Source to sink threats¶
Untrusted input reaching a dangerous sink, checked at every sink.
| Threat | Sink |
|---|---|
| SQL injection | SQL query |
| NoSQL injection | NoSQL query or update |
| Cross-site scripting (XSS) | HTML / DOM |
| Server-side template injection (SSTI) | Template source |
| Server-side request forgery (SSRF) | Outbound URL |
| Open redirect | Redirect location |
| Path traversal | File system path |
| Client-side path traversal (CSPT) | Client-side request path |