security-patterns

Security Patterns

🔍 Code Searchability Patterns

Find security-patterns Issues with ast-grep

# Find parseFloat($$$)
# Find env.$DB.prepare(`SELECT $QUERY`)
# Find new Date()
# Find WASM.*exports
ast-grep --pattern 'parseFloat($$$)' src/
ast-grep --pattern 'env.$DB.prepare(`SELECT $QUERY`)' src/
ast-grep --pattern 'new Date()' src/
ast-grep --pattern 'WASM.*exports' src/
sg -p 'parseFloat($$$)' src/
sg -p 'env.$DB.prepare(`SELECT' src/
sg -p 'new' src/
sg -p 'WASM.*exports' src/

security-patterns Discovery Commands

sg search "parseFloat" src/
sg search "SELECT" src/
sg search "new Date()" src/
sg search "WASM" src/

Search Examples

# Find parseFloat usage (security risk)
sg search 'parseFloat($$$)' src/
# Find SQL injection risks
sg search 'env.$DB.prepare(`SELECT' src/
# Find timezone issues
sg search 'new' src/
# Find WASM memory leaks
sg search 'WASM.*exports' src/

Input Validation

Parameter Validation

// ✅ CORRECT: Validate all inputs
function validateInput(input: unknown): boolean {
  if (typeof input !== 'string') return false;
  if (input.length === 0) return false;
  if (input.length > 1000) return false;
  return true;
}

// ❌ WRONG: No validation
function processInput(input: unknown) {
  // Direct use without validation
  return input.toString();
}

SQL Injection Prevention

// ✅ CORRECT: Parameterized queries
const result = await env.ANALYTICS.prepare(`
  SELECT * FROM users WHERE id = ? AND status = ?
`).bind(userId, status).all();

// ❌ WRONG: String interpolation
const result = await env.ANALYTICS.prepare(`
  SELECT * FROM users WHERE id = '${userId}' AND status = '${status}'
`).all();

XSS Prevention

// ✅ CORRECT: Sanitize output
function sanitizeOutput(input: string): string {
  return input
    .replace(/&/g, '&')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#x27;');
}

// ❌ WRONG: Direct output
function displayUserInput(input: string) {
  return `<div>${input}</div>`; // XSS risk
}