> For the complete documentation index, see [llms.txt](https://notes.awfulsecurity.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.awfulsecurity.org/oswe/oswe-code-review-cheat-sheet/vscode-sinks.md).

# VSCode - Sinks

## Search

This cheat sheet helps identify dangerous code patterns in **PHP**, **Java**, **C#**, and **Python** for OSWE preparation using VS Code or grep.

***

### ✅ General Dangerous Functions

```bash
grep -RIn --line-number -E "eval|exec|system\(|popen|subprocess|shell_exec|passthru|include\(|require\(|execFile|Runtime\.getRuntime|ProcessBuilder|fetch\(|requests\.get|HttpClient" .
```

***

### ✅ SQL Injection

#### PHP

```bash
grep -RIn --line-number -E "mysql_query|mysqli_query|pdo->query|prepare\(|execute\(|db_query" .
```

#### Java

```bash
grep -RIn --line-number -E "Statement\.execute|Statement\.executeQuery|prepareStatement|createQuery" .
```

#### C\#

```bash
grep -RIn --line-number -E "SqlCommand|ExecuteReader|ExecuteScalar|ExecuteNonQuery" .
```

#### Python

```bash
grep -RIn --line-number -E "cursor\.execute|raw\(|execute_sql" .
```

***

### ✅ SSTI / Template Injection

#### PHP

```bash
grep -RIn --line-number -E "Smarty|Twig|Blade|render\(|template" .
```

#### Java

```bash
grep -RIn --line-number -E "Thymeleaf|Freemarker|Velocity|render\(" .
```

#### C\#

```bash
grep -RIn --line-number -E "Razor|ViewBag|RenderPartial" .
```

#### Python

```bash
grep -RIn --line-number -E "render_template|Jinja2|Django template" .
```

***

### ✅ XXE

```bash
grep -RIn --line-number -E "DocumentBuilderFactory|SAXParser|XMLReader|lxml|xml\.etree" .
```

***

### ✅ XSS (DOM-Based)

```bash
grep -RIn --line-number -E "innerHTML|outerHTML|document\.write|location\.href|eval\(|setTimeout\(|setInterval\(" .
```

***

### ✅ Command Injection

#### PHP

```bash
grep -RIn --line-number -E "system\(|exec\(|shell_exec|passthru" .
```

#### Java

```bash
grep -RIn --line-number -E "Runtime\.getRuntime|ProcessBuilder" .
```

#### C\#

```bash
grep -RIn --line-number -E "Process\.Start" .
```

#### Python

```bash
grep -RIn --line-number -E "os\.system|subprocess\.Popen|subprocess\.call" .
```

***

### ✅ CSRF / CORS

```bash
grep -RIn --line-number -E "Access-Control-Allow-Origin|CORS|Cross-Origin|csrf|XSRF|SameSite|session\.cookie|secure|httponly" .
```

***

### ✅ SSRF

```bash
grep -RIn --line-number -E "requests\.get|requests\.post|HttpClient|fetch\(|curl_exec|file_get_contents\(|urllib\.request|axios\.get|axios\.post" .
```

***

### ✅ Prototype Pollution

```bash
grep -RIn --line-number -E "Object\.assign|Object\.defineProperty|Object\.setPrototypeOf|__proto__|merge\(|deepMerge" .
```

***

### ✅ Eval / Filter Bypass

```bash
grep -RIn --line-number -E "eval\(|Function\(|exec\(|compile\(|Runtime\.getRuntime|ProcessBuilder" .
```

***

### ✅ Insecure Deserialization

#### PHP

```bash
grep -RIn --line-number -E "unserialize\(|__wakeup|__destruct" .
```

#### Java

```bash
grep -RIn --line-number -E "ObjectInputStream|readObject|XMLDecoder|readResolve|readExternal" .
```

#### C\#

```bash
grep -RIn --line-number -E "BinaryFormatter|SoapFormatter|DataContractSerializer|NetDataContractSerializer|ReadObject" .
```

#### Python

```bash
grep -RIn --line-number -E "pickle\.load|pickle\.loads|cPickle\.load|cPickle\.loads" .
```