without validation
+  detection_pattern: os\\.path\\.join.*request|open\\(.*input(?!.*safe)
+  fix_pattern: Use os.path.realpath and validate against base directory
+  cwe: CWE-22
+  cve_reference: n/a
+  example_vuln: open(os.path.join(base, user_file))
+  example_fix: 'safe_path = os.path.realpath(os.path.join(base, user_file))\nif not safe_path.startswith(base): raise'
+- id: PY-14
+  name: SSRF requests
+  severity: HIGH
+  category: Network
+  description: User URL fetched without validation
+  detection_pattern: requests\\.(get|post)\\(.*input(?!.*allowlist)
+  fix_pattern: Validate URLs against allowlist block internal IPs
+  cwe: CWE-918
+  cve_reference: n/a
+  example_vuln: requests.get(user_url)
+  example_fix: 'if is_allowed_url(user_url): requests.get(user_url)'
+- id: PY-15
+  name: XML External Entity
+  severity: CRITICAL
+  category: Injection
+  description: XML parsing with external entities enabled
+  detection_pattern: etree\\.(parse|fromstring)(?!.*resolve_entities.*False)
+  fix_pattern: Disable external entity resolution in lxml defusedxml
+  cwe: CWE-611
+  cve_reference: n/a
+  example_vuln: tree = etree.parse(xml_file)
+  example_fix: from defusedxml import ElementTree as ET\ntree = ET.parse(xml_file)
+- id: PY-16
+  name: JWT Algorithm None
+  severity: CRITICAL
+  category: Authentication
+  description: JWT verification allows algorithm none
+  detection_pattern: jwt\\.decode\\(.*algorithms\\s*=\\s*None
+  fix_pattern: Explicitly specify allowed algorithms
+  cwe: CWE-347
+  cve_reference: n/a
+  example_vuln: jwt.decode(token, key, algorithms=None)
+  example_fix: jwt.decode(token, key, algorithms=['HS256'])
+- id: PY-17
+  name: Regex DoS ReDoS
+  severity: HIGH
+  category: DoS
+  description: Vulnerable regex pattern with user input
+  detection_pattern: re\\.compile\\(.*input|re\\.(match|search).*user
+  fix_pattern: Use re2 or timeout limit input length
+  cwe: CWE-400
+  cve_reference: n/a
+  example_vuln: re.match(user_regex, data)
+  example_fix: import google_re2 as re2\nre2.match(pattern, data)
+- id: PY-18
+  name: Race Condition File
+  severity: HIGH
+  category: Concurrency
+  description: TOCTOU race condition in file operations
+  detection_pattern: os\\.path\\.exists.*open|if.*isfile.*then.*open
+  fix_pattern: Use atomic operations or file locking
+  cwe: CWE-367
+  cve_reference: n/a
+  example_vuln: 'if os.path.exists(f): open(f) # TOCTOU'
+  example_fix: 'with open(f, ''x'') as file: # Atomic create'
+- id: PY-19
+  name: Insecure Temp File
+  severity: MEDIUM
+  category: File
+  description: tempfile created with predictable name or permissions
+  detection_pattern: tempfile\\.mk(s)?temp(?!.*dir=)
+  fix_pattern: Use tempfile.NamedTemporaryFile or mkstemp with secure dir
+  cwe: CWE-377
+  cve_reference: n/a
+  example_vuln: f = tempfile.mktemp()
+  example_fix: 'with tempfile.NamedTemporaryFile(delete=False) as f:'
+- id: PY-20
+  name: Assert Security Check
+  severity: MEDIUM
+  category: Logic
+  description: Assert used for security checks bypassed with -O flag
+  detection_pattern: assert\\s+.*authenticated|assert.*authorized
+  fix_pattern: Use if-raise pattern for security checks
+  cwe: CWE-617
+  cve_reference: n/a
+  example_vuln: 'assert user.is_admin # Bypassed with python -O'
+  example_fix: 'if not user.is_admin: raise PermissionError()'
+- id: PY-21
+  name: Dynamic Import Injection
+  severity: HIGH
+  category: Injection
+  description: importlib with user input allows code execution
+  detection_pattern: importlib\\.import_module\\(.*input
+  fix_pattern: Validate module against allowlist
+  cwe: CWE-94
+  cve_reference: n/a
+  example_vuln: mod = importlib.import_module(user_module)
+  example_fix: 'if user_module in ALLOWED: mod = importlib.import_module(user_module)'
+- id: PY-22
+  name: Django ORM extra() Injection
+  severity: HIGH
+  category: Injection
+  description: extra() with raw SQL allows injection
+  detection_pattern: extra\\(.*where.*=.*\\+|extra\\(select=\\{.*\\+
+  fix_pattern: Use ORM methods or parameterized raw queries
+  cwe: CWE-89
+  cve_reference: n/a
+  example_vuln: Model.objects.extra(where=['id=' + id])
+  example_fix: Model.objects.filter(id=id)
+- id: PY-23
+  name: Weak Password Hash
+  severity: HIGH
+  category: Cryptography
+  description: MD5 SHA1 or unsalted hash for passwords
+  detection_pattern: (md5|sha1)\\(.*password|hashlib\\.(md5|sha1)
+  fix_pattern: Use bcrypt argon2 or PBKDF2 with sufficient rounds
+  cwe: CWE-327
+  cve_reference: n/a
+  example_vuln: hashlib.md5(password.encode()).hexdigest()
+  example_fix: from argon2 import PasswordHasher; ph.hash(password)
+- id: PY-24
+  name: Socket Race Condition
+  severity: HIGH
+  category: Network
+  description: socket.socketpair fallback race on Windows
+  detection_pattern: socket\\.socketpair(?!.*verify)
+  fix_pattern: Upgrade Python 3.12+ or verify connection manually
+  cwe: CWE-362
+  cve_reference: CVE-2024-3219
+  example_vuln: s1, s2 = socket.socketpair()
+  example_fix: '# Python 3.12 fixes this - upgrade'
+- id: PY-25
+  name: Sandbox Escape exec
+  severity: CRITICAL
+  category: Sandbox
+  description: Restricted exec can be bypassed with builtins
+  detection_pattern: exec\\(.*\\{['\]__builtins__"
+  fix_pattern: Never use exec for sandboxing use proper isolation
+  cwe: CWE-94
+  cve_reference: n/a
+  example_vuln: 'exec(code, {''__builtins__'': {}})'
+  example_fix: '# Use subprocess with restricted user or container'

package/.agent/skills/core/security/data/language-specific/ruby-security.yaml

@@ -0,0 +1,198 @@
+metadata:
+  skill: security
+  domain: ruby_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: ruby-security.csv
+  patterns_count: 20
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - example_code
+patterns:
+- id: RB-01
+  name: Mass Assignment
+  severity: CRITICAL
+  category: Injection
+  description: Unprotected attributes allow overwriting sensitive fields
+  detection_pattern: params\\.permit|attr_accessible(?!.*:role)
+  fix_pattern: Use strong_parameters with explicit permit list
+  cwe: CWE-915
+  example_code: '# BAD\nUser.create(params[:user])\n# GOOD\nUser.create(params.require(:user).permit(:name, :email))'
+- id: RB-02
+  name: Marshal Deserialization
+  severity: CRITICAL
+  category: Injection
+  description: Marshal.load on untrusted data leads to RCE
+  detection_pattern: Marshal\\.load(?!.*trusted)
+  fix_pattern: Use JSON.parse instead of Marshal for untrusted data
+  cwe: CWE-502
+  example_code: '# RCE via Marshal\nMarshal.load(Base64.decode64(cookies[:session]))\n# SAFE: Use JSON\nJSON.parse(data)'
+- id: RB-03
+  name: YAML.load Unsafe
+  severity: CRITICAL
+  category: Injection
+  description: YAML.load executes arbitrary Ruby code
+  detection_pattern: YAML\\.load(?!_file|.*permitted)
+  fix_pattern: Use YAML.safe_load with permitted_classes
+  cwe: CWE-502
+  example_code: '# RCE via YAML\nYAML.load(user_input)\n# SAFE\nYAML.safe_load(user_input, permitted_classes: [Date])'
+- id: RB-04
+  name: ERB Injection SSTI
+  severity: CRITICAL
+  category: Injection
+  description: User input in ERB template leads to code execution
+  detection_pattern: ERB\\.new\\(.*\\#\\{|render.*inline.*params
+  fix_pattern: Never use user input in ERB templates directly
+  cwe: CWE-94
+  example_code: '# SSTI\nERB.new(\<%= #{params[:name]} %>\").result\n# SAFE: Escape output"'
+- id: RB-05
+  name: Command Injection system
+  severity: CRITICAL
+  category: Injection
+  description: User input in system/exec/backticks
+  detection_pattern: system\\(.*\\#\\{|`.*\\#\\{|exec\\(.*\\+
+  fix_pattern: Use array form or shellwords escape
+  cwe: CWE-78
+  example_code: '# Vulnerable\nsystem(\ls #{params[:dir]}\")\n# SAFE\nsystem(''ls'''
+- id: RB-06
+  name: SQL Injection Raw
+  severity: CRITICAL
+  category: Injection
+  description: Raw SQL with string interpolation
+  detection_pattern: where\\(.*\\#\\{|find_by_sql.*\\#\\{
+  fix_pattern: Use parameterized queries with ?
+  cwe: CWE-89
+  example_code: '# SQLi\nUser.where(\name = ''#{params[:name]}''\")\n# SAFE\nUser.where(name: params[:name])"'
+- id: RB-07
+  name: Open Redirect
+  severity: HIGH
+  category: Web
+  description: Unvalidated redirect_to with user input
+  detection_pattern: redirect_to\\s+params|redirect_to.*url(?!_for)
+  fix_pattern: Whitelist allowed redirect paths
+  cwe: CWE-601
+  example_code: '# Open redirect\nredirect_to params[:url]\n# SAFE\nredirect_to url_for(params[:path].presence_in(ALLOWED))'
+- id: RB-08
+  name: Path Traversal send_file
+  severity: HIGH
+  category: Web
+  description: send_file with user-controlled path
+  detection_pattern: send_file.*params|send_data.*File\\.read.*params
+  fix_pattern: Validate path within allowed directory
+  cwe: CWE-22
+  example_code: '# Path traversal\nsend_file(params[:file])\n# SAFE\nsend_file(Rails.root.join(''public'', File.basename(params[:file])))'
+- id: RB-09
+  name: Eval Code Execution
+  severity: CRITICAL
+  category: Injection
+  description: eval/instance_eval on user input
+  detection_pattern: eval\\(.*params|instance_eval.*user
+  fix_pattern: Never use eval on user input
+  cwe: CWE-94
+  example_code: '# RCE\neval(params[:code])\n# SAFE: Use whitelist of allowed operations'
+- id: RB-10
+  name: render inline XSS
+  severity: HIGH
+  category: Web
+  description: render inline without escaping
+  detection_pattern: render.*inline.*params(?!.*escape)
+  fix_pattern: Use html_safe only on trusted content
+  cwe: CWE-79
+  example_code: '# XSS\nrender inline: params[:content]\n# SAFE\nrender inline: ERB::Util.html_escape(params[:content])'
+- id: RB-11
+  name: Insecure Regex ReDoS
+  severity: MEDIUM
+  category: DoS
+  description: Regex with nested quantifiers vulnerable to ReDoS
+  detection_pattern: Regexp\\.new.*\\+\\*|\\(.*\\*\\)\\+
+  fix_pattern: Use timeout or safe regex patterns
+  cwe: CWE-1333
+  example_code: '# ReDoS vulnerable\n/(a+)+$/.match(user_input)\n# SAFE: Use timeout or re2 gem'
+- id: RB-12
+  name: Session Fixation
+  severity: HIGH
+  category: Auth
+  description: Session not regenerated after login
+  detection_pattern: session\\[:user_id\\]\\s*=(?!.*reset_session)
+  fix_pattern: Call reset_session before setting user
+  cwe: CWE-384
+  example_code: '# Fixation\nsession[:user_id] = user.id\n# SAFE\nreset_session; session[:user_id] = user.id'
+- id: RB-13
+  name: CSRF Token Skip
+  severity: HIGH
+  category: Web
+  description: skip_forgery_protection without API check
+  detection_pattern: skip_forgery_protection|protect_from_forgery.*except
+  fix_pattern: Only skip for stateless API endpoints
+  cwe: CWE-352
+  example_code: '# Risky\nskip_forgery_protection\n# SAFE\nprotect_from_forgery with: :null_session, if: -> { request.format.json? }'
+- id: RB-14
+  name: Weak Password Hash
+  severity: HIGH
+  category: Crypto
+  description: Using MD5/SHA1 for password storage
+  detection_pattern: Digest::(MD5|SHA1).*password|digest.*password
+  fix_pattern: Use bcrypt via has_secure_password
+  cwe: CWE-328
+  example_code: '# Weak\nDigest::SHA1.hexdigest(password)\n# SAFE\nhas_secure_password'
+- id: RB-15
+  name: Constant Comparison Timing
+  severity: MEDIUM
+  category: Crypto
+  description: String comparison vulnerable to timing attack
+  detection_pattern: ==.*secret|secret.*==(?!.*secure_compare)
+  fix_pattern: Use ActiveSupport::SecurityUtils.secure_compare
+  cwe: CWE-208
+  example_code: '# Timing attack\nparams[:token] == secret_token\n# SAFE\nActiveSupport::SecurityUtils.secure_compare(params[:token], secret_token)'
+- id: RB-16
+  name: File.read Arbitrary
+  severity: HIGH
+  category: LFI
+  description: File.read with user input allows LFI
+  detection_pattern: File\\.(read|open).*params
+  fix_pattern: Validate path and use safe_join
+  cwe: CWE-22
+  example_code: '# LFI\nFile.read(params[:path])\n# SAFE: Validate and restrict to allowed directory'
+- id: RB-17
+  name: Paperclip/Shrine RCE
+  severity: CRITICAL
+  category: Upload
+  description: Image processing without validation
+  detection_pattern: has_attached_file|Shrine(?!.*validate)
+  fix_pattern: Validate content type and use imagemagick safely
+  cwe: CWE-434
+  example_code: '# RCE via ImageMagick\nhas_attached_file :avatar\n# SAFE: Validate and restrict types'
+- id: RB-18
+  name: ActiveRecord Serialize
+  severity: HIGH
+  category: Injection
+  description: serialize with unsafe coder class
+  detection_pattern: serialize.*Marshal|serialize(?!.*JSON|coder)
+  fix_pattern: Use JSON coder for serialization
+  cwe: CWE-502
+  example_code: '# Unsafe\nserialize :data, Marshal\n# SAFE\nserialize :data, JSON'
+- id: RB-19
+  name: Logger Injection
+  severity: MEDIUM
+  category: Log
+  description: User input in logs without sanitization
+  detection_pattern: Rails\\.logger\\.(info|debug).*params
+  fix_pattern: Sanitize user input before logging
+  cwe: CWE-117
+  example_code: '# Log injection\nRails.logger.info(\User: #{params[:user]}\")\n# SAFE: Filter and sanitize"'
+- id: RB-20
+  name: Rack CRLF Injection
+  severity: HIGH
+  category: Web
+  description: User input in headers allows CRLF
+  detection_pattern: response\\.headers\\[.*\\]\\s*=.*params
+  fix_pattern: Validate header values
+  cwe: CWE-113
+  example_code: '# CRLF\nresponse.headers[''X-Custom''] = params[:header]\n# SAFE: Validate alphanumeric only'