apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-27 20:29:39 +02:00
Code Issues Projects Releases Packages Wiki Activity

Dynamic (#77)

Browse source
This commit is contained in:
Eli Peter 2026-06-05 10:16:30 -05:00 • committed by GitHub
parent 55247b7fcd
commit 991c84a1eb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1464 changed files with 225448 additions and 1985 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/fixtures/real_world/java/mixed/deser_cmdi.expect.json vendored
View file

@ -45,14 +45,14 @@
"notes": "Runtime.getRuntime().exec(command) with deserialized input; AST pattern correctly matches"
},
{
"rule_id": "java.xss.getwriter_print",
"rule_id": "taint-unsanitised-flow",
"severity": "MEDIUM",
"must_not_match": true,
"line_range": [
11,
11
],
"notes": "response.getWriter().println(\"Done\") — constant string, Layer B suppresses (regression guard)"
"notes": "response.getWriter().println(\"Done\") — constant string, must NOT raise reflected-XSS (Cap::HTML_ESCAPE). Regression guard retargeted from the retired java.xss.getwriter_print AST pattern to the taint sink that now owns reflected XSS."
},
{
"rule_id": "taint-unsanitised-flow",

4
tests/fixtures/real_world/java/mixed/servlet_full.expect.json vendored
View file

@ -80,14 +80,14 @@
"notes": "source at 11:9 (request.getParameter(\"input\")) flows through SQL query (line 17) into result set output at out.println(rs.getString(1)); second-order taint via tainted query results"
},
{
"rule_id": "java.xss.getwriter_print",
"rule_id": "taint-unsanitised-flow",
"severity": "MEDIUM",
"must_not_match": true,
"line_range": [
26,
26
],
"notes": "response.getWriter().println(new String(data)) — file-read data, Layer B suppresses (regression guard)"
"notes": "response.getWriter().println(new String(data)) — file-read bytes, not reflected request input, must NOT raise reflected-XSS (Cap::HTML_ESCAPE). Regression guard retargeted from the retired java.xss.getwriter_print AST pattern to the taint sink that now owns reflected XSS."
}
]
}