Description

This vulnerability detector identifies instances where sensitive information might be exposed in URLs within Elixir applications. URLs with sensitive data can lead to information disclosure through server logs, browser history, referrer headers, or when URLs are shared inadvertently. This poses a significant security risk as credentials or personal data may be leaked unintentionally.

Detection Strategy

• Analyzes Elixir source code to identify potentially unsafe URL construction patterns

• Examines function calls and expressions that build or manipulate URLs

• Flags code locations where sensitive information (credentials, tokens, personal data) might be included directly in URL strings

• Triggers alerts when URL building patterns are detected that could expose sensitive data in query parameters, path segments, or URL fragments

Vulnerable code example

defmodule SensitiveUrlExample do
  def expose_token(conn) do
    token = conn.params["access_token"]
    # VULNERABLE: sensitive token exposed in URL
    Req.get!("https://api.example.com/auth?token=#{token}")
  end
end

✅ Secure code example

defmodule SensitiveUrlExample do
  def expose_token(conn) do
    token = conn.params["access_token"]
    # SAFE: token sent as Authorization header, not in URL
    Req.get!("https://api.example.com/auth", auth: {:bearer, token})
  end
end