## Injection (Critical)

### Trigger Signals

- String concatenation to construct queries (SQL/NoSQL/LDAP/Shell)
- ORM queries using user input concatenated strings (non-parameterized)
- Template engine rendering user input (`render`, `template`, `compile`, `Handlebars.compile`)
- Expression language evaluation (`eval`, `Function()`, `Expression Language`)

### Key Sinks

| Injection Type | Sink Functions |
|---------|----------|
| SQL Injection | `query(string)`, `execute(string)`, `raw()`, `$where`, `sequelize.query(string)` |
| NoSQL Injection | `Collection.find(object)` (user input as query condition object), `$where`, `$regex` |
| Command Injection | `exec()`, `system()`, `popen()`, `spawn(shell=True)`, `child_process.exec()` |
| Template Injection | `render(string)`, `compile(string)`, `Template(user_input).render()` |
| LDAP Injection | `ldap_search(filter=user_input)` |

### Judgment Process

1. **Identify Sinks**: `Read` extracts dangerous function calls in the changed code, marking Sink points
2. **Trace back to Source**: `find_references` traces data flow backward from Sink parameters (up to 5 levels), determining whether the parameter comes from user input:
   - Trace variable assignment chains: `param → intermediate → sink`
   - Trace function call chains: `handler(req) → service.query(param) → db.raw(param)`
3. **Check defense mechanisms**: On the Source → Sink path, `Read` checks whether the following exist:
   - Parameterized queries (`?` placeholders, ORM `.where({field: value})`)
   - Input validation (type conversion, whitelist validation)
   - Escaping/encoding (`escape()`, `sanitize()`, `mysql.escape()`)
4. **Verify bypass risk**: If defenses exist, `Read` determines whether they can be bypassed:
   - Blacklist filtering (`replace("drop", "")` can be bypassed via `drdropop`)
   - Partial parameterization (some fields concatenated, some parameterized → overall still injectable)

### Evidence Construction

After confirming a defect, the output must include:
- Source (origin of user input, with file:line number)
- Sink (dangerous function call location, with file:line number)
- Propagation path (complete chain from Source → Propagator → Sink)
- Defense mechanism analysis (no defense / bypassable defense)
- Exploitation scenario (specific injection payload example)

### Exclusions

- Already using parameterized queries/prepared statements
- ORM queries using safe parameter binding (`.where({name: req.body.name})`)
- Already using whitelist validation (only allowing alphanumeric, rejecting special characters)
- Template engine has auto-escaping enabled (e.g., Jinja2 autoescape, EJS default escaping)
