rules-elixir

Code.eval_string() and Code.eval_file() execute arbitrary Elixir code at runtime — a critical RCE vector. Redesign to use pattern matching, function dispatch maps, or macros at compile time.

Hardcoded secrets in Elixir source or config files are committed to version control. Use runtime configuration with System.get_env()/1 or a secrets manager via Config.Provider.

RISK: Redirecting to a URL taken directly from conn.params enables open redirect (CWE-601) — an attacker can craft a link that appears to be your domain but redirects users to a phishing site. FIX: Validate the destination against an allowlist of safe paths, or use Routes helpers that only generate internal paths.

String concatenation in Ecto fragments or raw SQL enables SQL injection. Use Ecto's parameterized fragment/2 with ^ for interpolation: fragment('col = ?', ^user_value)

String.to_atom() with user input can exhaust the atom table (atoms are never garbage collected in Erlang/BEAM), causing a node crash. Use String.to_existing_atom/1 or work with string keys.

String concatenation with <> in System.cmd arguments enables command injection. Build arguments as separate list elements — never join user input into a command string.

:erlang.binary_to_term/1 deserializes arbitrary Erlang terms and can execute arbitrary code if given malicious input. Use :erlang.binary_to_term(bin, [:safe]) to restrict to safe terms only.

Logging conn.params or raw user input may persist PII (passwords, tokens, personal data) in log files and log aggregators, violating GDPR/CCPA and creating a secret exposure risk. FIX: Log only sanitized, non-sensitive fields; use Logger.metadata for structured, filterable context.