One page per vulnerability class: what actually goes wrong, the vulnerable and the fixed code next to each other in every language it matters in, how to find it in your own repository, and the real pull requests where we fixed it.
Assigning untrusted data to innerHTML executes attacker HTML in the page origin. Use textContent, or sanitize with DOMPurify when markup is required.
JavaScript (browser) · JavaScript (markup genuinely required) · React / TypeScriptstrcpy, strcat and sprintf write until a NUL byte with no destination bound. Replace them with snprintf or strlcpy and check the return value for truncation.
C — copying a string · C — the strncpy trap · C — sizeof across a function boundaryCommand injection happens when user data reaches a shell string. Pass an argument array with the shell disabled, and validate the executable path yourself.
Python · Node.js · JavaStripping ../ does not stop traversal. Resolve the path to an absolute real path, then verify it sits inside the base directory before opening it.
Python · Node.js · Java — archive extraction (Zip Slip)pickle.loads, Java ObjectInputStream and yaml.load execute code during deserialization. Use JSON with a schema, or safe_load, and never trust the byte stream.
Python — pickle · Python — YAML · JavaBlocking localhost in a URL does not stop SSRF. Resolve the hostname, reject private and link-local ranges, pin the connection, and disable redirects.
Python · Node.jsEvery case study on our blog is a pull request Orbis AppSec opened against a real open-source repository — the vulnerability, the patch, and the verification.
Browse the case studies