## Security Vulnerability Detection

> Security vulnerability detection is based on the **taint analysis** model: tracking the propagation path of user-controllable data (Source) from input to dangerous operations (Sink).
> This file is the detection routing table -- it locates the detection subtask subfiles to load based on code characteristics.

### Detection Routing Table

| Trigger Signals (Code Characteristics) | Detection Subtask Triggered | File |
|---------------------|-----------|------|
| String concatenation to construct queries (SQL/NoSQL/LDAP/Shell) | Injection | [injection.md](injection.md) |
| ORM queries using user input concatenated strings (non-parameterized) | Injection | [injection.md](injection.md) |
| Template engine rendering user input (`render`/`template`/`compile`) | Injection | [injection.md](injection.md) |
| User input directly concatenated into HTML/response body (`innerHTML`, template literals concatenated into HTML) | XSS | [xss.md](xss.md) |
| `document.write`/`eval`/`setTimeout(string)` receiving user input | XSS | [xss.md](xss.md) |
| File path from user input (`open`/`readFile`/`send_file` parameter controllable) | Path Traversal + SSRF | [path-traversal.md](path-traversal.md) |
| URL from user input and making requests (`fetch`/`http.get`/`requests`) | Path Traversal + SSRF | [path-traversal.md](path-traversal.md) |
| Redirect target from user input (`redirect`/`Location` header) | Path Traversal + SSRF | [path-traversal.md](path-traversal.md) |
| File upload endpoints (`multer`/`multipart`/`upload`) | File Upload | [file-upload.md](file-upload.md) |
| Password/Token comparison using `==` instead of constant-time comparison | Authentication & Session | [auth-session.md](auth-session.md) |
| Session management (`session`/`cookie`/`jwt`/`token`) related code | Authentication & Session | [auth-session.md](auth-session.md) |
| Object properties directly mapped from request parameters (`Object.assign`/`req.body` assigned to model) | Access Control | [access-control.md](access-control.md) |
| API endpoints operating on resources without checking current user permissions | Access Control | [access-control.md](access-control.md) |
| Hardcoded keys/passwords (`password`/`secret`/`apikey` assigned as string constants) | Cryptographic Failures | [crypto-failures.md](crypto-failures.md) |
| Use of weak cryptographic algorithms (`md5`/`sha1`/`DES`/`RC4`/`ECB`) | Cryptographic Failures | [crypto-failures.md](crypto-failures.md) |
| `console.log`/`logger` output containing sensitive data (passwords, tokens, ID numbers) | Sensitive Data Exposure | [data-exposure.md](data-exposure.md) |
| Internal information exposed in error responses (`err.stack`/`ex.message` returned directly) | Sensitive Data Exposure | [data-exposure.md](data-exposure.md) |
| `pickle.loads`/`unserialize`/`JSON.parse` deserializing untrusted data | Deserialization | [deserialization.md](deserialization.md) |
| XML parser configuration allowing external entities (`external_entities`/`DTDEntityResolver`) | Deserialization | [deserialization.md](deserialization.md) |
| CORS configured as `*` or allowing arbitrary Origin | Security Misconfiguration | [misconfiguration.md](misconfiguration.md) |
| Missing security response headers (`X-Frame-Options`/`CSP`/`HSTS`) | Security Misconfiguration | [misconfiguration.md](misconfiguration.md) |
| Sensitive endpoints without rate limiting or with overly permissive rate limiting | Security Misconfiguration | [misconfiguration.md](misconfiguration.md) |

### Usage

1. Read the changed code and identify the trigger signals above
2. Based on matched trigger signals, **only load** the corresponding subfiles (no need to load everything)
3. No matched trigger signals → do not execute security vulnerability detection
4. When detecting, use the **taint analysis** method: Source (user input) → Propagator (data passing) → Sink (dangerous function)

### Taint Analysis Model

```
Source origins:
  HTTP requests (Header/Body/Query/Cookie/Path parameters)
  RPC/message queue/WebSocket input
  Untrusted data in databases/Redis/config files
  Environment variables/command-line arguments

Propagator propagation:
  Variable assignment, function parameter passing, string concatenation, object property propagation

Sink dangerous operations:
  → See specific Sink lists in each subfile
```

### Defense Mechanism Identification (Excluding False Positives)

After detecting a Source → Sink path, also confirm whether defense mechanisms exist:
- **Input validation**: whitelist validation, type conversion (`parseInt`, `Number()`)
- **Parameterized queries**: prepared statements, ORM parameterized methods
- **Output encoding**: HTML escaping, URL encoding, JSON serialization
- **Sanitization functions**: `DOMPurify`, `escape`, `sanitize`
- Framework automatic protection (e.g., React JSX default escaping)

### General Exclusion Rules

The following situations are not reported as defects:
- **Test files**: `*.test.*`, `*.spec.*`, `__tests__/` directories
- **Generated code**: `generated/`, `*.generated.*`, `node_modules/`, vendor
- **Third-party dependencies**: uncontrollable external library code
- **Clear TODO/FIXME comments**: issues already known to the developer
- **Existing defense mechanisms**: effective sanitization or validation exists between Source and Sink
