CWE-74 Injection
What this means
SiteShadow flagged an "injection-shaped" pattern: untrusted input is being used to build something that will later be interpreted (SQL, commands, HTML, templates, headers, file paths).
Why it matters
Injection enables attackers to run unintended commands or queries.
- It often leads to data leaks, auth bypass, or code execution, depending on the sink.
- Injection issues frequently chain: one bug becomes many once attackers control interpretation.
Safer examples
1) Parameterize queries (don't concatenate)
await db.query("SELECT * FROM users WHERE id = $1", [id]);2) Use safe APIs (avoid "interpret me" sinks)
Use textContent instead of innerHTML, argument arrays instead of shell strings, and allowlists for dynamic behavior.
3) Validate at trust boundaries
Validate inputs in request handlers and reject unexpected shapes/lengths (see CWE-20).
How SiteShadow detects it (high level)
- Detects dangerous sinks (SQL execution, command execution, HTML/DOM sinks, header sinks) and checks for user-controlled sources.
- Uses context heuristics to reduce false positives when safe APIs are used.
References
- CWE-74: https://cwe.mitre.org/data/definitions/74.html
---