# Improper Control of Generation of Code ('Code Injection') (CWE-94)

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

**Stack:** Go

- Prevalence: 高 频繁被利用
- Impact: 关键 6 条严重级别为关键的规则
- Prevention: 已记录 10 个修复示例

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

When software allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the software. Such an alteration could lead to arbitrary code execution.

## Prevention

基于 3 条 Shoulder 检测规则的 Code Injection 预防策略。

### Go

Pass user input as template data, never use template.HTML with unsanitized input

Validate and sanitize LLM outputs before using in dangerous operations like exec or SQL

Use predefined templates and pass user input as template data, never as template code

## Warning Signs

- [HIGH] LLM output flows to ... without validation
- [HIGH] LLM outputs used directly in dangerous operations like command execution or SQL queries without vali
- [CRITICAL] user input flowing to template functions that bypass HTML escaping

## Consequences

- 执行未授权代码
- 读取应用程序数据
- 修改应用程序数据

## Mitigations

- 重构代码以避免使用 eval() 或等效函数
- 在强制执行严格边界的沙箱中运行代码
- 尽可能使用静态类型检查

## Detection

- Total rules: 10
- Critical: 6
- Languages: go, javascript, typescript, python

## Rules by Language

### Go (3 rules)

- **Code Injection via os/exec** [CRITICAL]: Detects user input flowing to template functions that bypass HTML escaping.
  - Remediation: Pass user input as template data instead of using template.HTML.

```go
data := struct{ Content string }{Content: userInput}
tmpl.Execute(w, data)
```

Learn more: https://shoulder.dev/learn/go/cwe-94/code-injection
- **LLM Insecure Output Handling** [HIGH]: Detects LLM outputs used directly in dangerous operations like command execution or SQL queries without validation.
  - Remediation: Validate LLM outputs against an allowlist before using in dangerous operations.

```go
if !validCommands[output] {
    return errors.New("invalid command")
}
```

Learn more: https://shoulder.dev/learn/go/cwe-94/llm-insecure-output-handling
- **Server-Side Template Injection** [CRITICAL]: User input passed directly to template.Parse without sanitization.
  - Remediation: Use predefined templates and pass user data as template variables.

```go
tmpl := template.Must(template.ParseFiles("page.html"))
tmpl.Execute(w, map[string]string{
    "name": userInput, // Safe - passed as data, not template code
})
```

Learn more: https://shoulder.dev/learn/go/cwe-94/ssti