code-review-dangerous-sinkslisted

# Dangerous sinks by language (grep catalog) ## When it applies You're reading source and want the fastest path to bugs: grep every dangerous sink, then trace each hit's argument back to user input. ## Why it works A small set of functions cause most severe bugs (command/code exec, SQL, deserialization, file access, SSRF). Enumerating them turns review into "find the sink → prove the source". ## Sinks to grep (trace the argument to a user source) - **Command exec (RCE, CWE-78)**: PHP `system exec shell_exec passthru proc_open` · Python `os.system subprocess.*(shell=True) os.popen` · Node `child_process.exec execSync` · Java `Runtime.exec ProcessBuilder` · Ruby `` system exec `backticks` %x() `` · Go `exec.Command`. - **Code eval (CWE-94)**: `eval` (all), Python `exec pickle.loads`, Node `Function() vm`, PHP `eval assert create_function preg_replace/e`, Ruby `eval send`. - **SQL (CWE-89)**: string-built queries / concatenation into `query execute` (all ORMs have a raw path — grep `raw`, `.query(`, `String.format` near SQL). - **Deserialization (CWE-502)**: Python `pickle yaml.load(!safe) marshal`, Java `readObject XMLDecoder`, PHP `unserialize`, Ruby `Marshal.load YAML.load`, .NET `BinaryFormatter`. - **File/path (CWE-22)**: `open read include require fopen readFile sendFile` with user paths; archive extractors (zip-slip). - **SSRF (CWE-918)**: URL fetchers — `requests.get urllib curl file_get_contents http.get HttpClient` taking a user URL. - **Template (SSTI