propagate

Pattern Propagation

When you find one vulnerability, search for the same pattern everywhere else. Developers often make the same mistake repeatedly.

Philosophy

"If you find one bug, look for the same bug everywhere else." - Common Bug Bounty Wisdom

Why pattern propagation works:

1. Developers copy/paste code
2. Codebases have consistent (bad) patterns
3. Same developer makes same mistakes
4. Frameworks encourage certain anti-patterns
5. One finding often multiplies into many

---

Usage

Option 1: Describe the Pattern

/vuln-scout:propagate "string concatenation in SQL queries"

Option 2: Reference a Known Vulnerability

/vuln-scout:propagate src/api/users.py:45

The command will analyze the code at that location and extract the generalizable pattern.

---

Phase 1: Pattern Extraction

If file:line provided

1. Read the specified file and line
2. Analyze the vulnerable code
3. Identify the anti-pattern
4. Extract searchable characteristics

Example analysis:

# Given: src/api/users.py:45
# Code: query = f"SELECT * FROM users WHERE id = {user_id}"

# Extracted pattern:
# - f-string or format() with SQL keywords
# - Variable interpolation in query string
# - Missing parameterization

If description provided

1. Parse the vulnerability description
2. Map to known vulnerability patterns
3. Generate search patterns

Example mapping:

Description: "string concatenation in SQL queries"

Patterns:
- f"SELECT.*{
- "SELECT.*" +
- "SELECT.*%s" %
- "SELECT.*".format(
- query.*=.*+.*user

---

Phase 2: Generate Search Patterns

SQL Injection Patterns

# f-strings with SQL
grep -rniE 'f"(SELECT|INSERT|UPDATE|DELETE|FROM|WHERE).*\{' --include="*.py"

# String concatenation with SQL
grep -rniE '"(SELECT|INSERT|UPDATE|DELETE).*"\s*\+' --include="*.py" --include="*.java" --include="*.js"

# Format strings with SQL
grep -rniE '(SELECT|INSERT|UPDATE|DELETE).*%s.*%' --include="*.py"
grep -rniE '\.format\(.*\).*(SELECT|INSERT|UPDATE|DELETE)' --include="*.py"