language-baseline

Baseline

Applies when: Writing or committing code that builds SQL from non-literal values, runs a subprocess/shell with non-literal arguments, writes input into the DOM/HTML, resolves a filesystem path from input, deserializes untrusted data, executes a string as code, bypasses type-system checks, or issues an outbound HTTP request to an input-derived URL.

Always:

• Route SQL values through driver parameter binding; never string concatenation, f-strings, template literals, or ORM raw-query helpers.
• Run subprocesses with an argv array and no shell (shell=False); the command name is a literal or from an allowlist, never derived from input.
• Write user-controlled values to the DOM/HTML only through escaping sinks (textContent, not innerHTML/document.write); sanitize with a vetted library when raw HTML is required.
• Normalize input-derived filesystem paths: strip to basename, join against a known-safe directory, resolve symlinks, and reject anything outside that directory.
• Deserialize untrusted data only with type-constrained formats (json.loads, yaml.safe_load); never pickle.loads, unsafe yaml.load, Marshal.load, ObjectInputStream, or unserialize.
• Never execute a string as code (eval, new Function, setTimeout(stringArg)) or bypass type-system checks (as any, @ts-ignore) on external input.
• Before an outbound HTTP request to an input-derived URL, check the host against an allowlist and reject internal/link-local IP ranges.

Never:

• SQL built by string concatenation, f-strings, or template literals with non-literal values.
• subprocess/exec/system invoked with a single shell-interpreted string containing non-literal elements.
• innerHTML, document.write, dangerouslySetInnerHTML, or {{ x | safe }} fed with unsanitized user input.
• pickle.loads, yaml.load/yaml.unsafe_load, Marshal.load, or unserialize on external data.
• eval, new Function, or TypeScript as any/@ts-ignore used to bypass validation of external input.

Open the full component before acting: it has the examples, the remediation steps, and the detection patterns.