injection

OWASP A05:2025 — Injection: Python Security Testing Skill

Overview

Injection occurs when untrusted user input reaches an interpreter — a database, OS shell, template engine, or browser — and is executed as part of a command or query. Despite dropping from #3 to #5 in 2025, Injection carries the most CVEs of any OWASP category: 62,445, including 30,000+ for XSS alone.

Injection types covered by this skill:

• SQL Injection (SQLi) — CWE-89
• Cross-Site Scripting (XSS) — CWE-79
• Server-Side Template Injection (SSTI) — CWE-94
• OS Command Injection — CWE-78 / CWE-77
• ORM Injection
• Input Validation failures — CWE-20
• LLM Prompt Injection (related class, noted in OWASP 2025)

---

Detection Checklist

1. SQL Injection (CWE-89)

High-risk patterns to flag:

# ❌ VULNERABLE — f-string in raw SQL
db.execute(f"SELECT * FROM users WHERE email = '{email}'")

# ❌ VULNERABLE — .format() in SQLAlchemy text()
db.execute(text("SELECT * FROM users WHERE id = {}".format(user_id)))

# ❌ VULNERABLE — string concatenation in ORM raw query
User.query.filter(text("name = '" + name + "'"))

Safe patterns to enforce:

# ✅ SAFE — bound parameters in SQLAlchemy text()
db.execute(text("SELECT * FROM users WHERE email = :email"), {"email": email})

# ✅ SAFE — ORM method (avoids interpreter entirely)
User.query.filter_by(email=email).first()

# ✅ SAFE — FastAPI with Pydantic + SQLAlchemy ORM
async def get_user(user_id: int, db: Session = Depends(get_db)):
    return db.query(User).filter(User.id == user_id).first()

Testing approach:

1. Search codebase for text(, execute(, raw(, cursor.execute( + string interpolation
2. Run Bandit: bandit -r . -t B608 (hardcoded SQL expressions)
3. Inject payloads: ' OR '1'='1, '; DROP TABLE users; --, 1 UNION SELECT null,null--
4. Use OWASP ZAP active scan on all endpoints accepting string parameters

---

2. XSS — Cross-Site Scripting (CWE-79)

High-risk patterns to flag: