How to Fix AI Code Snippet Security Vulnerabilities: Tutorial That Secured My Production Apps

# sonar-project.properties - AI-generated code security rules
sonar.projectKey=ai-security-audit
sonar.sources=src
sonar.language=javascript,typescript,python,java

# Custom rules for AI-generated code patterns
sonar.javascript.custom.rules=/config/ai-security-rules.json
sonar.python.custom.rules=/config/python-ai-security.json

# Specific patterns that indicate AI generation
sonar.issue.ignore.multicriteria=e1,e2,e3
sonar.issue.ignore.multicriteria.e1.ruleKey=javascript:S3776
sonar.issue.ignore.multicriteria.e1.resourceKey=**/*.copilot.js

# AI-specific security checks
sonar.custom.ai.patterns.enabled=true
sonar.custom.ai.security.level=STRICT

# .semgrep.yml - AI code security patterns
rules:
  - id: ai-sql-injection-risk
    pattern-either:
      - pattern: |
          cursor.execute($SQL + $USER_INPUT)
      - pattern: |
          query = f"SELECT * FROM users WHERE id = {$USER_ID}"
      - pattern: |
          db.raw(`SELECT * FROM ${$TABLE} WHERE ${$CONDITION}`)
    message: "Potential SQL injection in AI-generated code"
    languages: [python, javascript, typescript]
    severity: ERROR
    metadata:
      category: security
      ai-generated: likely

  - id: ai-xss-vulnerability
    pattern-either:
      - pattern: |
          innerHTML = $USER_CONTENT
      - pattern: |
          dangerouslySetInnerHTML={{ __html: $USER_DATA }}
      - pattern: |
          response.write($USER_INPUT)
    message: "XSS vulnerability in AI-generated HTML rendering"
    languages: [javascript, typescript]
    severity: ERROR

  - id: ai-insecure-random
    pattern-either:
      - pattern: Math.random()
      - pattern: random.random()
      - pattern: new Random().nextInt()
    message: "Insecure random number generation for security contexts"
    languages: [javascript, python, java]
    severity: WARNING
    metadata:
      ai-pattern: common-suggestion

  - id: ai-hardcoded-secrets
    pattern-either:
      - pattern: |
          const API_KEY = "$VALUE"
      - pattern: |
          password = "$VALUE"
      - pattern: |
          secret_key = "$VALUE"
    message: "Hardcoded secrets in AI-generated code"
    languages: [javascript, python, java]
    severity: ERROR
    metadata:
      cwe: "CWE-798"

# AI-Generated Code Security Checklist

## 🔍 IDENTIFICATION
- [ ] Code was generated or suggested by AI tool (Copilot/Claude/etc.)
- [ ] AI tool name and date of generation documented
- [ ] Business context and security requirements understood

## 🛡️ INPUT VALIDATION & SANITIZATION
- [ ] All user inputs are validated and sanitized
- [ ] SQL queries use parameterized statements
- [ ] File paths are validated against directory traversal
- [ ] URL inputs are validated and sanitized
- [ ] JSON/XML inputs are parsed securely

## 🔐 AUTHENTICATION & AUTHORIZATION  
- [ ] Authentication checks are present and correct
- [ ] Authorization logic follows principle of least privilege
- [ ] Session management follows security best practices
- [ ] API keys and tokens are handled securely
- [ ] Multi-factor authentication considered where appropriate

## 💾 DATA HANDLING
- [ ] Sensitive data is encrypted at rest and in transit
- [ ] PII is handled according to privacy regulations
- [ ] Data retention policies are implemented
- [ ] Secure deletion of sensitive data
- [ ] Audit logging for data access

## 🌐 NETWORK & API SECURITY
- [ ] HTTPS is enforced for all communications
- [ ] CORS policies are configured correctly
- [ ] Rate limiting is implemented
- [ ] API endpoints have proper authentication
- [ ] Input size limits are enforced

## 🔧 CONFIGURATION & DEPLOYMENT
- [ ] No hardcoded secrets or credentials
- [ ] Security headers are configured
- [ ] Error messages don't leak sensitive information
- [ ] Logging doesn't expose sensitive data
- [ ] Dependencies are up to date and vulnerability-free

## 🧪 TESTING
- [ ] Security unit tests are written
- [ ] Penetration testing scenarios considered
- [ ] Negative test cases for security boundaries
- [ ] Integration with security testing pipeline

## 📋 COMPLIANCE
- [ ] Meets industry-specific compliance requirements
- [ ] OWASP guidelines followed
- [ ] Code meets internal security policies
- [ ] Documentation updated with security considerations

# VULNERABLE AI-Generated Code
def get_user_orders(user_id, status_filter=None):
    """Get orders for a specific user with optional status filtering"""
    
    # AI generated this without parameterization
    query = f"""
    SELECT o.*, u.email 
    FROM orders o 
    JOIN users u ON o.user_id = u.id 
    WHERE o.user_id = {user_id}
    """
    
    if status_filter:
        # Critical vulnerability - direct string concatenation
        query += f" AND o.status = '{status_filter}'"
    
    cursor.execute(query)
    return cursor.fetchall()

# ATTACK VECTOR:
# get_user_orders(123, "'; DROP TABLE orders; --")
# Results in: SELECT ... WHERE o.user_id = 123 AND o.status = ''; DROP TABLE orders; --'

# SECURE Fixed Version
def get_user_orders(user_id: int, status_filter: Optional[str] = None) -> List[Dict]:
    """Get orders for a specific user with optional status filtering
    
    Security: Uses parameterized queries to prevent SQL injection
    """
    
    # Base query with parameter placeholders
    query = """
    SELECT o.order_id, o.total, o.created_at, o.status, u.email
    FROM orders o 
    JOIN users u ON o.user_id = u.id 
    WHERE o.user_id = %s
    """
    
    params = [user_id]
    
    # Secure parameter handling for optional filter
    if status_filter:
        # Whitelist valid statuses
        valid_statuses = ['pending', 'processing', 'shipped', 'delivered', 'cancelled']
        if status_filter not in valid_statuses:
            raise ValueError(f"Invalid status filter: {status_filter}")
        
        query += " AND o.status = %s"
        params.append(status_filter)
    
    query += " ORDER BY o.created_at DESC LIMIT 1000"
    
    try:
        cursor.execute(query, params)
        return cursor.fetchall()
    except Exception as e:
        logger.error(f"Database error in get_user_orders: {e}")
        raise DatabaseException("Failed to retrieve user orders")

# Security unit test
def test_get_user_orders_sql_injection_protection():
    """Test that SQL injection attempts are prevented"""
    
    malicious_input = "'; DROP TABLE orders; --"
    
    # This should raise ValueError due to whitelist validation
    with pytest.raises(ValueError):
        get_user_orders(123, malicious_input)
    
    # Verify no database modification occurred
    cursor.execute("SELECT COUNT(*) FROM orders")
    orders_count = cursor.fetchone()[0]
    assert orders_count > 0  # Table still exists

// VULNERABLE AI-Generated Component
const UserProfile: React.FC<{userData: any}> = ({ userData }) => {
  return (
    <div className="user-profile">
      <h2>Welcome {userData.name}</h2>
      {/* Critical XSS vulnerability */}
      <div dangerouslySetInnerHTML={{ __html: userData.bio }} />
      
      <div className="user-status">
        {/* Another XSS vector */}
        Status: {userData.status}
      </div>
    </div>
  );
};

// SECURE Fixed Version
import DOMPurify from 'dompurify';
import { useMemo } from 'react';

interface UserData {
  name: string;
  bio: string;
  status: string;
  isVerified: boolean;
}

const UserProfile: React.FC<{userData: UserData}> = ({ userData }) => {
  // Sanitize HTML content
  const sanitizedBio = useMemo(() => {
    return DOMPurify.sanitize(userData.bio, {
      ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'ul', 'ol', 'li'],
      ALLOWED_ATTR: []
    });
  }, [userData.bio]);
  
  // Sanitize status text (remove HTML)
  const sanitizedStatus = useMemo(() => {
    return DOMPurify.sanitize(userData.status, { ALLOWED_TAGS: [] });
  }, [userData.status]);
  
  return (
    <div className="user-profile">
      {/* Safe text rendering */}
      <h2>Welcome {userData.name}</h2>
      
      {/* Sanitized HTML rendering */}
      <div 
        className="user-bio"
        dangerouslySetInnerHTML={{ __html: sanitizedBio }} 
      />
      
      <div className="user-status">
        Status: <span>{sanitizedStatus}</span>
        {userData.isVerified && <span className="verified">✓ Verified</span>}
      </div>
    </div>
  );
};

// Security test
describe('UserProfile XSS Protection', () => {
  it('should sanitize malicious HTML in bio', () => {
    const maliciousUserData = {
      name: 'Test User',
      bio: '<script>alert("XSS")</script><p>Safe content</p>',
      status: '<img src=x onerror=alert("XSS2")>Online',
      isVerified: true
    };
    
    render(<UserProfile userData={maliciousUserData} />);
    
    // Script tag should be removed
    expect(screen.queryByText('alert("XSS")')).not.toBeInTheDocument();
    
    // Safe content should remain
    expect(screen.getByText('Safe content')).toBeInTheDocument();
    
    // Status should be text only
    expect(screen.getByText('Online')).toBeInTheDocument();
    expect(screen.queryByRole('img')).not.toBeInTheDocument();
  });
});

# .github/workflows/ai-code-security.yml
name: AI Code Security Audit

on:
  pull_request:
    branches: [ main, develop ]
  push:
    branches: [ main ]

jobs:
  security_scan:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v3
    
    - name: Setup Node.js
      uses: actions/setup-node@v3
      with:
        node-version: '18'
        
    - name: Install dependencies
      run: |
        npm install
        pip install semgrep bandit safety
    
    - name: Run Semgrep security scan
      run: |
        semgrep --config=.semgrep.yml --json --output=semgrep-results.json src/
        
    - name: Run Python security checks
      run: |
        bandit -r backend/ -f json -o bandit-results.json
        safety check --json --output safety-results.json
        
    - name: Run SonarQube analysis
      uses: sonarqube-quality-gate-action@master
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        
    - name: Check for AI-generated security issues
      run: |
        python scripts/check_ai_security.py \
          --semgrep semgrep-results.json \
          --bandit bandit-results.json \
          --fail-on-critical
          
    - name: Security test suite
      run: |
        npm run test:security
        pytest tests/security/
        
    - name: Generate security report
      if: always()
      run: |
        python scripts/generate_security_report.py \
          --output security-report.html \
          --include-ai-patterns
          
    - name: Upload security artifacts
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: security-scan-results
        path: |
          semgrep-results.json
          bandit-results.json
          security-report.html