Findings
Every rule inkdex-vuln reports, its CWE and its usual severity, and what proven and verify mean.
A finding is one place in your code (a sink, a secret, a setting) and one rule. The severity below is the rule's starting point; inkdex lowers it one step for an authenticated route, for data coming from a service your code called, and in a library scan. The verdict is proven when the index shows the whole path, verify when a human should look.
inkdex-vuln rules prints this list from the binary; inkdex-vuln rules VULN-SQLI says when a finding of that rule is proven.
Findings that come from a flow (most of the injection, file, request and denial-of-service rules) need data from outside to reach the place. The other rules are about the place itself (a secret, a weak primitive, a setting) and need no flow.
| Rule | What it is | CWE | Severity |
|---|
VULN-SQLI | SQL injection | CWE-89 | critical |
VULN-NOSQLI | NoSQL injection | CWE-943 | high |
VULN-CMDI | OS command injection | CWE-78 | critical (shell), high (program) |
VULN-ARGI | Argument injection into a program run without a shell | CWE-88 | medium |
VULN-CODEI | Code injection | CWE-94 | critical |
VULN-SSTI | Server-side template injection | CWE-1336 | high |
VULN-LDAPI | LDAP injection | CWE-90 | high |
VULN-XPATHI | XPath injection | CWE-643 | high |
VULN-XSS | Cross-site scripting | CWE-79 | high (low for data handed to a view, to verify) |
VULN-HEADER | HTTP response splitting | CWE-113 | medium |
VULN-LOGI | Log injection | CWE-117 | low |
VULN-PROTO | Prototype pollution | CWE-1321 | high |
VULN-REFLECT | Unsafe reflection | CWE-470 | medium |
VULN-DESER | Deserialization of untrusted data | CWE-502 | critical |
VULN-XXE | XML external entity | CWE-611 | high |
| Rule | What it is | CWE | Severity |
|---|
VULN-PATH | Path traversal | CWE-22 | high |
VULN-PATH-BUILD | Path built from untrusted data | CWE-22 | medium |
VULN-ZIPSLIP | Archive entry written without a containment check | CWE-22 | medium |
VULN-SSRF | Server-side request forgery | CWE-918 | high |
VULN-REDIRECT | Open redirect | CWE-601 | medium |
| Rule | What it is | CWE | Severity |
|---|
VULN-AUTHZ | Authorization skipped on a record the request picks | CWE-639 | medium |
VULN-TRUST-BOUNDARY | Untrusted data stored in the session | CWE-501 | medium |
VULN-CRYPTO-INPUT | Key material from untrusted data | CWE-321 | high |
| Rule | What it is | CWE | Severity |
|---|
VULN-REDOS | Regular expression from untrusted data, or a backtracking pattern applied to it | CWE-1333 | medium |
VULN-DOS-ALLOC | Allocation sized by untrusted data | CWE-770 | medium |
VULN-DOS-DECOMPRESS | Decompressed data read without a size limit | CWE-409 | medium |
VULN-ATOM | Atom table exhaustion (Elixir) | CWE-400 | high |
VULN-BODY-LIMIT | Request body read without a size limit | CWE-770 | low |
VULN-DOS-TIMEOUT | HTTP server without a read timeout | CWE-400 | low |
| Rule | What it is | CWE | Severity |
|---|
VULN-SECRET | Hard-coded secret or key | CWE-798 / CWE-321 | high for a provider's key, lower for a generic one |
VULN-WEAK-HASH | Weak hash | CWE-328 | low to medium |
VULN-WEAK-PASSWORD-HASH | Password hashed with a fast hash or a low cost | CWE-916 | medium |
VULN-WEAK-CIPHER | Broken cipher | CWE-327 | high |
VULN-ECB | Cipher in ECB mode | CWE-327 | medium |
VULN-STATIC-IV | Static IV | CWE-329 | medium |
VULN-WEAK-KEY | Key too short | CWE-326 | high |
VULN-WEAK-RNG | Predictable random value used as a secret | CWE-330 / CWE-338 | medium |
VULN-TIMING | Secret compared in non-constant time | CWE-208 | low |
VULN-JWT-VERIFY | JWT signature verification disabled, or claims read without it | CWE-347 | high / medium |
| Rule | What it is | CWE | Severity |
|---|
VULN-TLS | TLS certificate verification disabled | CWE-295 | high |
VULN-DEBUG | Debug mode enabled | CWE-489 | medium |
VULN-COOKIE-SECURE | Cookie sent without the Secure flag | CWE-614 | medium |
VULN-COOKIE-HTTPONLY | Cookie readable by scripts (no HttpOnly) | CWE-1004 | medium |
VULN-CORS | Any origin allowed by CORS | CWE-942 | medium |
VULN-WS-ORIGIN | WebSocket accepting any origin | CWE-1385 | medium |
VULN-CSRF | CSRF protection disabled | CWE-352 | low |
VULN-CLEARTEXT | Service reached over cleartext HTTP | CWE-319 | low |
| Rule | What it is | CWE | Severity |
|---|
VULN-SQLI | SQL built from values, no source seen | CWE-89 | medium |
VULN-DESER-API | Unsafe deserialization API | CWE-502 | medium |
VULN-EVAL-API | Dynamic code evaluation | CWE-94 / CWE-95 | low |
VULN-XSS-API | Markup marked safe | CWE-79 | medium |
VULN-XXE | XML parser resolving external entities | CWE-611 | medium |
VULN-TEMPFILE | Insecure temporary file | CWE-377 | low |
VULN-DANGEROUS-API | Other dangerous API | varies | low |
| Rule | What it is | CWE | Severity |
|---|
VULN-DEP | Dependency with a known vulnerability | the advisory's | the advisory's |
| Verdict | Meaning |
|---|
proven | The index shows it: an unsanitized flow from a request to the sink, a provider's key, a setting written in the code. |
verify | Likely, to check with the evidence: a weaker flow, a generic secret, a weak primitive whose use is not known, a check known only by its name. |
- An escaping or validation function inkdex knows (or one your code defines that clearly checks) protects the sinks it is meant for.
- A value checked against a fixed list, or a URL whose host is pinned to fixed values, is no longer attacker-controlled.
- Values the code builds only from constants reach no finding.
- Test code, fixtures, examples, generated, vendored and minified files are left out.
- Code that runs in the browser is not reported for server-only rules (SQL, shell, files).
