« Phase 11

Lab 02 — Source Code Vulnerability Scanner

Operation Cedar Lattice, Phase 11.

Meridian Freight International runs a custom logistics management application. FIN-LATTICE has identified weaknesses in the codebase through a combination of phishing-delivered source files and a misconfigured internal Git server. Your job: scan the source code for exploitable patterns, classify each finding by CWE, and produce a prioritized vulnerability report. This lab implements a lightweight static analysis engine covering the three most common web application vulnerability classes.

Safety. This lab is a static pattern scanner over synthetic code strings. There is no code execution, no exploit payload generation, and no network access. The input is a list of code snippet dicts; the output is a structured FINDINGS report with CWE identifiers and severity levels.

What You Will Build

Five functions that implement the Cedar Lattice Source Code Triage Pipeline:

Snippet Schema

snippet = {
    "language": "python",   # language hint (informational)
    "code": str,            # source code to scan
    "context": str,         # human-readable context (module name, purpose)
}

Function Specifications

sql_injection_patterns(code)

Scan line by line. A line is flagged if it contains both:

1. A SQL keyword: SELECT, INSERT, UPDATE, DELETE, or WHERE (case-insensitive)
2. A string-interpolation marker: " + ", " % ", .format(, or an f-string variable marker {

Return {line_hint: int, pattern_type: "sql_string_concat", severity: "CRITICAL"} for each matching line. line_hint is 1-indexed.

command_injection_patterns(code)

Scan line by line. Flag each line matching:

Return {line_hint: int, pattern_type: str, severity: "HIGH"} for each match.

path_traversal_patterns(code)

Scan line by line. Flag each line matching:

Return {line_hint: int, pattern_type: str, severity: "MEDIUM"} for each match.

scan_snippet(snippet)

Run all three pattern scanners on snippet["code"]. Enrich each finding with CWE info:

Return combined list sorted by severity (CRITICAL first, then HIGH, then MEDIUM) then by line_hint ascending.

severity_rank(findings)

Sort findings by severity: CRITICAL first, HIGH second, MEDIUM third, LOW last. Within the same severity, sort by line_hint ascending.

Files

Running the Tests

# Run against your stubs (expect NotImplementedError)
pytest -q

# Run against reference solution (all 12 should pass)
LAB_MODULE=solution pytest -q

Learning Objectives

After completing this lab you should be able to:

1. Identify SQL injection patterns from string concatenation and f-string interpolation.
2. Distinguish dangerous subprocess / shell invocation patterns from safe alternatives.
3. Explain why os.path.join() with user-supplied input requires os.path.realpath() validation.
4. Assign CWE identifiers to common vulnerability classes.
5. Prioritize findings by severity for efficient remediation triage.

« Lab 01 — Binary Triage Engine | « Phase 11 README