Security Risk

Why this rule exists

These are not theoretical risks. SQL injection, MD5 password hashes, and unvalidated Process.Start calls are still the top sources of breach disclosures every year.

Code example

+ var sql = $"SELECT * FROM Users WHERE Email = '{email}'";
+ using var hash = MD5.Create();

+ var sql = "SELECT * FROM Users WHERE Email = @Email";
+ cmd.Parameters.AddWithValue("@Email", email);
+ var hash = SHA256.HashData(Encoding.UTF8.GetBytes(input));

Configuration

Disable or adjust the severity of this rule in .gauntletci.json:

{
  "rules": {
    "GCI0012": { "enabled": true, "severity": "Block" }
  }
}

See Configuration for the full schema.

Related rules

Discussed in