logo

Injection

Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

Anti-patterns

Inline JavaScript

Malicious code injected through inline JavaScript can exploit vulnerabilities, allowing injection attacks like cross-site scripting (XSS), which can lead to site defacement, unauthorized access, and data theft.
View anti-pattern

Vulnerable code to server-side payload injections

A server-side JSON and XML injection can happen when data from an untrusted source is not sanitised by the server and written directly to a JSON or XML stream.
View anti-pattern

Code vulnerable to cross-site scripting (XSS)

Cross-site scripting (XSS) attacks cover a broad range of attacks where malicious HTML or client-side scripting is provided to a Web application. The Web application includes malicious scripting in a response to a user of the Web application.
View anti-pattern

Vulnerable code to SOQL/SOSL injections

SOQL/SOSL injection is a serious security vulnerability that results from the insecure construction of a database query, with user-supplied data. When queries are built unsafely from user input, instead of using type-safe bind parameters, malicious input may be used to change the structure of the query and bypass or change the application logic.
View anti-pattern

Inline Cascading Style Sheets (CSS)

When using CSS style tags and attributes, the HTML parser switches to CDATA or raw text context, which is prone to code injection. For this reason, using inline CSS is considered unsafe and should be avoided.
View anti-pattern

Insecure JavaScript operations

Some JavaScript operations, such as eval and other reflection operations, introduce a significant security risk. For this reason, they are blocked by the Lightning Locker and are generally discouraged.
View anti-pattern