Supported rules

The Snyk Code security rules that support custom sanitizers as Rule Extensions, listed per language

Select your language to see the rules that support custom sanitizers.

Rule Key

Rule name

CommandInjection

Command Injection

EmailContentInjection

Improper Access Control: Email Content Injection

Open Redirect

PotentialXSS

Cross-site Scripting (XSS)

RegexInjection

Regular expression injection

Soqli

SOQL Injection

Sosli

SOSL Injection

Ssrf

Server-Side Request Forgery (SSRF)

XmlInjection

XML Injection

XSS

Cross-site Scripting (XSS)

Rule Key

Rule name

ClientSideRequestForgery

Client-Side Request Forgery

CodeInjection

Code Injection

CommandInjection

Command Injection

FormatString

Use of Externally-Controlled Format String

ImproperNullTermination

Improper Null Termination

IntegerOverflow

Integer Overflow

LdapInjection

LDAP Injection

PrivateInformationExposure

Exposure of Private Personal Information to an Unauthorized Actor

Path Traversal

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

UserControlledPointer

User Controlled Pointer

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

XXE

XML External Entity (XXE) Injection

Rule Key

Rule name

CleartextCookieStorage

Cleartext Storage of Sensitive Information in a Cookie

CodeInjection

Code Injection

CommandInjection

Command Injection

HttpResponseSplitting

Improper Neutralization of CRLF Sequences in HTTP Headers

LdapInjection

LDAP Injection

LogForging

Log Forging

Open Redirect

PrivateInformationExposure

Exposure of Private Personal Information to an Unauthorized Actor

Path Traversal

RegexInjection

Regular expression injection

ServerLeak

Information Exposure - Server Error Message

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

XamlInjection

XAML Injection

XmlInjection

XML Injection

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

XXE

XML External Entity (XXE) Injection

ZipSlip

Arbitrary File Write via Archive Extraction (Zip Slip)

Rule Key

Rule name

Open Redirect

Path Traversal

ZipSlip

Arbitrary File Write via Archive Extraction (Zip Slip)

Rule Key

Rule name

ClearTextLogging

Clear Text Logging

CommandInjection

Command Injection

EmailContentInjection

Improper Access Control: Email Content Injection

ErrorMessage

Generation of Error Message Containing Sensitive Information

Open Redirect

Path Traversal

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

Ssti

Improper Neutralization of Directives in Statically Saved Code

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

Rule Key

Rule name

CodeInjection

Code Injection

CommandInjection

Command Injection

IndirectCommandInjection

Command Injection

Open Redirect

Path Traversal

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

XSS

Cross-site Scripting (XSS)

Rule Key

Rule name

CodeInjection

Code Injection

CommandInjection

Command Injection

EnvCommandInjection

Indirect Command Injection via User Controlled Environment

ExternalConfigControl

External Control of System or Configuration Setting

ExternalProcessControl

Process Control

HttpResponseSplitting

Improper Neutralization of CRLF Sequences in HTTP Headers

IndirectCommandInjection

Command Injection

IntentForwarding

Android Intent Forwarding

JndiInjection

Java Naming and Directory Interface (JNDI) Injection

LdapInjection

LDAP Injection

NoSqli

NoSQL Injection

Open Redirect

Path Traversal

Reflection

Unsafe Reflection

RegexInjection

Regular expression injection

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

ThirdPartyCodeExec

Code Execution via Third Party Package Context

ThirdPartyInstall

Code Execution via Third Party Package Installation

TooPermissiveCorsHeader

Origin Validation Error

TrustBoundaryViolation

Trust Boundary Violation

UnauthorizedFileAccess

Unauthorized File Access

UriPermissionManipulation

Android Uri Permission Manipulation

UserControlledFormatString

Use of Externally-Controlled Format String

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

Rule Key

Rule name

CodeInjection

Code Injection

CommandInjection

Command Injection

Deserialization

Deserialization of Untrusted Data

DOMXSS

DOM-based Cross-site Scripting (XSS)

FormatString

Use of Externally-Controlled Format String

Graphqli

GraphQL Injection

ImproperCodeSanitization

Improper Code Sanitization

IndirectCommandInjection

Command Injection

NoSqli

NoSQL Injection

Open Redirect

PrototypePollution

Prototype Pollution

Path Traversal

reDOS

Regular Expression Denial of Service (ReDoS)

reDOSPolynomial

Regular Expression Denial of Service (ReDoS)

Spoof

Weak Password Recovery Mechanism for Forgotten Password

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

Ssti

Improper Neutralization of Directives in Statically Saved Code

UnsafeJqueryPlugin

Unsafe JQuery Plugin

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

XXE

XML External Entity (XXE) Injection

ZipSlip

Arbitrary File Write via Archive Extraction (Zip Slip)

Rule Key

Rule name

CodeInjection

Code Injection

CommandInjection

Command Injection

Deserialization

Deserialization of Untrusted Data

EnvCommandInjection

Indirect Command Injection via User Controlled Environment

ExternalConfigControl

External Control of System or Configuration Setting

ExternalProcessControl

Process Control

HttpResponseSplitting

Improper Neutralization of CRLF Sequences in HTTP Headers

IndirectCommandInjection

Command Injection

IntentForwarding

Android Intent Forwarding

JndiInjection

Java Naming and Directory Interface (JNDI) Injection

LdapInjection

LDAP Injection

Open Redirect

Path Traversal

RegexInjection

Regular expression injection

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

ThirdPartyCodeExec

Code Execution via Third Party Package Context

ThirdPartyInstall

Code Execution via Third Party Package Installation

TooPermissiveCorsHeader

Origin Validation Error

TrustBoundaryViolation

Trust Boundary Violation

UnauthorizedFileAccess

Unauthorized File Access

UriPermissionManipulation

Android Uri Permission Manipulation

UserControlledFormatString

Use of Externally-Controlled Format String

Xpath

XPath Injection

Rule Key

Rule name

CodeInjection

Code Injection

CommandInjection

Command Injection

Deserialization

Deserialization of Untrusted Data

EmailContentInjection

Improper Access Control: Email Content Injection

FileInclusion

File Inclusion

Open Redirect

Path Traversal

reDOS

Regular Expression Denial of Service (ReDoS)

ServerLeak

Information Exposure - Server Error Message

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

XxePostPHP8

XML External Entity (XXE) Injection - Post-PHP 8

XxePrePHP8

XML External Entity (XXE) Injection - Pre-PHP 8

ZipSlip

Arbitrary File Write via Archive Extraction (Zip Slip)

Rule Key

Rule name

BrokenUserAuthentication

Broken User Authentication

CodeInjection

Code Injection

CommandInjection

Command Injection

Deserialization

Deserialization of Untrusted Data

DjangoUnvalidatedPassword

Password Requirements Not Enforced in Django Application

LdapInjection

LDAP Injection

NoSqli

NoSQL Injection

Open Redirect

Path Traversal

reDOS

Regular Expression Denial of Service (ReDoS)

ServerInformationExposure

Server Information Exposure

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

Ssti

Improper Neutralization of Directives in Statically Saved Code

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

XXE

XML External Entity (XXE) Injection

Rule Key

Rule name

CommandInjection

Command Injection

Deserialization

Deserialization of Untrusted Data

Open Redirect

Path Traversal

reDOS

Regular Expression Denial of Service (ReDoS)

Reflection

Unsafe Reflection

SessionManipulation

Session Manipulation

Sqli

SQL Injection

Ssti

Improper Neutralization of Directives in Statically Saved Code

Xpath

XPath Injection

XXE

XML External Entity (XXE) Injection

Rule Key

Rule name

CommandInjection

Command Injection

Open Redirect

Path Traversal

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

XSS

Cross-site Scripting (XSS)

Rule Key

Rule name

CodeInjection

Code Injection

CommandInjection

Command Injection

Deserialization

Deserialization of Untrusted Data

EnvCommandInjection

Indirect Command Injection via User Controlled Environment

ExternalConfigControl

External Control of System or Configuration Setting

ExternalProcessControl

Process Control

HttpResponseSplitting

Improper Neutralization of CRLF Sequences in HTTP Headers

IndirectCommandInjection

Command Injection

JndiInjection

Java Naming and Directory Interface (JNDI) Injection

LdapInjection

LDAP Injection

Open Redirect

Path Traversal

RegexInjection

Regular expression injection

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

TooPermissiveCorsHeader

Origin Validation Error

TrustBoundaryViolation

Trust Boundary Violation

UserControlledFormatString

Use of Externally-Controlled Format String

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

Rule Key

Rule name

CodeInjection

Code Injection

CommandInjection

Command Injection

MemoryCorruption

Memory Corruption

Path Traversal

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

XSS

Cross-site Scripting (XSS)

XXE

XML External Entity (XXE) Injection

Rule Key

Rule name

CodeInjection

Code Injection

CommandInjection

Command Injection

HttpResponseSplitting

Improper Neutralization of CRLF Sequences in HTTP Headers

Open Redirect

Path Traversal

RegexInjection

Regular expression injection

Sqli

SQL Injection

Ssrf

Server-Side Request Forgery (SSRF)

XmlInjection

XML Injection

Xpath

XPath Injection

XSS

Cross-site Scripting (XSS)

XXE

XML External Entity (XXE) Injection

PreviousCustom sanitizers NextIdentify your sanitizer's FQN

Last updated 11 days ago

Was this helpful?