Sample: Perl — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — Perl

This PR intentionally introduces insecure patterns so you can see SquidGate work on Perl:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/perl/demo.pl

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

The new demo.pl file introduces hardcoded credentials, SQL injection, and command injection vulnerabilities.

⛔ 3 finding(s) block merge.

HIGH — Hardcoded API Key

File: examples/perl/demo.pl:2 | Confidence: high

A secret API key is hardcoded directly in the source code. This exposes the credential if the file is committed to version control or distributed.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded key and load it from environment variables or a secure secrets manager. Example: my $API_KEY = $ENV{'API_KEY'};

---

HIGH — SQL Injection Vulnerability

File: examples/perl/demo.pl:7 | Confidence: high

User-controlled input ($id) is directly interpolated into a SQL query string without parameterization or escaping, enabling SQL injection attacks.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries or prepared statements with DBI. Example: $sth = $dbh->prepare('SELECT * FROM users WHERE id = ?'); $sth->execute($id);

---

HIGH — OS Command Injection

File: examples/perl/demo.pl:13 | Confidence: high

User input ($name) is passed unsanitized to system(), allowing arbitrary command execution via shell metacharacters.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Avoid system() with user input. Use safe APIs or escape arguments properly. Example: use IPC::Run or list form: system('echo', $name);

---