tryb

Local inspector

Check reference v1.0.0

Reference pages for tryb checks.

These supporting pages give each SARIF rule a stable help link with its detector code, verification boundary, inert example, and remediation guidance.

123 of 123 checks

  1. TRB-001Bidi override detectedBidi override detected identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  2. TRB-002Cert expiredCert expired identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  3. TRB-003Cert expiring soonCert expiring soon identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  4. TRB-004Cert is caCert is ca identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  5. TRB-005Cert key bad exponentCert key bad exponent identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  6. TRB-006Cert key rocaCert key roca identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  7. TRB-007Cert key small factorCert key small factor identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  8. TRB-008Cert key too smallCert key too small identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  9. TRB-009Cert key undersizedCert key undersized identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  10. TRB-010Cert lifetime too longCert lifetime too long identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  11. TRB-011Cert no known weaknessCert no known weakness identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  12. TRB-012Cert no SANCert no SAN identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  13. TRB-013Cert not yet validCert not yet valid identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  14. TRB-014Cert obsolete versionCert obsolete version identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  15. TRB-015Cert self signedCert self signed identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  16. TRB-016Cert signature broken hashCert signature broken hash identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  17. TRB-017Cert signature SHA-1Cert signature SHA-1 identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  18. TRB-018Cert unknown critical extensionCert unknown critical extension identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  19. TRB-019Cert wildcard SANCert wildcard SAN identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  20. TRB-020Chmod owner no accessChmod owner no access identifies the value affects an access, exposure, or trust boundary that must be recognized explicitly.
    CWE-284
  21. TRB-021Chmod privileged executionChmod privileged execution identifies the value affects an access, exposure, or trust boundary that must be recognized explicitly.
    CWE-284
  22. TRB-022Chmod world writableChmod world writable identifies the value affects an access, exposure, or trust boundary that must be recognized explicitly.
    CWE-284
  23. TRB-023Envfile duplicate keysEnvfile duplicate keys identifies different consumers can interpret duplicate, normalized, or trailing input differently.
    CWE-436
  24. TRB-024Envfile invalid linesEnvfile invalid lines identifies the input requires validation beyond syntactic recognition before downstream use.
    CWE-20
  25. TRB-025Envfile sensitive valuesEnvfile sensitive values identifies credential material is exposed or relies on an insufficiently protected secret.
    CWE-798
  26. TRB-026Base64 mime signature mismatchBase64 mime signature mismatch identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  27. TRB-027Base64 plain text decodedBase64 plain text decoded identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  28. TRB-028Base64 recognized fileBase64 recognized file identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  29. TRB-029Base32 plain text decodedBase32 plain text decoded identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  30. TRB-030Hash argon2 detectedHash argon2 detected identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  31. TRB-031Hash broken algorithmHash broken algorithm identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  32. TRB-032Hash SHA-1 deprecatedHash SHA-1 deprecated identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  33. TRB-033Hex control characterHex control character identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  34. TRB-034Hidden payload decodedHidden payload decoded identifies the input requires validation beyond syntactic recognition before downstream use.
    CWE-20
  35. TRB-035Htmlentities control characterHtmlentities control character identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  36. TRB-036Htmlentities decoded markupHtmlentities decoded markup identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  37. TRB-037HTTP bare lf detectedHTTP bare lf detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  38. TRB-038HTTP cl te ambiguity detectedHTTP cl te ambiguity detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  39. TRB-039HTTP conflicting content length detectedHTTP conflicting content length detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  40. TRB-040HTTP duplicate content length detectedHTTP duplicate content length detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  41. TRB-041HTTP duplicate header detectedHTTP duplicate header detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  42. TRB-042HTTP duplicate transfer encoding detectedHTTP duplicate transfer encoding detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  43. TRB-043HTTP header name whitespace detectedHTTP header name whitespace detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  44. TRB-044HTTP invalid content length detectedHTTP invalid content length detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  45. TRB-045HTTP malformed header detectedHTTP malformed header detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  46. TRB-046HTTP mixed line endings detectedHTTP mixed line endings detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  47. TRB-047HTTP obfuscated transfer encoding detectedHTTP obfuscated transfer encoding detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  48. TRB-048HTTP obs fold detectedHTTP obs fold detected identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  49. TRB-049HTTP status unassignedHTTP status unassigned identifies hTTP components can disagree about message framing or header interpretation.
    CWE-444
  50. TRB-050IP multicast scopeIP multicast scope identifies the value affects an access, exposure, or trust boundary that must be recognized explicitly.
    CWE-284
  51. TRB-051IP non public scopeIP non public scope identifies the value affects an access, exposure, or trust boundary that must be recognized explicitly.
    CWE-284
  52. TRB-052JSON decoded key collisionJSON decoded key collision identifies different consumers can interpret duplicate, normalized, or trailing input differently.
    CWE-436
  53. TRB-053JSON deep nestingJSON deep nesting identifies unbounded input expansion or nesting can exhaust processing resources.
    CWE-400
  54. TRB-054JSON duplicate keysJSON duplicate keys identifies different consumers can interpret duplicate, normalized, or trailing input differently.
    CWE-436
  55. TRB-055JSON go field collisionJSON go field collision identifies different consumers can interpret duplicate, normalized, or trailing input differently.
    CWE-436
  56. TRB-056JSON nonstandard syntaxJSON nonstandard syntax identifies different consumers can interpret duplicate, normalized, or trailing input differently.
    CWE-436
  57. TRB-057JSON trailing dataJSON trailing data identifies different consumers can interpret duplicate, normalized, or trailing input differently.
    CWE-436
  58. TRB-058JSON unsafe numberJSON unsafe number identifies the input requires validation beyond syntactic recognition before downstream use.
    CWE-20
  59. TRB-059JWE compression header detectedJWE compression header detected identifies security-sensitive token fields require strict validation before trust decisions.
    CWE-345
  60. TRB-060JWE pbes2 p2c below policyJWE pbes2 p2c below policy identifies security-sensitive token fields require strict validation before trust decisions.
    CWE-345
  61. TRB-061JWE pbes2 p2c invalidJWE pbes2 p2c invalid identifies security-sensitive token fields require strict validation before trust decisions.
    CWE-345
  62. TRB-062JWT alg case confusion detectedJWT alg case confusion detected identifies security-sensitive token fields require strict validation before trust decisions.
    CWE-345
  63. TRB-063JWT alg none detectedJWT alg none detected identifies security-sensitive token fields require strict validation before trust decisions.
    CWE-345
  64. TRB-064JWT expiredJWT expired identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  65. TRB-065JWT kid presentJWT kid present identifies security-sensitive token fields require strict validation before trust decisions.
    CWE-345
  66. TRB-066JWT lifetime excessiveJWT lifetime excessive identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  67. TRB-067JWT missing expirationJWT missing expiration identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  68. TRB-068JWT PII in payloadJWT PII in payload identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  69. TRB-069JWT remote key header detectedJWT remote key header detected identifies security-sensitive token fields require strict validation before trust decisions.
    CWE-345
  70. TRB-070JWT weak secret crackedJWT weak secret cracked identifies credential material is exposed or relies on an insufficiently protected secret.
    CWE-798
  71. TRB-071JWT weak secret unsupported algJWT weak secret unsupported alg identifies credential material is exposed or relies on an insufficiently protected secret.
    CWE-798
  72. TRB-072Live secret detectedLive secret detected identifies credential material is exposed or relies on an insufficiently protected secret.
    CWE-798
  73. TRB-073Mixed script confusable detectedMixed script confusable detected identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  74. TRB-074MCP executable command declaredMCP executable command declared identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  75. TRB-075MCP inline environment valuesMCP inline environment values identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  76. TRB-076MCP path outside declared rootMCP path outside declared root identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  77. TRB-077MCP path without declared rootMCP path without declared root identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  78. TRB-078MCP remote endpoint declaredMCP remote endpoint declared identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  79. TRB-079MCP schema description mismatchMCP schema description mismatch identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  80. TRB-080MCP suspicious instruction textMCP suspicious instruction text identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  81. TRB-081Native serialized payload detectedNative serialized payload detected identifies the input can request unsafe object construction during deserialization.
    CWE-502
  82. TRB-082Normalization case changeNormalization case change identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  83. TRB-083Normalization compatibility changeNormalization compatibility change identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  84. TRB-084Normalization idna changeNormalization idna change identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  85. TRB-085Normalization metacharacter introducedNormalization metacharacter introduced identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  86. TRB-086Port cleartext servicePort cleartext service identifies the value affects an access, exposure, or trust boundary that must be recognized explicitly.
    CWE-284
  87. TRB-087Polyglot file detectedPolyglot file detected identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  88. TRB-088Port zero reservedPort zero reserved identifies the value affects an access, exposure, or trust boundary that must be recognized explicitly.
    CWE-284
  89. TRB-089PQC kyber mlkem ambiguityPQC kyber mlkem ambiguity identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  90. TRB-090PQC size match not validationPQC size match not validation identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  91. TRB-091PQC TLS hybrid draft contextPQC TLS hybrid draft context identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  92. TRB-092Querystring duplicate keysQuerystring duplicate keys identifies different consumers can interpret duplicate, normalized, or trailing input differently.
    CWE-436
  93. TRB-093Querystring sensitive parameterQuerystring sensitive parameter identifies the input requires validation beyond syntactic recognition before downstream use.
    CWE-20
  94. TRB-094Redos static risk detectedRedos static risk detected identifies the regular expression can consume excessive resources on adversarial input.
    CWE-1333
  95. TRB-095RSA close primesRSA close primes identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  96. TRB-096RSA exponent evenRSA exponent even identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  97. TRB-097RSA exponent oneRSA exponent one identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  98. TRB-098RSA exponent smallRSA exponent small identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  99. TRB-099RSA key too smallRSA key too small identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  100. TRB-100RSA key undersizedRSA key undersized identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  101. TRB-101RSA no known weaknessRSA no known weakness identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  102. TRB-102RSA private key pastedRSA private key pasted identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  103. TRB-103RSA roca fingerprintRSA roca fingerprint identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  104. TRB-104RSA small factorRSA small factor identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  105. TRB-105Smart quote damage detectedSmart quote damage detected identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  106. TRB-106Terminal control character detectedTerminal control character detected identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  107. TRB-107Terminal escape sequence detectedTerminal escape sequence detected identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  108. TRB-108SVG data uriSVG data uri identifies the input requires validation beyond syntactic recognition before downstream use.
    CWE-20
  109. TRB-109Unicode tag character detectedUnicode tag character detected identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  110. TRB-110URL-encoded decode limitURL-encoded decode limit identifies unbounded input expansion or nesting can exhaust processing resources.
    CWE-400
  111. TRB-111URL-encoded multiple layersURL-encoded multiple layers identifies different consumers can interpret duplicate, normalized, or trailing input differently.
    CWE-436
  112. TRB-112Unverified image claimUnverified image claim identifies the input requires validation beyond syntactic recognition before downstream use.
    CWE-20
  113. TRB-113Unidentified high entropy secretUnidentified high entropy secret identifies credential material is exposed or relies on an insufficiently protected secret.
    CWE-798
  114. TRB-114Variation selector smugglingVariation selector smuggling identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436
  115. TRB-115XML entity cycle detectedXML entity cycle detected identifies recursive or parameter entity processing requires explicit resource and grammar limits.
    CWE-776
  116. TRB-116XML entity expansion detectedXML entity expansion detected identifies recursive or parameter entity processing requires explicit resource and grammar limits.
    CWE-776
  117. TRB-117XML external entity detectedXML external entity detected identifies external XML entities can be resolved unless the parser explicitly forbids that behavior.
    CWE-611
  118. TRB-118XML parameter entity use detectedXML parameter entity use detected identifies recursive or parameter entity processing requires explicit resource and grammar limits.
    CWE-776
  119. TRB-119YAML unsafe object tag detectedYAML unsafe object tag detected identifies the input can request unsafe object construction during deserialization.
    CWE-502
  120. TRB-120UUID embedded timestampUUID embedded timestamp identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  121. TRB-121UUID low entropyUUID low entropy identifies the value requires explicit validation before security-sensitive downstream use.
    CWE-20
  122. TRB-122Uuidv1 mac leakedUuidv1 mac leaked identifies cryptographic material or parameters require explicit strength and validity checks.
    CWE-327
  123. TRB-123Zero width character detectedZero width character detected identifies the same representation can acquire different meaning across decoding or parsing boundaries.
    CWE-436