Description

This detector identifies vulnerabilities where user-controlled input is used to construct database connection strings in Elixir applications. When connection parameters like hostnames, usernames, or passwords come from untrusted sources, attackers can potentially redirect connections to malicious databases or extract sensitive information from connection strings.

Detection Strategy

• Scans Elixir code for function calls that establish database connections using connection string parameters

• Identifies functions that accept connection URIs through positional arguments or keyword parameters (like 'uri')

• Traces the source of connection string data to determine if it originates from user input, request parameters, or other untrusted sources

• Reports a vulnerability when a connection string contains user-controlled data that hasn't been properly validated or sanitized

Vulnerable code example

defmodule ConnectionStringDemo do
  import Plug.Conn

  def unsafe_redis_connection(conn, _opts) do
    host = conn.params["host"]
    
    # VULNERABLE: credentials sent to attacker-controlled host
    Redix.start_link("redis://user:pass@#{host}:6379/0")...

✅ Secure code example

defmodule ConnectionStringDemo do
  import Plug.Conn

  def unsafe_redis_connection(conn, _opts) do
    host = conn.params["host"]
    
    # Validate host against allowlist to prevent credential leakage
    allowed_hosts = ["cache-1.internal", "cache-2.internal"]...