snyk-code-remediation

Snyk Code SAST Remediation

Overview

Snyk Code performs taint analysis to identify security vulnerabilities in application code. This skill provides fix patterns for common vulnerability types, organized by CWE and with language-specific examples.

Vulnerability Types & Fix Patterns

SQL Injection (CWE-89)

Snyk Rules: javascript/SqlInjection, python/SqlInjection, java/SqlInjection

Detection: User input used in SQL query without parameterization

Fix Pattern:

JavaScript (Node.js):

// Bad: string concatenation
const result = db.query(`SELECT * FROM users WHERE id = ${userId}`);

// Good: parameterized query
const result = db.query('SELECT * FROM users WHERE id = $1', [userId]);

// Also good: prepared statement
const stmt = connection.prepareStatement('SELECT * FROM users WHERE id = ?');
stmt.setInt(1, userId);
const result = stmt.executeQuery();

Python:

# Bad: f-string in query
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

# Good: parameter placeholder
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

Java:

// Bad: string concatenation
String query = "SELECT * FROM users WHERE id = " + userId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

// Good: prepared statement
String query = "SELECT * FROM users WHERE id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setInt(1, userId);
ResultSet rs = pstmt.executeQuery();

Cross-Site Scripting (XSS) (CWE-79)

Snyk Rules: javascript/XSS, python/XSS, java/XSS

Detection: User input rendered to HTML/JavaScript without encoding

Fix Pattern:

JavaScript (React):

// Bad: dangerouslySetInnerHTML
<div dangerouslySetInnerHTML={{ __html: userInput }} />

// Good: JSX (auto-escapes)
<div>{userInput}</div>

// Good: sanitize with DOMPurify
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} />

JavaScript (vanilla):

// Bad: innerHTML with user input
document.getElementById('output').innerHTML = userInput;

// Good: textContent (no HTML parsing)
document.getElementById('output').textContent = userInput;

// Good: createElement (safe)
const div = document.createElement('div');
div.textContent = userInput;
parent.appendChild(div);

Python (Flask/Jinja2):

# Bad: unsafe filter
{{ userInput|safe }}

# Good: default auto-escaping
{{ userInput }}

# Also good: explicit escaping
from markupsafe import escape
{{ escape(userInput) }}

Java:

// Bad: no encoding
response.getWriter().println("<div>" + userInput + "</div>");

// Good: use encoder
import org.owasp.encoder.Encode;
response.getWriter().println("<div>" + Encode.forHtml(userInput) + "</div>");

Command Injection (CWE-78)

Snyk Rules: javascript/CommandInjection, python/CommandInjection

Detection: User input used in shell command execution

Fix Pattern:

JavaScript (Node.js):

// Bad: exec with string concatenation
const { exec } = require('child_process');
exec(`ls -la ${userPath}`, (err, stdout) => { ... });

// Good: execFile with argument array
const { execFile } = require('child_process');
execFile('ls', ['-la', userPath], (err, stdout) => { ... });

// Also good: spawn for complex commands
const { spawn } = require('child_process');
const child = spawn('ls', ['-la', userPath]);

Python:

# Bad: os.system with user input
import os
os.system(f"ls -la {user_path}")

# Good: subprocess.run with array
import subprocess
subprocess.run(['ls', '-la', user_path], shell=False)

# Also good: Popen with args list
subprocess.Popen(['ls', '-la', user_path], shell=False)

Path Traversal (CWE-22)

Snyk Rules: javascript/PathTraversal, python/PathTraversal

Detection: User input used in file path without validation

Fix Pattern:

JavaScript:

const path = require('path');

// Bad: no validation
const filePath = `/uploads/${userInput}`;
fs.readFile(filePath, 'utf8', (err, data) => { ... });

// Good: resolve and validate
const basePath = path.resolve(__dirname, 'uploads');
const filePath = path.resolve(basePath, userInput);

if (!filePath.startsWith(basePath)) {
  throw new Error('Path traversal attempt detected');
}
fs.readFile(filePath, 'utf8', (err, data) => { ... });

Python:

import os

# Bad: no validation
file_path = f"/uploads/{user_input}"
with open(file_path) as f:
    data = f.read()

# Good: resolve and validate
base_path = os.path.realpath('/uploads')
file_path = os.path.realpath(os.path.join(base_path, user_input))

if not file_path.startswith(base_path):
    raise ValueError('Path traversal attempt detected')

with open(file_path) as f:
    data = f.read()

Insecure Deserialization (CWE-502)

Snyk Rules: python/UnsafeDeserialization, java/Deserialization

Detection: Untrusted data deserialized using unsafe methods

Fix Pattern:

Python:

import json
import pickle

# Bad: pickle with untrusted data
data = pickle.loads(user_input)

# Good: JSON with schema validation
import json
from jsonschema import validate

schema = {
    "type": "object",
    "properties": {
        "name": {"type": "string"},
        "age": {"type": "integer"}
    }
}
data = json.loads(user_input)
validate(instance=data, schema=schema)

Java:

// Bad: ObjectInputStream
ObjectInputStream ois = new ObjectInputStream(inputStream);
Object obj = ois.readObject();

// Good: Jackson JSON with type restrictions
import com.fasterxml.jackson.databind.ObjectMapper;
ObjectMapper mapper = new ObjectMapper();
mapper.readValue(userInput, MyClass.class);

Hardcoded Secrets (CWE-798)

Detection: API keys, passwords, tokens in source code

Fix Pattern:

// Bad: hardcoded
const API_KEY = "sk-abc123def456";
const DATABASE_PASSWORD = "mypassword123";

// Good: environment variables
const API_KEY = process.env.API_KEY;
const DATABASE_PASSWORD = process.env.DATABASE_PASSWORD;

if (!API_KEY) throw new Error('API_KEY env var not set');
if (!DATABASE_PASSWORD) throw new Error('DATABASE_PASSWORD env var not set');

// Also good: secrets manager
const AWS_SECRET = await secretManager.getSecret('prod/database-password');

Process

1. Identify the vulnerability type from Snyk Code alert
2. Find the matching pattern above
3. Apply the fix using language-specific examples
4. Write a regression test that verifies the vulnerability is fixed
5. Run Snyk Code again to confirm the alert is resolved

CWE Cross-Reference

Snyk Rule	CWE	Category	Priority
*/SqlInjection	CWE-89	SQL Injection	P0
*/XSS	CWE-79	Cross-Site Scripting	P0
*/CommandInjection	CWE-78	Command Injection	P0
*/PathTraversal	CWE-22	Path Traversal	P0
*/UnsafeDeserialization	CWE-502	Insecure Deserialization	P0
*/HardcodedSecret	CWE-798	Hard-Coded Credentials	P0

All of these are P0 (critical) — fix immediately before shipping code.