Source-Code Analysis
Source review finds flaws static testing misses by tracing data from sources (request parameters, headers, files, environment) to sinks (queries, shell calls, template engines, deserializers, file paths). Candidates must understand taint propagation, sanitizers versus validators, and why a validator that checks format does not make a value safe for a different sink. Know the classic sink families: SQL string concatenation, OS command construction, unsafe deserialization, path joins with user input, and template evaluation of user data.
Traps are common: flagging a finding behind an effective sanitizer (false positive), missing a second-order flow where stored data is later used unsafely, and assuming framework auto-escaping covers every context (it usually does not cover JavaScript or attribute contexts or raw HTML helpers). Also watch for secrets committed to repositories, weak randomness for tokens, and comparison flaws in authentication logic.
Worked example: a handler reads name from a query parameter and passes it to cursor.execute("SELECT * FROM users WHERE name = '%s'" % name). The source is the request parameter; the sink is the SQL string; there is no parameterization, so it is SQL injection. Even if an upstream regex rejects quotes, concatenation remains fragile; the correct fix is a bound parameter. Rule of thumb: follow the data, not the function name-confirm the source is attacker-controlled, no effective sanitizer sits on the path, and the sink interprets the data as code or a query.