ssti_prescan report — 5 file(s), 27 finding(s)

HIGH   TI-REQ-NAME      App.java:3  request-controlled name/path reaches template lookup
       | cfg.getTemplate(request.getParameter("t"));
HIGH   TI-REQ-SRC       App.java:9  request-controlled source reaches template render/compile
       | Velocity.evaluate(ctx, w, "t", request.getParameter("tpl"));
HIGH   TI-REQ-SRC       handler.rb:3  request-controlled source reaches template render/compile
       | render inline: params[:tpl]
HIGH   TI-REQ-NAME      handler.rb:6  request-controlled name/path reaches template lookup
       | render file: params[:f]
HIGH   TI-REQ-NAME      handler.rb:9  request-controlled name/path reaches template lookup
       | render template: params[:view]
HIGH   TI-REQ-SRC       routes.ts:7  request-controlled source reaches template render/compile
       | return ejs.render(req.query.tpl, { user: 'x' });
HIGH   TI-REQ-NAME      routes.ts:10  request-controlled name/path reaches template lookup
       | return res.render(req.query.view);
HIGH   TI-REQ-NAME      routes.ts:13  request-controlled name/path reaches template lookup
       | return pug.renderFile(req.params.f, {});
HIGH   TI-REQ-SRC       views.py:8  request-controlled source reaches template render/compile
       | return render_template_string(request.args['tpl'])
HIGH   TI-REQ-NAME      views.py:11  request-controlled name/path reaches template lookup
       | return render_template('pages/' + request.args['p'])
HIGH   TI-REQ-NAME      views.py:14  request-controlled name/path reaches template lookup
       | return render(request, request.GET['t'])
HIGH   TI-REQ-NAME      views.py:17  request-controlled name/path reaches template lookup
       | return TemplateResponse(request, 'themes/' + request.GET['th'], {})
HIGH   TI-REQ-SRC       views.py:20  request-controlled source reaches template render/compile
       | return env.from_string(request.data).render()
HIGH   TI-REQ-SRC       x.php:2  request-controlled source reaches template render/compile
       | $twig->createTemplate($_POST['tpl']);
HIGH   TI-REQ-SRC       x.php:3  request-controlled source reaches template render/compile
       | $smarty->display('string:'.$_GET['t']);
MEDIUM TI-SRC-NONLIT    App.java:6  non-literal/interpolated template source
       | new Template("t", new StringReader(src), cfg);
MEDIUM TI-SRC-NONLIT    handler.rb:12  non-literal/interpolated template source
       | ERB.new(template).result
MEDIUM TI-SRC-NONLIT    routes.ts:16  non-literal/interpolated template source
       | return ejs.render(cachedTpl, data);
MEDIUM TI-NAME-NONLIT   routes.ts:19  non-literal/interpolated template name/path
       | return res.render(viewName);
MEDIUM TI-REQ-SRC       routes.ts:22  request-controlled source reaches template render/compile (logic-less engine — content forgery, not code exec)
       | return Mustache.render(req.query.tpl, view);
MEDIUM TI-NAME-NONLIT   views.py:23  non-literal/interpolated template name/path
       | return render(request, tpl_name)
MEDIUM TI-SRC-NONLIT    views.py:26  non-literal/interpolated template source
       | return render_template_string("<h1>" + heading)
MEDIUM TI-SRC-NONLIT    views.py:29  non-literal/interpolated template source
       | return Template(page_src).render()
MEDIUM TI-SRC-NONLIT    x.php:4  non-literal/interpolated template source
       | $smarty->fetch('string:' . $tpl);
LOW    TI-REQ-NAME      views.py:41  request-controlled name/path reaches template lookup
       | return render_template(secure_filename(request.args['p']))
LOW    TI-ENV-TMPL      views.py:44  environment-controlled template source
       | return render_template_string(os.environ['MAIL_TPL'])
LOW    TI-AUTOESCAPE-OFF views.py:46  autoescaping disabled in engine config
       | env = Environment(autoescape=False)

scope: deterministic pre-scan — flags patterns for review; not an audit, clean != injection-safe