Description

This vulnerability detector identifies unsafe dynamic file inclusion in Elixir code where user input can control file paths without proper sanitization. This allows attackers to read arbitrary files from the system through path traversal attacks or access sensitive files outside the intended directory structure.

Detection Strategy

• Scan Elixir source code for file operation functions (sinks) that load or include files dynamically

• Check if the file path argument comes from user input sources (HTTP parameters, form data, user-controlled variables)

• Verify that the user input flows to the file path parameter without proper validation or sanitization

• Report vulnerability when user-controllable data directly influences file paths in file inclusion operations

Vulnerable code example

defmodule UnsafeCodeExec do
  import Plug.Conn

  def load_plugin(conn) do
    plugin = conn.params["plugin"]
    
    # VULNERABLE: User input directly executed as Elixir code
    Code.eval_file(plugin)...

✅ Secure code example

defmodule SafeCodeExec do
  import Plug.Conn

  @plugins_dir "priv/plugins"
  @allowed_plugins %{
    "report_gen" => "report_generator.ex",
    "data_export" => "data_exporter.ex",
    "validation" => "validator.ex"...