Issue Detection Methodology

Issue Detection Methodology

Objective

Identify code issues across security, quality, performance, and maintainability dimensions.

Security Issues

Injection Vulnerabilities

SQL Injection

• Pattern: String concatenation in SQL queries
• Detection: Look for query strings built with + operator
• Fix: Use parameterized queries

Command Injection

• Pattern: User input passed to shell execution functions
• Detection: Look for subprocess/​exec calls with dynamic arguments
• Fix: Use subprocess with shell=False, validate inputs

XSS

• Pattern: Unescaped user input in HTML output
• Detection: Template variables without escaping filters
• Fix: HTML escape all user content

Authentication Issues

Hardcoded Credentials

• Pattern: password/​secret/​key assignments with string literals
• Detection: Regex for common credential variable names
• Fix: Use environment variables

Weak Crypto

• Pattern: MD5, SHA1 for passwords, ECB mode
• Fix: Use bcrypt/​argon2 for passwords, AES-GCM

Quality Issues

Complexity Violations

High Cyclomatic Complexity

• Threshold: > 20
• Impact: Hard to test, prone to bugs
• Fix: Extract methods, reduce conditions

Deep Nesting

• Threshold: > 5 levels
• Impact: Hard to read and maintain
• Fix: Early returns, guard clauses

Code Smells

Long Method

• Threshold: > 50 lines
• Fix: Extract smaller methods

Large Class

• Threshold: > 500 lines or > 20 methods
• Fix: Split into focused classes

Long Parameter List

• Threshold: > 5 parameters
• Fix: Use parameter object

Performance Issues

Algorithm Efficiency

N+1 Queries

• Pattern: Loop containing database query
• Detection: ORM calls inside for/​while loops
• Fix: Use eager loading/​joins

Quadratic Algorithms

• Pattern: Nested loops over same collection
• Impact: O(n^2) scaling
• Fix: Use sets, maps, or better algorithms

Resource Management

Unclosed Resources

• Pattern: File/​connection open without close or context manager
• Fix: Use with statement

Memory Issues

• Pattern: Growing collections without bounds
• Fix: Use bounded caches, weak references

Maintainability Issues

Documentation Gaps

Missing Docstrings

• Pattern: Public functions without documentation
• Standard: All public APIs documented

Outdated Comments

• Pattern: Comments contradicting code
• Fix: Update or remove

Test Coverage

Untested Code

• Pattern: No corresponding test file
• Threshold: < 60% coverage is concern

Missing Edge Case Tests

• Pattern: Only happy path tested
• Fix: Add boundary and error tests

Issue Reporting Format

[SEVERITY] [CATEGORY] in [file:line]
Description: [what is wrong]
Impact: [why it matters]
Fix: [how to resolve]
Confidence: [High/​Medium/​Low]

Severity Classification