OWASP-SAST tool common findings and remediations

1. SQL Injection

Definition: SQL Injection occurs when untrusted user input is inserted directly into SQL queries, allowing attackers to manipulate or execute unauthorized database commands.

Prevention: Use parameterized queries or prepared statements, apply strict input validation, and enforce least-privilege database accounts to minimize damage if exploitation occurs.

2. Second-Order SQL Injection

Definition: This occurs when malicious data is stored in the database (e.g., from a previous user input) and later used unsafely in a new SQL query, leading to delayed injection.

Prevention: Validate and sanitize data not only at input but also before reuse, use ORM frameworks, and avoid concatenating database-stored values into queries.

3. Reflected XSS (Cross-Site Scripting)

Definition: Reflected XSS happens when user-supplied data in a request is immediately returned in the response without proper encoding, executing malicious scripts in the victim's browser.

Prevention: Encode all untrusted output (HTML, JS, URL), validate inputs, and implement Content Security Policy (CSP) to block inline script execution.

4. Stored XSS

Definition: Stored XSS occurs when malicious input is permanently stored on the server (e.g., in a database or comment field) and delivered to other users when the affected page is viewed.

Prevention: Sanitize all stored inputs before display, encode output in the correct context, and use frameworks that auto-escape HTML by default.

5. Command Injection

Definition: Command Injection happens when user input is passed directly to system commands (e.g., os.system, exec) allowing attackers to execute arbitrary code on the host OS.

Prevention: Avoid direct shell execution, use safe API calls or parameterized commands, validate and whitelist inputs, and run services with minimal privileges.

6. DOM-Based Injection (DOM XSS)

Definition: DOM-based Injection occurs entirely on the client side when JavaScript modifies the DOM using unsanitized user input, leading to script execution without server interaction.

Prevention: Avoid using innerHTML, document.write, or eval with untrusted data; use safe DOM APIs (textContent, setAttribute), and apply client-side input sanitization libraries like DOMPurify.