verify-code

Perform a security review of the following code:

$ARGUMENTS

---

What to do

Review the code provided in the arguments above. If no code was provided, ask the user to paste the code or specify a file path to read. If a file path is mentioned, read the file first.

Step 1 — Detect Technologies

Identify language and frameworks from:

• File extension: .py → Python, .ts/.tsx → TypeScript, .go → Go, .java → Java, .rb → Ruby, .php → PHP, .sql → SQL
• Import statements: import django, require('express'), import React, use actix_web
• Syntax patterns: def/class → Python, func → Go, public class → Java, fn → Rust
• Framework indicators: @app.route → Flask, useState → React, @Controller → Spring

Step 2 — Check for Vulnerabilities by Language

Python:

• Command injection: os.system(), subprocess with shell=True
• Unsafe deserialization: pickle.loads() on untrusted data
• Code execution: eval() / exec() with user-controlled input
• SQL injection via f-strings or % formatting in queries
• Path traversal in open() with user-supplied paths

JavaScript / TypeScript:

• XSS: innerHTML, document.write(), dangerouslySetInnerHTML without sanitization
• Prototype pollution via Object.assign / spread with user data
• eval() or new Function() with dynamic content
• Unvalidated postMessage handlers
• Sensitive data in localStorage or sessionStorage

React:

• dangerouslySetInnerHTML without DOMPurify or equivalent
• User input rendered directly in JSX without escaping
• Sensitive tokens/data stored in component state

Java:

• Statement instead of PreparedStatement for SQL
• Runtime.exec() with user-controlled input
• XXE vulnerabilities in XML parsers
• Unsafe deserialization (ObjectInputStream)

Go:

• SQL injection in raw database/sql queries
• Command injection in exec.Command with user input
• Path traversal in file serving handlers
• Race conditions in concurrent code without proper locking