Issue Detection Methodology

Objective

Identify code issues across security, quality, performance, and maintainability dimensions.

Security Issues

Injection Vulnerabilities

SQL Injection

• Pattern: String concatenation in SQL queries
• Detection: Look for query strings built with + operator
• Fix: Use parameterized queries

Command Injection

• Pattern: User input passed to shell execution functions
• Detection: Look for subprocess/exec calls with dynamic arguments
• Fix: Use subprocess with shell=False, validate inputs