OWASP Top 10:2025 Cheat Sheet for AI-Generated Code

// AI-generated: fetches by ID with no ownership check
app.get('/api/orders/:id', authenticate, async (req, res) => {
  const order = await db.query(
    'SELECT * FROM orders WHERE id = $1',
    [req.params.id]
  );
  res.json(order.rows[0]);
});

// Ownership check added
app.get('/api/orders/:id', authenticate, async (req, res) => {
  const order = await db.query(
    'SELECT * FROM orders WHERE id = $1 AND user_id = $2',
    [req.params.id, req.user.id]
  );
  if (!order.rows[0]) return res.status(403).json({ error: 'Forbidden' });
  res.json(order.rows[0]);
});

# AI-generated: hardcoded AWS credentials
import boto3

AWS_ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE'
AWS_SECRET_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'

client = boto3.client(
    's3',
    aws_access_key_id=AWS_ACCESS_KEY,
    aws_secret_access_key=AWS_SECRET_KEY,
)

import boto3
import os

client = boto3.client(
    's3',
    aws_access_key_id=os.environ['AWS_ACCESS_KEY_ID'],
    aws_secret_access_key=os.environ['AWS_SECRET_ACCESS_KEY'],
)

// AI-generated: string concatenation in SQL
async function getUser(username) {
  const result = await db.query(
    "SELECT * FROM users WHERE username = '" + username + "'"
  );
  return result.rows[0];
}

// Also common: eval() on user input
function applyFilter(data, filterExpr) {
  return data.filter(item => eval(filterExpr));
}

// Parameterized query
async function getUser(username) {
  const result = await db.query(
    'SELECT * FROM users WHERE username = $1',
    [username]
  );
  return result.rows[0];
}

// AI-generated: password reset with no rate limit or expiry
app.post('/api/reset-password', async (req, res) => {
  const { email, token, newPassword } = req.body;
  const user = await db.findOne({ email, resetToken: token });
  if (!user) return res.status(400).json({ error: 'Invalid token' });
  await db.updatePassword(user.id, newPassword);
  res.json({ success: true });
});
// Missing: token expiry check, rate limiting, token invalidation after use

// AI-generated: wildcard CORS + debug mode
const app = express();

app.use(cors({ origin: '*', credentials: true }));
app.use(express.json());

// Debug endpoint left in
app.get('/debug/config', (req, res) => {
  res.json(process.env); // exposes all environment variables
});

const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(',') || [];

app.use(cors({
  origin: (origin, callback) => {
    if (!origin || allowedOrigins.includes(origin)) callback(null, true);
    else callback(new Error('Not allowed by CORS'));
  },
  credentials: true,
}));

{
  "dependencies": {
    "lodash": "4.17.15",
    "jsonwebtoken": "8.5.1",
    "axios": "0.21.1",
    "express": "4.17.1"
  }
}

import jwt from 'jsonwebtoken';

// jwt.decode() does NOT verify the signature
export function getUser(token: string) {
  const payload = jwt.decode(token); // anyone can forge this
  return payload as { userId: string; role: string };
}

import jwt from 'jsonwebtoken';

export function getUser(token: string) {
  try {
    const payload = jwt.verify(token, process.env.JWT_SECRET!);
    return payload as { userId: string; role: string };
  } catch {
    return null;
  }
}

import pickle
import base64

def restore_session(session_cookie: str):
    # Arbitrary code execution if cookie is tampered
    data = base64.b64decode(session_cookie)
    return pickle.loads(data)  # CRITICAL: never deserialize untrusted data

import json
import base64

def restore_session(session_cookie: str):
    data = base64.b64decode(session_cookie)
    return json.loads(data)  # JSON only deserializes data, not code

// AI-generated: silent auth failures
app.post('/api/login', async (req, res) => {
  const user = await db.findByEmail(req.body.email);
  if (!user || !bcrypt.compareSync(req.body.password, user.hash)) {
    return res.status(401).json({ error: 'Invalid credentials' });
    // No log: attacker can brute-force silently
  }
  res.json({ token: generateToken(user) });
});

app.post('/api/login', async (req, res) => {
  const user = await db.findByEmail(req.body.email);
  if (!user || !bcrypt.compareSync(req.body.password, user.hash)) {
    logger.warn('Failed login attempt', {
      email: req.body.email,
      ip: req.ip,
      timestamp: new Date().toISOString(),
    });
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  logger.info('Successful login', { userId: user.id, ip: req.ip });
  res.json({ token: generateToken(user) });
});

// AI-generated: fetches any URL the user provides
app.post('/api/preview', async (req, res) => {
  const { url } = req.body;
  const response = await fetch(url); // attacker can target internal services
  const html = await response.text();
  res.json({ preview: html.slice(0, 500) });
});

const { URL } = require('url');
const ALLOWED_PROTOCOLS = ['http:', 'https:'];
const BLOCKED_HOSTS = ['localhost', '127.0.0.1', '0.0.0.0', '169.254.169.254'];

app.post('/api/preview', async (req, res) => {
  let parsed;
  try { parsed = new URL(req.body.url); } catch {
    return res.status(400).json({ error: 'Invalid URL' });
  }
  if (!ALLOWED_PROTOCOLS.includes(parsed.protocol))
    return res.status(400).json({ error: 'Protocol not allowed' });
  if (BLOCKED_HOSTS.includes(parsed.hostname))
    return res.status(400).json({ error: 'Host not allowed' });

  const response = await fetch(req.body.url);
  res.json({ preview: (await response.text()).slice(0, 500) });
});