sharp-edges

Sharp Edges Detector

Adapted from Trail of Bits' sharp-edges skill. Identifies API usage patterns and code constructs that are technically valid but frequently lead to security vulnerabilities or reliability failures.

What You're Looking For

Dangerous Function Calls

• eval(), exec(), Function() with user-controlled input
• innerHTML, dangerouslySetInnerHTML with unsanitized data
• subprocess.call(shell=True) or os.system() with string interpolation
• pickle.loads(), yaml.load() (unsafe deserializer), JSON.parse() on untrusted input without schema validation
• Math.random() or random.random() for security-sensitive operations (use crypto.randomBytes or secrets module)

SQL and Injection Vectors

• String concatenation or template literals in SQL queries
• ORM raw query methods with unparameterized input
• LDAP, XPath, or command injection via string interpolation
• GraphQL queries built from user input without validation

Concurrency and Race Conditions

• TOCTOU (Time-of-Check-Time-of-Use) patterns: checking a condition and acting on it in separate operations
• Shared mutable state without synchronization
• Non-atomic read-modify-write sequences
• File operations without proper locking

Path and File Operations

• Path construction from user input without canonicalization
• Directory traversal via ../ in user-supplied paths
• Symlink following without verification
• Temporary file creation with predictable names

Cryptographic Footguns

• MD5 or SHA1 for password hashing (use bcrypt, scrypt, or argon2)
• ECB mode for encryption
• Hardcoded IVs or nonces
• Custom cryptographic implementations
• Insufficient key lengths

Type and Memory Safety

• Unchecked type assertions/casts
• Integer overflow in arithmetic used for allocation or indexing
• Buffer operations without bounds checking
• Null pointer dereference patterns

Scan Protocol

1. Parse the changed files into AST (or analyze textually for config files)
2. Walk the AST looking for known dangerous patterns
3. For each finding, assess:
   - Is the input user-controlled? (worse) or internal? (less bad)
   - Is there sanitization/validation nearby? (might be OK)
   - Is this in a test file? (lower severity)
4. Classify and report