dangerous-flows

Dangerous Flow Identification

A Dangerous Flow occurs when user input—or data derived from it—is used in a way that introduces vulnerabilities, undefined behavior, or unwanted system interactions. This can range from command injection, SSRF, and path traversal to logic bugs and broken access controls. The goal is to trace the lifecycle of untrusted inputs and assess whether their use is safe.

---

Starting the Session

1. If the project is very large, you may ask the user for what specific flow he wishes to test or for where more specific area of the code he is interested in.

Example of Dangerous Flow in JavaScript

const express = require('express');
const fs = require('fs');
const app = express();

app.get('/read', (req, res) => {
  const filename = req.query.file; // User input
  fs.readFile(`/home/userdata/${filename}`, (err, data) => {  // Dangerous usage
    if (err) return res.status(500).send("Error reading file");
    res.send(data);
  });
});

Danger: This allows for Path Traversal (e.g., ?file=../../etc/passwd), enabling unauthorized file access.

---

Identifying User Inputs

1. Web/Backend Projects

   • Look for where routes or API endpoints are defined (e.g., Express app.get(), Flask @app.route, FastAPI).
   • Search for request/response objects: req, res, request, ctx, etc.

2. CLI/Native Applications

   • Look for process.argv, getopt, or direct stdin usage.
   • Watch for file input, env variables, user config, or interactive prompts.

3. Persisted Inputs

   • Even if sanitized once, data stored in a DB, config, or file can be reused unsafely.
   • These create second-order injection risks.

---

Following the Flow

1. Start Point Detection

   • Look for parameters from user input:

     • req.body, req.query, input(), prompt(), fs.readFileSync(userInput), etc.

   • Example:

     username = input("Enter username:")  # user input