Application Security Testing Powered by AI | Code Intelligence

// This is the code you want to test
public static String getUser(String id) {
  // SECURITY ISSUE: vulnerable to log4Shell (CVE-2021-44228)
  log.info("Request: user with ID " + id);
  
  Statement stmt = conn.createStatement();
  // SECURITY ISSUE: vulnerable to SQL injection!
  ResultSet rs = stmt.executeQuery("SELECT * FROM users WHERE id = '" + id + "'");
  // handle results
}

// This is the test you write
@FuzzTest
void testGetUser(String generatedId) {
  // Call your method with AI-generated inputs.
  User.getUser(generatedId);
}

TERMINAL

$ cifuzz run all

Results: found 2 issues and reached 91% code coverage

* Critical Security Issue: Remote Code Execution in getUser (com.example.User:4)

* Critical Security Issue: SQL Injection in getUser (com.example.User:8)

To assess the issues, check your project on CI Sense

// This is the code you want to test
char* getUser(const char* id, size_t id_size) {
  char* user_buffer = (char*) malloc(MAX_USER_LENGTH); 
  // SECURITY ISSUE: buffer overflow!
  memcpy(user_buffer, id, id_size);
  // finish constructing the user buffer
}

// This is the test you write
FUZZ_TEST(const char* data, size_t size) {
  // Call your function with AI-generated inputs.
  getUser(data, size);
}

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 86% code coverage

* Critical Security Issue: Heap Buffer Overflow in getUser (src/user.cpp:5:2)

To assess the issues, check your project on CI Sense

// This is the code you want to test
func GetUser(id string) (string, error) {
  // SECURITY ISSUE: vulnerable to command injection!
  out, err := exec.Command(fmt.Sprintf("id -nu %s", id)).Output()
  // handle error and return result
}

// This is the test you write
func FuzzGetUser(f *testing.F) {
  f.Fuzz(func(t *testing.T, id string) {
    // Call your function with AI-generated inputs.
    result, err := GetUser(id)
    // ...
  })
}

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 71% code coverage

* Critical Security Issue: Command Injection in GetUser (user/user.go:4)

To assess the issues, check your project on CI Sense

// This is the code you want to test
function getUser(id) {
  // SECURITY ISSUE: vulnerable to command injection!
  const result = execSync(`id -nu ${id}`);
  // handle error and return result
}

// This is the test you write
describe("Test the getUser function", () => {
  it.fuzz("with AI-generated inputs", (data) => {
    getUser(data);
  });
});

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 74% code coverage

* Critical Security Issue: Command Injection in getUser (user/user.js:4:2)

To assess the issues, check your project on CI Sense

// This is the code you want to test
@SpringBootApplication
@RestController
class MyApplication {

  @GetMapping("/user")
  public String getUser(@RequestParam() String id) {
    Statement stmt = conn.createStatement();
    // SECURITY ISSUE: vulnerable to SQL injection!
    ResultSet rs = stmt.executeQuery("SELECT * FROM users WHERE id = '" + id + "'");
    // handle results
  }
}

// This is the test you write
@FuzzTest
public void testUserEndpoint(String generatedId) throws Exception {
  // Call your API endpoint with AI-generated inputs.
  mockMvc.perform(get("/user").param("id", generatedId));
}

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 86% code coverage

* Critical Security Issue: SQL Injection in Get User endpoint (com.example.MyApplication:10)

To assess the issues, check your project on CI Sense

// This is the code you want to test
int getUser(struct Connection *conn, const char *id) {
  sprintf(query, "SELECT * FROM users WHERE id ='%s'", id);
  char *zErrMsg = nullptr;
  
  // SECURITY ISSUE: vulnerable to SQL injection!
  sqlite3_exec(db, query, nullptr, nullptr, &zErrMsg);
  // handle query results
}

// This is the test you write
FUZZ_TEST(const uint8_t *data, size_t size) {
  // Call your API endpoint with AI-generated inputs.
  Client *client = connect_to_server(ip, port);
  client->send_request("GET /user/%s HTTP/1.0", data);
}

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 76% code coverage

* Critical Security Issue: SQL Injection in the Get User API endpoint (src/user.cpp:7:2)

To assess the issues, check your project on CI Sense

// This is the code you want to test
func GetUser(db sql.DB, w http.ResponseWriter, r *http.Request) {
  id := r.URL.Query().Get("id")
  
  // SECURITY ISSUE: vulnerable to SQL injection!
  rows, err := db.Query(fmt.Sprintf("SELECT * FROM users WHERE id = %s", id))
  // Handle the answer and write the answer to `w`
}

// This is the test you write
func FuzzGetUser(f *testing.F) {
  f.Fuzz(func(t *testing.T, id string) {
    // Call your API endpoint with AI-generated inputs.
    url := fmt.Sprintf("/user?id=%s", id)
    req := httptest.NewRequest("GET", url, nil)
    performRequestAndCheckResult(req)
  })
}

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 76% code coverage

* Critical Security Issue: SQL Injection in the Get User API endpoint (user/user.go:6)

To assess the issues, check your project on CI Sense

// This is the code you want to test
const app = require('express')();
app.get("/user", (request, response) => {
  const id = request.query.id;
  const query = `SELECT * FROM users WHERE id = ${id}`;
  // SECURITY ISSUE: vulnerable to SQL injection!
  connection.query(query, (error, results, fields) => {
    // handle results
  });
});

// This is the test you write
const request = require("supertest");
describe("Test the Get User API Endpoint", () => {
  it.fuzz("with AI-generated inputs", async (generatedId) => {
    const response = await request(app).get("/user").query({ id: generatedId });
  });
});

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 73% code coverage

* Critical Security Issue: SQL Injection in the Get User API endpoint (user/user.js:7:2)

To assess the issues, check your project on CI Sense

// This is the code you want to test
public static String getUser(String id) {
  if (id.startsWith("admin:")) {
    Statement stmt = conn.createStatement();
    // SECURITY ISSUE: vulnerable to SQL injection!
    ResultSet rs = stmt.executeQuery("SELECT * FROM admins WHERE id = '" + id + "'");
    // handle results
  }
  // Handle non-admin users.
}

// This is the test you write
@FuzzTest
void testGetUser(String generatedId) {
  // Call your method with AI-generated inputs.
  User.getUser(generatedId);
}

TERMINAL

$ cifuzz run all

Results: found 2 issues and reached 91% code coverage

* Critical Security Issue: SQL Injection in getUser (com.example.User:6)

To assess the issues, check your project on CI Sense

// This is the code you want to test
char* getUser(const char* id, size_t id_size) {
  char* user_buffer = (char*) malloc(MAX_USER_LENGTH);
  
  if (id_size >= 6 && strncmp("admin:", id, id_size) == 0) {
    // SECURITY ISSUE: vulnerable to heap buffer overflow!
    memcpy(user_buffer, id, id_size);
  
    // finish constructing the user buffer
  }
}

// This is the test you write
FUZZ_TEST(const char* data, size_t size) {
  // Call your function with AI-generated inputs.
  getUser(data, size);
}

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 63% code coverage

* Critical Security Issue: Heap Buffer Overflow in getUser (src/user.cpp:7:4)

To assess the issues, check your project on CI Sense

// This is the code you want to test
func GetUser(id string) (string, error) {
  if strings.HasPrefix(id, "admin:") {
    // SECURITY ISSUE: vulnerable to SQL injection!
    rows, err := db.Query(fmt.Sprintf("SELECT * FROM admins WHERE id = %s", id))
    // ...
  }
}

// This is the test you write
func FuzzGetUser(f *testing.F) {
  f.Fuzz(func(t *testing.T, id string) {
    // Call your function with AI-generated inputs.
    GetUser(id)
  })
}

TERMINAL

$ cifuzz run all

Results: found 1 issues and reached 79% code coverage

* Critical Security Issue: Command Injection in GetUser (user/user.go:5)

To assess the issues, check your project on CI Sense

// This is the code you want to test
function getUser(id) {
  if (id.startsWith("admin:")) {
    const query = `SELECT * FROM admins WHERE id = ${id}`;
    // SECURITY ISSUE: vulnerable to SQL injection!
    connection.query(query, (error, results, fields) => {
      // handle results
    });
  }
}

// This is the test you write
describe("Test the getUser function", () => {
  it.fuzz("with AI-generated inputs", (data) => {
    getUser(data);
  });
});

TERMINAL

$ cifuzz run all

Results: found 1 issue and reached 93% code coverage

* Critical Security Issue: SQL Injection in getUser (user/user.js:6:4)

To assess the issues, check your project on CI Sense

// This is the code you want to test
public static String sanitize(String userInput) {
  // logic to remove all HTML tags from user input
}

// This is the test you write
@FuzzTest
void testSanitize(String generatedInput) {
  // Call your method with AI-generated inputs.
  String sanitizedInput = User.sanitize(generatedInput);
  assertFalse("Result contains unwanted string", sanitizedInput.contains("</script"))
}

TERMINAL

$ cifuzz run all

Results: found 1 issue and reached 61% code coverage

* Assertion Failure: Result contains unwanted string (com.example.SanitizerTest)

To assess the issues, check your project on CI Sense

// This is the code you want to test
std::string sanitize(const std::string& userInput) {
  // logic to remove all HTML tags from user input
}

// This is the test you write
FUZZ_TEST(const char*data, size_t size) {
  // Call your function with AI-generated inputs.
  std::string input(data, size);
  std::string sanitizedInput = sanitize(input);
  assert(sanitizedInput.contains("</script"), "Result contains unwanted string")
}

TERMINAL

$ cifuzz run all

Results: found 1 issue and reached 61% code coverage

* Assertion Failure: Result contains unwanted string (src/sanitize_test.cpp)

To assess the issues, check your project on CI Sense

// This is the code you want to test
func Sanitize(userInput string) string {
  // logic to remove all HTML tags from user input
}

// This is the test you write
func FuzzSanitize(f *testing.F) {
  f.Fuzz(func(t *testing.T, input string) {
    // Call your function with AI-generated inputs.
    sanitizedInput := Sanitize(input)
    if strings.Contains(sanitizedInput, "</script") {
      t.Error("Result contains unwanted string")
    }
  })
}

TERMINAL

$ cifuzz run all

Results: found 1 issue and reached 90% code coverage

* Test Failure: Result contains unwanted string (sanitizer/sanitize_test.go)

To assess the issues, check your project on CI Sense

// This is the code you want to test
function sanitize(userInput) {
  // logic to remove all HTML tags from user input
}

// This is the test you write
describe("Test the sanitize function", () => {
  it.fuzz("with AI-generated inputs", (input) => {
    const sanitizedInput = sanitize(input)
    expect(
      sanitizedInput.includes("</script"), 
      "Result contains unwanted string"
    ).toBeFalsy();
  });
});

TERMINAL

$ cifuzz run all

Results: found 1 issue and reached 76% code coverage

* Test Failure: Result contains unwanted string (sanitizer/sanitize_test.js)

To assess the issues, check your project on CI Sense

"Code Intelligence helps developers ship secure software by providing the necessary integrations to test their code at each pull request, without ever having to leave their favorite environment. It's like having an automated security expert always by your side."

Thomas DohmkeCEO, GitHub

“Thanks to Code Intelligence we were able to remediate deeply hidden issues, allowing us to ensure our vehicular software’s optimal functionality and safety. Coming up with the right unit tests for these cases would have been super difficult. With Code Intelligence’s AI-powered tests, we had the first finding within hours!”

Saleh HeydariVP of Software Engineering, XOS Trucks