Code Guardian-AI-powered Code Security

Example

Code Guardian analyzes database query constructions to spot dynamic SQL generation patterns that do not sanitize inputs. For example, a query like 'SELECT * FROM users WHERE username = '" + username + "';' is flagged for using direct concatenation of user input.

Scenario

During development, a programmer inadvertently writes code that directly includes user input in a SQL query. Code Guardian detects this and suggests using parameterized queries or prepared statements as a safer alternative.

Example

Code Guardian examines places in the code where user input is handled and then outputted directly to web pages. It flags instances like 'document.write(userInput);' which could execute malicious scripts.

Scenario

In web development, a new feature involves displaying user comments on a webpage. Code Guardian identifies and warns against directly outputting user content without sanitization, thus preventing potential XSS attacks.

Example

It checks for unsafe usage of system commands that incorporate external user data. An example it would flag is 'exec("rm -rf /" + userInput);' due to the direct inclusion of user input in a system command.

Scenario

A software maintenance tool allows users to specify files to delete. Code Guardian ensures that commands executed by the server do not directly include unsanitized user input, reducing the risk of malicious deletions or system compromises.