I was thinking the same thing. Would it be feasible to hide dozens or even hundreds of small pieces of code that, when deployed enough times, operate together as one large piece of malware. Say a few lines of code here that cause some memory to leak in a server context. A few over there that cause the server to occasionally reach out to some public destination and a few others that, if they should so happen to be reached out to will know the origin is poisoned and set in motion some sort of attack…it would be the opposite approach to highly targeted attacks. But, if we have tools that offer up code snippets then surely we’re going to have people blindly using them just through inexperience. So it seems plausible at least that it could act as an attack vector.

Consider that a bunch of bad patches[1] introducing vulnerabilities have passed a strict reviewing process and made their way into the Linux kernel. I'd say there's a far more simple and effective way: just answer questions on StackOverflow by giving code with vulnerabilities (something that most novices aren't likely to notice) and look for them later in the wild.

[1]: https://lore.kernel.org/lkml/[email protected]/#r

Considering StackOverflow rewards speed, and that most common questions fall into category of "how do I make thing X work?" - a good proportion of highly voted answers already come pre-loaded with vulnerabilities.

And no, I'm not being snarky. I wish I was.

Please, post some examples.

-cracks knuckles-

Coming from Google, top answer to inserting data with python+psycopg2: https://stackoverflow.com/questions/61861310/how-to-use-psyc... (no bound variables, straight up format string)

Same route, this time asking about allowing requests between subdomains: https://stackoverflow.com/questions/11161526/cross-subdomain... (question specifies they "already use CORS: <star>" and nobody even comments on that)

And let's not forget, PHP is still a thing: https://stackoverflow.com/questions/43497587/how-to-display-... (yep, user supplied input goes straight to SQL query string)

---

All of the above were results of about 10 seconds of searching. Each one came from the first page of Google results - because let's be honest, that's what almost everyone cares about.

To be fair, at least these days I can't find the "just use CORS=<star>" answers. They were bountiful two years ago, but maybe, just maybe, have been flagged as cataclysmically insecure since then.

(EDIT: remove asterisks in CORS gripes)