mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-06 19:35:13 +02:00
15590 lines
No EOL
436 KiB
JSON
15590 lines
No EOL
436 KiB
JSON
{
|
|
"schema_version": "1.0",
|
|
"metadata": {
|
|
"description": "Nyx benchmark ground truth",
|
|
"created": "2026-03-20",
|
|
"corpus_size": 492
|
|
},
|
|
"cases": [
|
|
{
|
|
"case_id": "js-sqli-001",
|
|
"file": "javascript/sqli/sqli_concat.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.code_exec.eval"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"concat",
|
|
"eval-proxy"
|
|
],
|
|
"disabled": false,
|
|
"notes": "eval used as proxy for SQL query; analogue tier because real SQL sink is not modeled directly"
|
|
},
|
|
{
|
|
"case_id": "js-sqli-002",
|
|
"file": "javascript/sqli/sqli_template.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.code_exec.eval"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"template-literal",
|
|
"eval-proxy"
|
|
],
|
|
"disabled": false,
|
|
"notes": "eval used as proxy for SQL query with template literal interpolation"
|
|
},
|
|
{
|
|
"case_id": "js-cmdi-001",
|
|
"file": "javascript/cmdi/cmdi_direct.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"js.cmdi.exec"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"child_process"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from req.query.cmd to exec()"
|
|
},
|
|
{
|
|
"case_id": "js-cmdi-002",
|
|
"file": "javascript/cmdi/cmdi_indirect.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"js.cmdi.exec"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"indirect",
|
|
"concat",
|
|
"child_process"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Indirect flow via string concat to exec()"
|
|
},
|
|
{
|
|
"case_id": "js-xss-001",
|
|
"file": "javascript/xss/xss_reflected.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"innerHTML",
|
|
"reflected"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Reflected XSS via innerHTML assignment; taint-based detection (no AST pattern for innerHTML)"
|
|
},
|
|
{
|
|
"case_id": "js-xss-002",
|
|
"file": "javascript/xss/xss_document_write.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.xss.document_write"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"document-write"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS via document.write with user-controlled content"
|
|
},
|
|
{
|
|
"case_id": "js-xss-003",
|
|
"file": "javascript/xss/xss_location.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-601",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.xss.location_assign"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"open-redirect",
|
|
"location-href"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Open redirect via location.href assignment"
|
|
},
|
|
{
|
|
"case_id": "js-ssrf-001",
|
|
"file": "javascript/ssrf/ssrf_fetch.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"fetch",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via fetch() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "js-path_traversal-001",
|
|
"file": "javascript/path_traversal/path_traversal.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"sendFile",
|
|
"path-traversal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path traversal via res.sendFile with user-controlled path"
|
|
},
|
|
{
|
|
"case_id": "js-code_injection-001",
|
|
"file": "javascript/code_injection/code_injection.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.code_exec.eval"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"eval",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Code injection via eval() with user-controlled expression"
|
|
},
|
|
{
|
|
"case_id": "js-code_injection-002",
|
|
"file": "javascript/code_injection/code_injection_indirect.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"new-function",
|
|
"indirect",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Code injection via new Function() with user-controlled template"
|
|
},
|
|
{
|
|
"case_id": "js-safe-001",
|
|
"file": "javascript/safe/safe_constant.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant string argument to exec; no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "js-safe-002",
|
|
"file": "javascript/safe/safe_dominated.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"dominated-check"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input dominated by allowlist check before reaching exec()"
|
|
},
|
|
{
|
|
"case_id": "js-safe-003",
|
|
"file": "javascript/safe/safe_interprocedural.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"dompurify",
|
|
"interprocedural"
|
|
],
|
|
"disabled": false,
|
|
"notes": "DOMPurify sanitizer applied via helper function before innerHTML"
|
|
},
|
|
{
|
|
"case_id": "js-safe-004",
|
|
"file": "javascript/safe/safe_non_security_sink.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"non-security-sink",
|
|
"console-log"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input flows to console.log and length computation, not a security sink"
|
|
},
|
|
{
|
|
"case_id": "js-safe-005",
|
|
"file": "javascript/safe/safe_reassigned.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"reassignment",
|
|
"killed-taint"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable reassigned to constant before reaching innerHTML"
|
|
},
|
|
{
|
|
"case_id": "js-safe-006",
|
|
"file": "javascript/safe/safe_sanitized.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"dompurify"
|
|
],
|
|
"disabled": false,
|
|
"notes": "DOMPurify.sanitize applied inline before innerHTML assignment"
|
|
},
|
|
{
|
|
"case_id": "js-safe-007",
|
|
"file": "javascript/safe/safe_type_check.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"type-check",
|
|
"typeof-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "typeof check guards eval(); only numbers reach the sink"
|
|
},
|
|
{
|
|
"case_id": "js-safe-008",
|
|
"file": "javascript/safe/safe_validated.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"validated"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Allowlist validation before exec(); only permitted commands reach sink"
|
|
},
|
|
{
|
|
"case_id": "py-sqli-001",
|
|
"file": "python/sqli/sqli_concat.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"concat",
|
|
"cursor-execute"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via string concat in cursor.execute()"
|
|
},
|
|
{
|
|
"case_id": "py-sqli-002",
|
|
"file": "python/sqli/sqli_format.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.sqli.execute_format"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"format-string",
|
|
"cursor-execute"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via % format operator in cursor.execute()"
|
|
},
|
|
{
|
|
"case_id": "py-cmdi-001",
|
|
"file": "python/cmdi/cmdi_direct.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.cmdi.os_system"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"os-system"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct command injection via os.system()"
|
|
},
|
|
{
|
|
"case_id": "py-cmdi-002",
|
|
"file": "python/cmdi/cmdi_indirect.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.cmdi.subprocess_shell"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"indirect",
|
|
"subprocess",
|
|
"shell-true"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Command injection via subprocess.run with shell=True"
|
|
},
|
|
{
|
|
"case_id": "py-xss-001",
|
|
"file": "python/xss/xss_reflected.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"reflected",
|
|
"make-response"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Reflected XSS via make_response with unescaped user input in HTML"
|
|
},
|
|
{
|
|
"case_id": "py-xss-002",
|
|
"file": "python/xss/xss_template_string.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.xss.jinja_from_string"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"jinja2",
|
|
"template-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Server-side template injection via jinja2.Template with user-controlled string"
|
|
},
|
|
{
|
|
"case_id": "py-ssrf-001",
|
|
"file": "python/ssrf/ssrf_requests.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"requests-get",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via requests.get() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "py-path_traversal-001",
|
|
"file": "python/path_traversal/path_traversal.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"send-file",
|
|
"path-traversal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path traversal via send_file() with user-controlled path"
|
|
},
|
|
{
|
|
"case_id": "py-deser-001",
|
|
"file": "python/deser/deser_pickle.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deser",
|
|
"cwe": "CWE-502",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.deser.pickle_loads"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"pickle",
|
|
"deserialization"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Insecure deserialization via pickle.loads with user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "py-code_injection-001",
|
|
"file": "python/code_injection/code_injection.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.code_exec.eval"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"eval",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Code injection via eval() with user-controlled expression"
|
|
},
|
|
{
|
|
"case_id": "py-code_injection-002",
|
|
"file": "python/code_injection/code_injection_exec.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.code_exec.exec"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"exec",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Code injection via exec() with user-controlled code string"
|
|
},
|
|
{
|
|
"case_id": "py-safe-001",
|
|
"file": "python/safe/safe_constant.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant string argument to os.system; no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "py-safe-002",
|
|
"file": "python/safe/safe_dominated.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"dominated-check"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input dominated by allowlist membership check before os.system()"
|
|
},
|
|
{
|
|
"case_id": "py-safe-003",
|
|
"file": "python/safe/safe_interprocedural.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"shlex-quote",
|
|
"interprocedural"
|
|
],
|
|
"disabled": false,
|
|
"notes": "shlex.quote sanitizer applied via helper function before os.system()"
|
|
},
|
|
{
|
|
"case_id": "py-safe-004",
|
|
"file": "python/safe/safe_non_security_sink.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"non-security-sink",
|
|
"logging"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input flows to logging.info and length computation, not a security sink"
|
|
},
|
|
{
|
|
"case_id": "py-safe-005",
|
|
"file": "python/safe/safe_reassigned.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"reassignment",
|
|
"killed-taint"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable reassigned to constant before reaching os.system()"
|
|
},
|
|
{
|
|
"case_id": "py-safe-006",
|
|
"file": "python/safe/safe_sanitized.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"shlex-quote"
|
|
],
|
|
"disabled": false,
|
|
"notes": "shlex.quote sanitizer applied inline before os.system()"
|
|
},
|
|
{
|
|
"case_id": "py-safe-007",
|
|
"file": "python/safe/safe_type_check.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"type-check",
|
|
"isinstance-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "isinstance check guards cursor.execute(); only ints reach the sink"
|
|
},
|
|
{
|
|
"case_id": "py-safe-008",
|
|
"file": "python/safe/safe_validated.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"validated"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Allowlist validation before os.system(); only permitted commands reach sink"
|
|
},
|
|
{
|
|
"case_id": "java-sqli-001",
|
|
"file": "java/sqli/SqliConcat.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.sqli.execute_concat"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"concat",
|
|
"executeQuery"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via string concat in executeQuery()"
|
|
},
|
|
{
|
|
"case_id": "java-sqli-002",
|
|
"file": "java/sqli/SqliFormat.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.sqli.execute_concat"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"string-format",
|
|
"executeQuery"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via String.format in executeQuery()"
|
|
},
|
|
{
|
|
"case_id": "java-cmdi-001",
|
|
"file": "java/cmdi/CmdiDirect.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.cmdi.runtime_exec"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"runtime-exec"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct command injection via Runtime.exec()"
|
|
},
|
|
{
|
|
"case_id": "java-cmdi-002",
|
|
"file": "java/cmdi/CmdiIndirect.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.cmdi.runtime_exec"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"indirect",
|
|
"concat",
|
|
"runtime-exec"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Indirect command injection via string concat to Runtime.exec()"
|
|
},
|
|
{
|
|
"case_id": "java-xss-001",
|
|
"file": "java/xss/XssReflected.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.xss.getwriter_print"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"reflected",
|
|
"getwriter-println"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Reflected XSS via getWriter().println() with unescaped user input"
|
|
},
|
|
{
|
|
"case_id": "java-ssrf-001",
|
|
"file": "java/ssrf/SsrfRequest.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"url-connection",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via URL.openConnection() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "java-ssrf-002",
|
|
"file": "java/ssrf/SsrfHttpClient.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"http-client",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via HttpClient.send() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "java-path_traversal-001",
|
|
"file": "java/path_traversal/PathTraversal.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"file-input-stream",
|
|
"path-traversal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path traversal via FileInputStream with user-controlled path"
|
|
},
|
|
{
|
|
"case_id": "java-deser-001",
|
|
"file": "java/deser/DeserOis.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deser",
|
|
"cwe": "CWE-502",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.deser.readobject"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"object-input-stream",
|
|
"deserialization"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Insecure deserialization via ObjectInputStream.readObject()"
|
|
},
|
|
{
|
|
"case_id": "java-deser-002",
|
|
"file": "java/deser/DeserSource.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deser",
|
|
"cwe": "CWE-502",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.deser.readobject",
|
|
"java.cmdi.runtime_exec"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"deser-to-exec",
|
|
"chained"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Deserialized object flows to Runtime.exec(); both readObject and exec patterns should match"
|
|
},
|
|
{
|
|
"case_id": "java-code_injection-001",
|
|
"file": "java/code_injection/CodeInjection.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.reflection.class_forname"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"reflection",
|
|
"class-forname"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Code injection via Class.forName() with user-controlled class name"
|
|
},
|
|
{
|
|
"case_id": "java-safe-001",
|
|
"file": "java/safe/SafeConstant.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant string in executeQuery(); no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "java-safe-002",
|
|
"file": "java/safe/SafeDominated.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"dominated-check"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input dominated by allowlist Set.contains() check before Runtime.exec()"
|
|
},
|
|
{
|
|
"case_id": "java-safe-003",
|
|
"file": "java/safe/SafeInterprocedural.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"html-escape",
|
|
"interprocedural"
|
|
],
|
|
"disabled": false,
|
|
"notes": "HtmlUtils.htmlEscape sanitizer applied via helper method before getWriter().println()"
|
|
},
|
|
{
|
|
"case_id": "java-safe-004",
|
|
"file": "java/safe/SafeNonSecuritySink.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"non-security-sink",
|
|
"logger"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input flows to Logger.info and length computation; output is String.valueOf(len)"
|
|
},
|
|
{
|
|
"case_id": "java-safe-005",
|
|
"file": "java/safe/SafeReassigned.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"reassignment",
|
|
"killed-taint"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable reassigned to constant 'Guest' before reaching getWriter().println()"
|
|
},
|
|
{
|
|
"case_id": "java-safe-006",
|
|
"file": "java/safe/SafeSanitized.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"html-escape"
|
|
],
|
|
"disabled": false,
|
|
"notes": "HtmlUtils.htmlEscape sanitizer applied inline before getWriter().println()"
|
|
},
|
|
{
|
|
"case_id": "java-safe-007",
|
|
"file": "java/safe/SafeTypeCheck.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"type-check",
|
|
"regex-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Regex matches(\"\\\\d+\") check guards executeQuery(); only numeric strings reach the sink"
|
|
},
|
|
{
|
|
"case_id": "java-safe-008",
|
|
"file": "java/safe/SafeValidated.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"validated"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Allowlist validation before Runtime.exec(); only permitted commands reach sink"
|
|
},
|
|
{
|
|
"case_id": "go-sqli-001",
|
|
"file": "go/sqli/sqli_concat.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.sqli.query_concat"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"concat",
|
|
"db-query"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via string concat in db.Query()"
|
|
},
|
|
{
|
|
"case_id": "go-sqli-002",
|
|
"file": "go/sqli/sqli_sprintf.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.sqli.query_concat"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"tags": [
|
|
"sprintf",
|
|
"db-exec"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via fmt.Sprintf in db.Exec()"
|
|
},
|
|
{
|
|
"case_id": "go-sqli-003",
|
|
"file": "go/sqli/sqli_queryrow.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.sqli.query_concat"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"concat",
|
|
"db-queryrow"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via string concat in db.QueryRow()"
|
|
},
|
|
{
|
|
"case_id": "go-cmdi-001",
|
|
"file": "go/cmdi/cmdi_direct.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.cmdi.exec_command"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-unauthed-access"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"exec-command"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct command injection via exec.Command()"
|
|
},
|
|
{
|
|
"case_id": "go-cmdi-002",
|
|
"file": "go/cmdi/cmdi_indirect.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.cmdi.exec_command"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-unauthed-access"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"indirect",
|
|
"concat",
|
|
"exec-command",
|
|
"shell"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Indirect command injection via string concat to exec.Command(\"sh\", \"-c\", cmd)"
|
|
},
|
|
{
|
|
"case_id": "go-cmdi-003",
|
|
"file": "go/cmdi_env/cmdi_env.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "language_specific",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.cmdi.exec_command"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"env-source",
|
|
"exec-command",
|
|
"shell"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Command injection via os.Getenv source flowing to exec.Command; language_specific tier because env-var source pattern is Go-specific"
|
|
},
|
|
{
|
|
"case_id": "go-cmdi-004",
|
|
"file": "go/cmdi/cmdi_unvalidated_queue_element.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.cmdi.exec_command"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-unauthed-access"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
13,
|
|
13
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"tags": [
|
|
"container-element",
|
|
"index-read",
|
|
"exec-command",
|
|
"pointer-w5"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted user input pushed into a slice via append(); unsanitised element re-read with cmds[0] flows to exec.Command. Exercises W5 subscript-read recognition + W2 container ELEM cell flow."
|
|
},
|
|
{
|
|
"case_id": "go-xss-001",
|
|
"file": "go/xss/xss_fprintf.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"fmt-fprintf",
|
|
"response-writer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS via fmt.Fprintf to ResponseWriter with unescaped user input"
|
|
},
|
|
{
|
|
"case_id": "go-xss-002",
|
|
"file": "go/xss/xss_template_html.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"template-html",
|
|
"unsafe-cast"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS via template.HTML() cast bypassing html/template auto-escaping"
|
|
},
|
|
{
|
|
"case_id": "go-ssrf-001",
|
|
"file": "go/ssrf/ssrf_http_get.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"http-get",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via http.Get() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "go-path_traversal-001",
|
|
"file": "go/path_traversal/path_traversal.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"state-unauthed-access"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"os-readfile",
|
|
"path-traversal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path traversal via os.ReadFile() with user-controlled path"
|
|
},
|
|
{
|
|
"case_id": "go-fmt_string-001",
|
|
"file": "go/fmt_string/fmt_injection.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "fmt_string",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"fmt-fprintf",
|
|
"format-string-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Format string injection via user-controlled format arg to fmt.Fprintf()"
|
|
},
|
|
{
|
|
"case_id": "go-safe-001",
|
|
"file": "go/safe/safe_constant.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant string arguments to exec.Command; no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "go-safe-002",
|
|
"file": "go/safe/safe_dominated.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"dominated-check",
|
|
"map-lookup"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input dominated by map allowlist check before exec.Command()"
|
|
},
|
|
{
|
|
"case_id": "go-safe-003",
|
|
"file": "go/safe/safe_interprocedural.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"filepath-clean",
|
|
"interprocedural"
|
|
],
|
|
"disabled": false,
|
|
"notes": "filepath.Clean sanitizer applied via helper function before os.ReadFile(); auth guard present"
|
|
},
|
|
{
|
|
"case_id": "go-safe-004",
|
|
"file": "go/safe/safe_non_security_sink.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"non-security-sink",
|
|
"log-printf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input flows to log.Printf and length output; no security-sensitive sink"
|
|
},
|
|
{
|
|
"case_id": "go-safe-005",
|
|
"file": "go/safe/safe_reassigned.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"reassignment",
|
|
"killed-taint"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable reassigned to constant 'Guest' before reaching fmt.Fprintf()"
|
|
},
|
|
{
|
|
"case_id": "go-safe-006",
|
|
"file": "go/safe/safe_sanitized.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"filepath-clean"
|
|
],
|
|
"disabled": false,
|
|
"notes": "filepath.Clean sanitizer applied inline before os.ReadFile(); auth guard present"
|
|
},
|
|
{
|
|
"case_id": "go-safe-007",
|
|
"file": "go/safe/safe_type_check.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"type-check",
|
|
"strconv-atoi-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "strconv.Atoi check guards db.Query(); only valid integers reach the sink"
|
|
},
|
|
{
|
|
"case_id": "go-safe-008",
|
|
"file": "go/safe/safe_validated.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"validated",
|
|
"map-lookup"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Allowlist map validation before exec.Command(); only permitted commands reach sink"
|
|
},
|
|
{
|
|
"case_id": "go-safe-009",
|
|
"file": "go/safe/safe_validated_queue_element.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"go.cmdi.exec_command",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"validated",
|
|
"container-element",
|
|
"index-read",
|
|
"pointer-w4-w5"
|
|
],
|
|
"disabled": false,
|
|
"notes": "validate() sanitises before append(); cmds[0] re-read carries the validated_must bit through the W4 ELEM cell + W5 subscript synth, suppressing the cmdi finding."
|
|
},
|
|
{
|
|
"case_id": "php-sqli-001",
|
|
"file": "php/sqli/sqli_concat.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.sqli.query_concat"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"concat",
|
|
"mysqli-query"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via string concat in mysqli->query()"
|
|
},
|
|
{
|
|
"case_id": "php-sqli-002",
|
|
"file": "php/sqli/sqli_sprintf.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.sqli.query_concat"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"sprintf",
|
|
"mysqli-query"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via sprintf in mysqli->query()"
|
|
},
|
|
{
|
|
"case_id": "php-cmdi-001",
|
|
"file": "php/cmdi/cmdi_direct.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.cmdi.system"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"system"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct command injection via system()"
|
|
},
|
|
{
|
|
"case_id": "php-cmdi-002",
|
|
"file": "php/cmdi/cmdi_indirect.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"php.cmdi.system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"indirect",
|
|
"shell-exec",
|
|
"concat"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Indirect command injection via shell_exec(); taint-based since shell_exec is not directly an AST pattern"
|
|
},
|
|
{
|
|
"case_id": "php-xss-001",
|
|
"file": "php/xss/xss_reflected.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"echo",
|
|
"reflected"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Reflected XSS via echo with unescaped user input in HTML"
|
|
},
|
|
{
|
|
"case_id": "php-ssrf-001",
|
|
"file": "php/ssrf/ssrf_curl.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"file-get-contents",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via file_get_contents() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "php-path_traversal-001",
|
|
"file": "php/path_traversal/path_traversal.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.path.include_variable"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"include",
|
|
"path-traversal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path traversal / RFI via include() with user-controlled path"
|
|
},
|
|
{
|
|
"case_id": "php-path_traversal-002",
|
|
"file": "php/path_traversal/path_traversal_copy.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"copy",
|
|
"path-traversal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path traversal via copy() with user-controlled source path"
|
|
},
|
|
{
|
|
"case_id": "php-deser-002",
|
|
"file": "php/deser/deser_unserialize_allowed_true.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deser",
|
|
"cwe": "CWE-502",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.deser.unserialize"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"real-repo-precision-2026-04-28",
|
|
"unserialize",
|
|
"allowed_classes",
|
|
"true-default"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart to php-safe-017: allowed_classes => true is the unsafe default. Pattern must still fire."
|
|
},
|
|
{
|
|
"case_id": "php-path_traversal-003",
|
|
"file": "php/path_traversal/path_traversal_concat.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-98",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.path.include_variable"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"real-repo-precision-2026-04-28",
|
|
"include",
|
|
"concat",
|
|
"user-input"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart to php-safe-018: included variable is built from concatenation of $_GET inside the function \u2014 not a parameter pass-through. Pattern must still fire."
|
|
},
|
|
{
|
|
"case_id": "php-deser-001",
|
|
"file": "php/deser/deser_unserialize.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deser",
|
|
"cwe": "CWE-502",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.deser.unserialize"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"unserialize",
|
|
"deserialization"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Insecure deserialization via unserialize() with user-controlled POST data"
|
|
},
|
|
{
|
|
"case_id": "php-code_injection-001",
|
|
"file": "php/code_injection/code_injection.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.code_exec.eval"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"eval",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Code injection via eval() with user-controlled code"
|
|
},
|
|
{
|
|
"case_id": "php-code_injection-002",
|
|
"file": "php/code_injection/code_injection_assert.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.code_exec.assert_string"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"assert",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Code injection via assert() with string argument (PHP < 8.0 evaluates as code)"
|
|
},
|
|
{
|
|
"case_id": "php-safe-001",
|
|
"file": "php/safe/safe_constant.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant string argument to system(); no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "php-safe-002",
|
|
"file": "php/safe/safe_dominated.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"dominated-check",
|
|
"in-array"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input dominated by in_array allowlist check before system()"
|
|
},
|
|
{
|
|
"case_id": "php-safe-003",
|
|
"file": "php/safe/safe_interprocedural.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"htmlspecialchars",
|
|
"interprocedural"
|
|
],
|
|
"disabled": false,
|
|
"notes": "htmlspecialchars sanitizer applied via helper function before echo"
|
|
},
|
|
{
|
|
"case_id": "php-safe-004",
|
|
"file": "php/safe/safe_non_security_sink.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"non-security-sink",
|
|
"error-log"
|
|
],
|
|
"disabled": false,
|
|
"notes": "User input flows to error_log and strlen; echo outputs only the length integer"
|
|
},
|
|
{
|
|
"case_id": "php-safe-005",
|
|
"file": "php/safe/safe_reassigned.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"reassignment",
|
|
"killed-taint"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable reassigned to constant 'Guest' before reaching echo"
|
|
},
|
|
{
|
|
"case_id": "php-safe-006",
|
|
"file": "php/safe/safe_sanitized.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"htmlspecialchars"
|
|
],
|
|
"disabled": false,
|
|
"notes": "htmlspecialchars sanitizer applied inline before echo"
|
|
},
|
|
{
|
|
"case_id": "php-safe-007",
|
|
"file": "php/safe/safe_type_check.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"type-check",
|
|
"is-numeric-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "is_numeric check guards mysqli->query(); only numeric strings reach the sink"
|
|
},
|
|
{
|
|
"case_id": "php-safe-008",
|
|
"file": "php/safe/safe_validated.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"validated",
|
|
"in-array"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Allowlist in_array validation before system(); only permitted commands reach sink"
|
|
},
|
|
{
|
|
"case_id": "js-ssrf-002",
|
|
"file": "javascript/ssrf/ssrf_axios.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"axios",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via bare axios() call with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "js-ssrf-003",
|
|
"file": "javascript/ssrf/ssrf_http_get_chained.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"http",
|
|
"ssrf",
|
|
"chained-call"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Regression guard for the chained-method-call inner-gate fix (2026-04-27): http.get(url, cb).on('error', cb) must classify as SSRF on the inner http.get even though the outer .on swallows classification."
|
|
},
|
|
{
|
|
"case_id": "js-ssrf-safe-002",
|
|
"file": "javascript/ssrf/safe_http_get_hardcoded_chained.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"http",
|
|
"ssrf-safe",
|
|
"chained-call",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Precision guard: chained-call inner-gate fix must NOT fire on http.get('http://internal-health.localhost/...').on(...) with a hardcoded literal URL."
|
|
},
|
|
{
|
|
"case_id": "py-ssrf-002",
|
|
"file": "python/ssrf/ssrf_httpx_post.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"httpx",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via httpx.post() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "go-ssrf-002",
|
|
"file": "go/ssrf/ssrf_new_request.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"http-client",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via http.NewRequest() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "ruby-ssrf-001",
|
|
"file": "ruby/ssrf/ssrf_httparty.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"httparty",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via HTTParty.get() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "ruby-ssrf-003",
|
|
"file": "ruby/ssrf/ssrf_open_uri.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"open-uri",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via OpenURI.open_uri() with user-controlled URL — canonical low-level URI fetcher; CarrierWave / Paperclip / similar gems route SSRF-vulnerable downloads through it"
|
|
},
|
|
{
|
|
"case_id": "js-ssrf-safe-001",
|
|
"file": "javascript/ssrf/safe_ssrf_hardcoded.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"hardcoded",
|
|
"ssrf",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Hardcoded URL to axios(); no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "py-ssrf-safe-001",
|
|
"file": "python/ssrf/safe_ssrf_constant.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"constant",
|
|
"ssrf",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant URL to requests.get(); no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "go-ssrf-safe-001",
|
|
"file": "go/ssrf/safe_ssrf_hardcoded.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"hardcoded",
|
|
"ssrf",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Hardcoded URL to http.Get(); no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "php-ssrf-safe-001",
|
|
"file": "php/ssrf/safe_ssrf_hardcoded.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"hardcoded",
|
|
"ssrf",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Hardcoded URL to file_get_contents(); no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-001",
|
|
"file": "ruby/safe/safe_constant.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant string argument to system(); no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-002",
|
|
"file": "ruby/safe/safe_dominated.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"dominated-check",
|
|
"include"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Allowlist guard dominates system() call; taint should be suppressed"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-003",
|
|
"file": "ruby/safe/safe_interprocedural.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"shellwords-escape",
|
|
"interprocedural"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Shellwords.escape called via helper function; interprocedural sanitization"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-004",
|
|
"file": "ruby/safe/safe_non_security_sink.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"non-security-sink",
|
|
"logger"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Logger.info is not a security-sensitive sink"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-005",
|
|
"file": "ruby/safe/safe_reassigned.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"reassignment",
|
|
"killed-taint"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable reassigned to constant before reaching sink"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-006",
|
|
"file": "ruby/safe/safe_sanitized.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"shellwords-escape"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Shellwords.escape sanitizes user input before system() call"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-007",
|
|
"file": "ruby/safe/safe_type_check.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"type-check",
|
|
"is-a-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Type check guard (is_a? Integer) dominates SQL execution"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-008",
|
|
"file": "ruby/safe/safe_validated.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"allowlist",
|
|
"validated"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Allowlist validation before system() call"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-009",
|
|
"file": "ruby/safe/safe_kernel_open_file_namespaced.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"kernel-open",
|
|
"file-open",
|
|
"regression",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Negative regression for Ruby =open exact-matcher: File.open with a hardcoded path must not fire the bare-open CMDI rule (or any taint rule); pairs with ruby-cmdi-003"
|
|
},
|
|
{
|
|
"case_id": "ruby-ssrf-safe-001",
|
|
"file": "ruby/ssrf/safe_ssrf_hardcoded.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"hardcoded",
|
|
"ssrf",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Hardcoded URL to HTTParty.get(); no user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "ruby-cmdi-001",
|
|
"file": "ruby/cmdi/cmdi_system.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rb.cmdi.system_interp"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"system",
|
|
"cmdi"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Command injection via system() with user-controlled argument"
|
|
},
|
|
{
|
|
"case_id": "ruby-cmdi-002",
|
|
"file": "ruby/cmdi/cmdi_backtick.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rb.cmdi.backtick"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"backtick",
|
|
"cmdi"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Command injection via backtick interpolation with user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "ruby-cmdi-003",
|
|
"file": "ruby/cmdi/cmdi_kernel_open.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"tags": [
|
|
"kernel-open",
|
|
"cmdi",
|
|
"regression"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2020-8130 regression: bare Kernel#open(path) interprets a leading | as a shell pipe; the =open exact-matcher distinguishes it from File.open / IO.open / URI.open"
|
|
},
|
|
{
|
|
"case_id": "ruby-code_injection-001",
|
|
"file": "ruby/code_injection/code_injection_eval.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rb.code_exec.eval"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"eval",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Code injection via eval() with user-controlled expression"
|
|
},
|
|
{
|
|
"case_id": "ruby-deser-001",
|
|
"file": "ruby/deser/deser_marshal.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deser",
|
|
"cwe": "CWE-502",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rb.deser.marshal_load"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"marshal",
|
|
"deserialization"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Insecure deserialization via Marshal.load() with user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "ruby-deser-002",
|
|
"file": "ruby/deser/deser_yaml.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deser",
|
|
"cwe": "CWE-502",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rb.deser.yaml_load"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"yaml",
|
|
"deserialization"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Insecure deserialization via YAML.load() with user-controlled data"
|
|
},
|
|
{
|
|
"case_id": "ruby-path_traversal-001",
|
|
"file": "ruby/path_traversal/path_traversal_send_file.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"send-file",
|
|
"path-traversal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path traversal via send_file() with user-controlled path"
|
|
},
|
|
{
|
|
"case_id": "ruby-path_traversal-002",
|
|
"file": "ruby/path_traversal/path_traversal_yaml_load_file_read.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"wrapper-sink",
|
|
"path-traversal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path traversal via cross-fn helper that wraps File.read inside YAML.safe_load (the `outer(File.read(x))` shape used in real Ruby helpers — rswag CVE-2023-38337 chain). Regression guard for the inner-call fallback fix in src/cfg/mod.rs::push_node so a wrapper around an FILE_IO sink continues to surface in summary extraction."
|
|
},
|
|
{
|
|
"case_id": "ruby-sqli-001",
|
|
"file": "ruby/sqli/sqli_find_by_sql.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"find-by-sql",
|
|
"sqli"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via find_by_sql() with string concatenation"
|
|
},
|
|
{
|
|
"case_id": "ruby-sqli-002",
|
|
"file": "ruby/sqli/sqli_execute.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"execute",
|
|
"sqli"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via ActiveRecord execute() with string concatenation"
|
|
},
|
|
{
|
|
"case_id": "ruby-ssrf-002",
|
|
"file": "ruby/ssrf/ssrf_net_http.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"net-http",
|
|
"ssrf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SSRF via Net::HTTP.get() with user-controlled URL"
|
|
},
|
|
{
|
|
"case_id": "ruby-xss-001",
|
|
"file": "ruby/xss/xss_html_safe.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"html-safe",
|
|
"xss"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS via html_safe on user-controlled input"
|
|
},
|
|
{
|
|
"case_id": "ruby-xss-002",
|
|
"file": "ruby/xss/xss_raw.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"raw",
|
|
"xss"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS via raw() on user-controlled input"
|
|
},
|
|
{
|
|
"case_id": "js-xss-react-001",
|
|
"file": "javascript/xss/xss_react_dangerously.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"react",
|
|
"dangerouslySetInnerHTML",
|
|
"xss"
|
|
],
|
|
"disabled": false,
|
|
"notes": "React XSS via dangerouslySetInnerHTML with user-controlled content"
|
|
},
|
|
{
|
|
"case_id": "js-safe-parseInt-001",
|
|
"file": "javascript/safe/safe_parseInt.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"parseInt",
|
|
"type-coercion",
|
|
"sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "parseInt sanitizes user input \u2014 should produce no taint finding"
|
|
},
|
|
{
|
|
"case_id": "py-cmdi-popen-001",
|
|
"file": "python/cmdi/cmdi_popen_shell.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"subprocess",
|
|
"popen",
|
|
"shell-true",
|
|
"gated-sink"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Command injection via subprocess.Popen with shell=True"
|
|
},
|
|
{
|
|
"case_id": "py-safe-int-001",
|
|
"file": "python/safe/safe_int_cast.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"int",
|
|
"type-coercion",
|
|
"sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "int() type coercion sanitizes user input \u2014 should produce no taint finding"
|
|
},
|
|
{
|
|
"case_id": "java-sqli-stmt-001",
|
|
"file": "java/sqli/sqli_statement_vs_prepared.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"state-resource-leak"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"statement",
|
|
"executeQuery",
|
|
"string-concat"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via raw Statement.executeQuery with string concatenation"
|
|
},
|
|
{
|
|
"case_id": "java-safe-prepared-001",
|
|
"file": "java/safe/safe_prepared_statement.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"prepareStatement",
|
|
"parameterized",
|
|
"sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "prepareStatement sanitizes SQL input \u2014 should produce no SQL taint finding"
|
|
},
|
|
{
|
|
"case_id": "go-safe-atoi-001",
|
|
"file": "go/safe/safe_strconv_atoi.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"strconv",
|
|
"Atoi",
|
|
"type-conversion",
|
|
"sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "strconv.Atoi sanitizes user input \u2014 should produce no taint finding"
|
|
},
|
|
{
|
|
"case_id": "go-xss-gin-001",
|
|
"file": "go/xss/xss_gin_source.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"gin",
|
|
"xss",
|
|
"formvalue"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS via r.FormValue flowing to fmt.Fprintf response writer"
|
|
},
|
|
{
|
|
"case_id": "php-safe-filter-001",
|
|
"file": "php/safe/safe_filter_input.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"filter_input",
|
|
"sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "filter_input sanitizes user input \u2014 should produce no taint finding"
|
|
},
|
|
{
|
|
"case_id": "php-sqli-pdo-001",
|
|
"file": "php/sqli/sqli_pdo_raw.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
2,
|
|
2
|
|
]
|
|
],
|
|
"tags": [
|
|
"pdo",
|
|
"raw-query",
|
|
"sqli"
|
|
],
|
|
"disabled": false,
|
|
"notes": "SQL injection via raw PDO query with string concatenation"
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-strong-params-001",
|
|
"file": "ruby/safe/safe_strong_params.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"strong-params",
|
|
"permit",
|
|
"require",
|
|
"rails"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Rails strong parameters (permit/require) sanitize user input \u2014 safe pattern"
|
|
},
|
|
{
|
|
"case_id": "ruby-sqli-raw-001",
|
|
"file": "ruby/sqli/sqli_raw_connection.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"tags": [
|
|
"connection-execute",
|
|
"raw-sql",
|
|
"sqli"
|
|
],
|
|
"disabled": true,
|
|
"notes": "SQL injection via ActiveRecord connection.execute \u2014 disabled: multi-line call expression not resolved by SSA lowering for Ruby class methods"
|
|
},
|
|
{
|
|
"case_id": "py-cmdi-cross-001",
|
|
"file": "python/cmdi/cross_propagation/",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"py.cmdi.os_system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"cross-file",
|
|
"ssa-summary",
|
|
"propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file taint propagation: env source \u2192 wrapper function \u2192 os.system sink"
|
|
},
|
|
{
|
|
"case_id": "py-cmdi-cross-002",
|
|
"file": "python/cmdi/cross_source/",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"py.cmdi.subprocess"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"cross-file",
|
|
"ssa-summary",
|
|
"source-detection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file source detection: read_input() returns env source \u2192 subprocess.call sink"
|
|
},
|
|
{
|
|
"case_id": "py-cmdi-cross-003",
|
|
"file": "python/cmdi/cross_sanitizer/",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"py.cmdi.os_system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"cross-file",
|
|
"ssa-summary",
|
|
"wrong-sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file wrong-cap sanitizer: HTML sanitizer does not strip SHELL_ESCAPE caps \u2192 os.system still vulnerable"
|
|
},
|
|
{
|
|
"case_id": "py-cmdi-cross-004",
|
|
"file": "python/cmdi/cross_indirect_sink/",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"py.cmdi.os_system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_call_site_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"cross-file",
|
|
"helper-function",
|
|
"sink-in-helper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file sink-in-helper: app.py line 6 reads env source, line 7 calls run_cmd() (cross-file call), helper.py line 5 is the real os.system sink. Phase 3 attribution must report helper.py:5 as the primary location (not app.py:7) and include app.py:7 in flow_steps as a Call step."
|
|
},
|
|
{
|
|
"case_id": "js-xss-cross-001",
|
|
"file": "javascript/xss/cross_propagation/",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"js.xss.document_write"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"cross-file",
|
|
"ssa-summary",
|
|
"propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file taint propagation: req.query \u2192 render wrapper \u2192 document.write XSS sink"
|
|
},
|
|
{
|
|
"case_id": "go-cmdi-cross-001",
|
|
"file": "go/cmdi/cross_source/",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"go.cmdi.exec_command",
|
|
"state-unauthed-access"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"cross-file",
|
|
"ssa-summary",
|
|
"source-detection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file source detection: GetUserInput returns request param \u2192 exec.Command sink"
|
|
},
|
|
{
|
|
"case_id": "go-path_traversal-cross-001",
|
|
"file": "go/path_traversal/cross_sanitizer/",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"go.path_traversal.readfile",
|
|
"state-unauthed-access"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"cross-file",
|
|
"ssa-summary",
|
|
"wrong-sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file wrong-cap sanitizer: HTML sanitizer does not strip FILE_IO caps \u2192 os.ReadFile still vulnerable"
|
|
},
|
|
{
|
|
"case_id": "c-cmdi-001",
|
|
"file": "c/cmdi/cmdi_system.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.cmdi.system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to system()"
|
|
},
|
|
{
|
|
"case_id": "c-cmdi-002",
|
|
"file": "c/cmdi/cmdi_popen.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.cmdi.popen"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to popen()"
|
|
},
|
|
{
|
|
"case_id": "c-cmdi-003",
|
|
"file": "c/cmdi/cmdi_exec.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.cmdi.execvp"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to execvp()"
|
|
},
|
|
{
|
|
"case_id": "c-cmdi-004",
|
|
"file": "c/cmdi/cmdi_fgets.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.cmdi.system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"stdin",
|
|
"fgets"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Flow from fgets(stdin) to system()"
|
|
},
|
|
{
|
|
"case_id": "c-path-001",
|
|
"file": "c/path_traversal/path_traversal_fopen.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.file_io.fopen"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to fopen()"
|
|
},
|
|
{
|
|
"case_id": "c-path-002",
|
|
"file": "c/path_traversal/path_traversal_open.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.file_io.open"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to open()"
|
|
},
|
|
{
|
|
"case_id": "c-fmt-001",
|
|
"file": "c/fmt_string/fmt_printf.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "fmt_string",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.fmt_string.printf"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to printf() as format string"
|
|
},
|
|
{
|
|
"case_id": "c-fmt-002",
|
|
"file": "c/fmt_string/fmt_fprintf.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "fmt_string",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.fmt_string.fprintf"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to fprintf() as format string"
|
|
},
|
|
{
|
|
"case_id": "c-ssrf-001",
|
|
"file": "c/ssrf/ssrf_curl.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.ssrf.curl_easy_perform"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"curl"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to curl_easy_perform()"
|
|
},
|
|
{
|
|
"case_id": "c-buf-001",
|
|
"file": "c/buffer_overflow/buffer_sprintf.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "buffer_overflow",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.buffer.sprintf"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to unbounded sprintf()"
|
|
},
|
|
{
|
|
"case_id": "c-buf-002",
|
|
"file": "c/buffer_overflow/buffer_strcpy.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "buffer_overflow",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.buffer.strcpy"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to strcpy()"
|
|
},
|
|
{
|
|
"case_id": "c-buf-003",
|
|
"file": "c/buffer_overflow/buffer_strcat.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "buffer_overflow",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"c.buffer.strcat"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to strcat()"
|
|
},
|
|
{
|
|
"case_id": "c-buf-005",
|
|
"file": "c/buffer_overflow/buffer_strcpy_user_arg.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "buffer_overflow",
|
|
"cwe": "CWE-120",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"c.memory.strcpy"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"direct",
|
|
"argv",
|
|
"real-repo-precision-2026-04-28"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart to c-safe-017: argv[1] is a non-literal source so Layer D does not suppress; pattern rule fires."
|
|
},
|
|
{
|
|
"case_id": "c-safe-001",
|
|
"file": "c/safe/safe_constant.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant string passed to system() \u2014 no taint source"
|
|
},
|
|
{
|
|
"case_id": "c-safe-002",
|
|
"file": "c/safe/safe_sanitized_snprintf.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"snprintf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through snprintf bounded formatting"
|
|
},
|
|
{
|
|
"case_id": "c-safe-003",
|
|
"file": "c/safe/safe_atoi.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"atoi"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through atoi() type conversion"
|
|
},
|
|
{
|
|
"case_id": "c-safe-004",
|
|
"file": "c/safe/safe_reassigned.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"reassigned"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable reassigned to constant before use"
|
|
},
|
|
{
|
|
"case_id": "c-safe-005",
|
|
"file": "c/safe/safe_strncpy.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"strncpy"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through bounded strncpy"
|
|
},
|
|
{
|
|
"case_id": "c-safe-006",
|
|
"file": "c/safe/safe_validated.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"validated",
|
|
"path-check"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path validated against traversal before fopen"
|
|
},
|
|
{
|
|
"case_id": "c-safe-007",
|
|
"file": "c/safe/safe_strtol.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"strtol"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through strtol() type conversion"
|
|
},
|
|
{
|
|
"case_id": "c-safe-008",
|
|
"file": "c/safe/safe_sanitize_func.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"custom-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through sanitize_input() helper"
|
|
},
|
|
{
|
|
"case_id": "cpp-cmdi-001",
|
|
"file": "cpp/cmdi/cmdi_system.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.cmdi.system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to system()"
|
|
},
|
|
{
|
|
"case_id": "cpp-cmdi-002",
|
|
"file": "cpp/cmdi/cmdi_popen.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.cmdi.popen"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to popen()"
|
|
},
|
|
{
|
|
"case_id": "cpp-cmdi-003",
|
|
"file": "cpp/cmdi/cmdi_getline.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.cmdi.system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"stdin",
|
|
"getline"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Flow from std::getline(cin) to system()"
|
|
},
|
|
{
|
|
"case_id": "cpp-cmdi-004",
|
|
"file": "cpp/cmdi/cmdi_exec.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.cmdi.execvp"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to execvp()"
|
|
},
|
|
{
|
|
"case_id": "cpp-cmdi-005",
|
|
"file": "cpp/cmdi/cmdi_stl_vector_string.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
17,
|
|
17
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"tags": [
|
|
"stl-container",
|
|
"c_str-passthrough",
|
|
"cpp-precision-2026-04-26"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted env var stored in std::vector<std::string>, read via front() and converted via c_str(); flow must reach system()"
|
|
},
|
|
{
|
|
"case_id": "cpp-cmdi-006",
|
|
"file": "cpp/cmdi/cmdi_lambda_passthrough.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
16,
|
|
16
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
14,
|
|
14
|
|
]
|
|
],
|
|
"tags": [
|
|
"lambda",
|
|
"passthrough",
|
|
"cpp-precision-2026-04-26"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted input passed through identity-lambda echo into system(); default Call-arg propagation carries the taint."
|
|
},
|
|
{
|
|
"case_id": "cpp-cmdi-007",
|
|
"file": "cpp/cmdi/cmdi_class_inline_method.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
20,
|
|
27
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
25,
|
|
25
|
|
]
|
|
],
|
|
"tags": [
|
|
"class-method",
|
|
"inline-definition",
|
|
"cpp-precision-2026-04-26"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Inline member-function definition; tainted arg flows through Inner::run into system(). Pinned by Phase 4 KINDS additions for class_specifier."
|
|
},
|
|
{
|
|
"case_id": "cpp-path-001",
|
|
"file": "cpp/path_traversal/path_traversal_fopen.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.file_io.fopen"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to fopen()"
|
|
},
|
|
{
|
|
"case_id": "cpp-path-002",
|
|
"file": "cpp/path_traversal/path_traversal_open.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.file_io.open"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to open()"
|
|
},
|
|
{
|
|
"case_id": "cpp-fmt-001",
|
|
"file": "cpp/fmt_string/fmt_printf.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "fmt_string",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.fmt_string.printf"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to printf() as format string"
|
|
},
|
|
{
|
|
"case_id": "cpp-fmt-002",
|
|
"file": "cpp/fmt_string/fmt_fprintf.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "fmt_string",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.fmt_string.fprintf"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to fprintf() as format string"
|
|
},
|
|
{
|
|
"case_id": "cpp-ssrf-001",
|
|
"file": "cpp/ssrf/ssrf_curl.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.ssrf.curl_easy_perform"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"curl"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to curl_easy_perform()"
|
|
},
|
|
{
|
|
"case_id": "cpp-ssrf-002",
|
|
"file": "cpp/ssrf/ssrf_connect.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.ssrf.connect"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
13,
|
|
13
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"socket"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to connect()"
|
|
},
|
|
{
|
|
"case_id": "cpp-ssrf-003",
|
|
"file": "cpp/ssrf/ssrf_builder_user_host.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
24,
|
|
24
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
23,
|
|
23
|
|
]
|
|
],
|
|
"tags": [
|
|
"builder-chain",
|
|
"fluent-api",
|
|
"cpp-precision-2026-04-26"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted host through fluent Socket::builder().host(h).port(p).connect() chain; terminal connect() must fire."
|
|
},
|
|
{
|
|
"case_id": "cpp-buf-001",
|
|
"file": "cpp/buffer_overflow/buffer_sprintf.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "buffer_overflow",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.buffer.sprintf"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to unbounded sprintf()"
|
|
},
|
|
{
|
|
"case_id": "cpp-buf-002",
|
|
"file": "cpp/buffer_overflow/buffer_strcpy.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "buffer_overflow",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cpp.buffer.strcpy"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"getenv"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from getenv to strcpy()"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-001",
|
|
"file": "cpp/safe/safe_constant.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant string passed to system() \u2014 no taint source"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-002",
|
|
"file": "cpp/safe/safe_snprintf.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"snprintf"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through snprintf bounded formatting"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-003",
|
|
"file": "cpp/safe/safe_stoi.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"stoi"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through std::stoi() type conversion"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-004",
|
|
"file": "cpp/safe/safe_reassigned.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"reassigned"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable reassigned to constant before use"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-005",
|
|
"file": "cpp/safe/safe_strncpy.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-120",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"strncpy"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through bounded strncpy"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-006",
|
|
"file": "cpp/safe/safe_validated.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"validated",
|
|
"path-check"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path validated against traversal before fopen"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-007",
|
|
"file": "cpp/safe/safe_sanitize_func.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"custom-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through sanitize_input() helper"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-008",
|
|
"file": "cpp/safe/safe_strtol.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-134",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"strtol"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through strtol() type conversion (C-style)"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-017",
|
|
"file": "cpp/safe/safe_stl_vector_int.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"stl-container",
|
|
"cpp-precision-2026-04-26"
|
|
],
|
|
"disabled": false,
|
|
"notes": "stoi sanitises tainted env var before push_back / front; downstream system() must be TN"
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-018",
|
|
"file": "cpp/safe/safe_builder_const_host.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"safe",
|
|
"builder-chain",
|
|
"constant-host",
|
|
"cpp-precision-2026-04-26"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Builder chain with hardcoded host literal; terminal connect() must NOT fire (no taint on chain)."
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-019",
|
|
"file": "cpp/safe/safe_reinterpret_cast_byte_pointer.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-704",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cpp.memory.reinterpret_cast"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"safe",
|
|
"reinterpret-cast",
|
|
"byte-pointer",
|
|
"real-repo-precision-2026-05-01"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Layer E: reinterpret_cast<T> targets that are well-defined-by-aliasing-rules (byte pointer / void* / uintptr_t / sockaddr family) must NOT fire cpp.memory.reinterpret_cast. Distilled from bitcoin leveldb/serialization/socket shapes."
|
|
},
|
|
{
|
|
"case_id": "cpp-buf-003",
|
|
"file": "cpp/buffer_overflow/buffer_reinterpret_cast_struct_alias.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "buffer_overflow",
|
|
"cwe": "CWE-704",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"cpp.memory.reinterpret_cast"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"vuln",
|
|
"reinterpret-cast",
|
|
"strict-aliasing",
|
|
"real-repo-precision-2026-05-01"
|
|
],
|
|
"disabled": false,
|
|
"notes": "reinterpret_cast<UserStruct*>(buf) genuinely violates [basic.lval]/11 strict aliasing \u2014 the pattern must continue to fire because the user-defined struct target is not in the byte-pointer / void* / sockaddr safe set."
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-001",
|
|
"file": "rust/cmdi/cmdi_command.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from env::var to Command::new().arg()"
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-002",
|
|
"file": "rust/cmdi/cmdi_command_output.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from env::var to Command::new().output()"
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-003",
|
|
"file": "rust/cmdi/cmdi_indirect.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_call_site_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"tags": [
|
|
"indirect",
|
|
"helper-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Taint flows through helper function to Command"
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-004",
|
|
"file": "rust/cmdi/cmdi_args.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"env-var",
|
|
"args"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from env::var to Command.args()"
|
|
},
|
|
{
|
|
"case_id": "rs-path-001",
|
|
"file": "rust/path_traversal/path_read.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.file_io.read_to_string"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from env::var to fs::read_to_string()"
|
|
},
|
|
{
|
|
"case_id": "rs-path-002",
|
|
"file": "rust/path_traversal/path_write.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.file_io.write"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from env::var to fs::write()"
|
|
},
|
|
{
|
|
"case_id": "rs-path-003",
|
|
"file": "rust/path_traversal/path_file_open.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.file_io.File"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from env::var to File::open()"
|
|
},
|
|
{
|
|
"case_id": "rs-path-004",
|
|
"file": "rust/path_traversal/path_file_create.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.file_io.File"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from env::var to File::create()"
|
|
},
|
|
{
|
|
"case_id": "rs-ssrf-001",
|
|
"file": "rust/ssrf/ssrf_reqwest.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.ssrf.reqwest"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"direct",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Direct flow from env::var to reqwest::get()"
|
|
},
|
|
{
|
|
"case_id": "rs-ssrf-002",
|
|
"file": "rust/ssrf/ssrf_indirect.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.ssrf.reqwest"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"indirect",
|
|
"helper-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Taint flows through helper function to reqwest::get()"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-001",
|
|
"file": "rust/safe/safe_constant.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Constant args passed to Command \u2014 no taint source"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-002",
|
|
"file": "rust/safe/safe_sanitized_shell.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sanitized",
|
|
"shell-escape"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through sanitize_shell() before Command"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-003",
|
|
"file": "rust/safe/safe_reassigned.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"reassigned"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted variable not used \u2014 constant passed to Command"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-004",
|
|
"file": "rust/safe/safe_validated.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"validated",
|
|
"path-check"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path validated against traversal before fs::read_to_string"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-005",
|
|
"file": "rust/safe/safe_hardcoded_url.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Hardcoded URL passed to reqwest::get \u2014 no taint source"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-006",
|
|
"file": "rust/safe/safe_type_check.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"type-check",
|
|
"parse"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input parsed to u32 before constructing path \u2014 type-safe"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-007",
|
|
"file": "rust/safe/safe_interprocedural.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"interprocedural",
|
|
"sanitize-wrapper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input sanitized through interprocedural sanitize_input() call chain"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-008",
|
|
"file": "rust/safe/safe_dominated.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"validated",
|
|
"dominated"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input validated with allowlist check before Command"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-009",
|
|
"file": "rust/safe/safe_shell_metachar.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"validated",
|
|
"shell-metachar"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input rejected when containing shell metacharacters before Command"
|
|
},
|
|
{
|
|
"case_id": "rs-sqli-002",
|
|
"file": "rust/sqli/sqli_metachar_gate_wrong_sink.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
13,
|
|
13
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"sqli",
|
|
"shell-metachar-gate"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Shell-metachar rejection is not a SQL sanitizer; SQL injection must still fire"
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-005",
|
|
"file": "rust/cmdi/cmdi_format_macro.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"format-macro",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted input interpolated via format!() into sh -c"
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-006",
|
|
"file": "rust/cmdi/cmdi_match_source.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"match-expression",
|
|
"env-var"
|
|
],
|
|
"disabled": false,
|
|
"notes": "env::var bound via match expression then used as Command program name"
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-007",
|
|
"file": "rust/cmdi/cmdi_string_concat.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"string-concat",
|
|
"binary-op"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted &str concatenated via + into sh -c argument"
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-008",
|
|
"file": "rust/cmdi/cmdi_static_map_dangerous.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
14,
|
|
14
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"hashmap",
|
|
"static-lookup",
|
|
"dangerous-literal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Static HashMap where one inserted value carries shell metacharacters \u2014 finite-set suppression must NOT clear this sink"
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-009",
|
|
"file": "rust/cmdi/cmdi_indirect_multisink.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
11
|
|
]
|
|
],
|
|
"expected_call_site_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"tags": [
|
|
"indirect",
|
|
"helper-function",
|
|
"multisink"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Helper run_both takes two tainted params and invokes two Command sinks on consecutive lines (5, 6). Phase 3 attribution must land each finding's primary line inside the helper, not at the call site (line 12). NOTE: the summary currently stores one SinkSite per callee so both findings may collapse onto the same helper line today \u2014 the \u00b12 sink range and the call-site assertion guard against regression to caller-attribution regardless."
|
|
},
|
|
{
|
|
"case_id": "rs-cmdi-cross-001",
|
|
"file": "rust/cmdi/cross_propagation/",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.cmdi.command"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_call_site_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"cross-file",
|
|
"propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file taint: main.rs line 7 env::var \u2192 transform::wrap at line 8 \u2192 Command::new at line 9. Sink is the top-level Command::new; transform::wrap is a cross-file propagator, not a sink."
|
|
},
|
|
{
|
|
"case_id": "rs-path-005",
|
|
"file": "rust/path_traversal/path_remove.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.file_io.remove_file"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"filesystem",
|
|
"remove",
|
|
"known-gap"
|
|
],
|
|
"disabled": false,
|
|
"notes": "fs::remove_file not in Rust sink rules \u2014 known FN coverage"
|
|
},
|
|
{
|
|
"case_id": "rs-ssrf-003",
|
|
"file": "rust/ssrf/ssrf_client_builder.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.ssrf.reqwest"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"tags": [
|
|
"builder-chain",
|
|
"known-gap"
|
|
],
|
|
"disabled": false,
|
|
"notes": "reqwest::Client::new().get(url).send() \u2014 builder chain not matched by reqwest::get/Client.execute sinks"
|
|
},
|
|
{
|
|
"case_id": "rs-sqli-001",
|
|
"file": "rust/sqli/sqli_rusqlite_format.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.sqli.rusqlite"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"rusqlite",
|
|
"format-macro",
|
|
"known-gap"
|
|
],
|
|
"disabled": false,
|
|
"notes": "rusqlite::Connection.execute not in Rust sink rules \u2014 SQLi class has no Rust coverage"
|
|
},
|
|
{
|
|
"case_id": "rs-deser-001",
|
|
"file": "rust/deser/deser_serde_yaml.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deser",
|
|
"cwe": "CWE-502",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.deser.serde_yaml"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"serde",
|
|
"yaml",
|
|
"known-gap"
|
|
],
|
|
"disabled": false,
|
|
"notes": "serde_yaml::from_str not in Rust sink rules \u2014 deserialization class has no Rust coverage"
|
|
},
|
|
{
|
|
"case_id": "rs-xss-001",
|
|
"file": "rust/xss/axum_html/",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"rust.xss.axum_html"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
3,
|
|
3
|
|
]
|
|
],
|
|
"tags": [
|
|
"framework",
|
|
"axum",
|
|
"html"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Axum Path<String> \u2192 Html(format!(...)) \u2014 requires framework rules (Cargo.toml present)"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-009",
|
|
"file": "rust/safe/safe_match_guard.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"match-guard",
|
|
"validated"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Match guard restricts input to ASCII alphanumeric before Command"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-010",
|
|
"file": "rust/safe/safe_static_map_lookup.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"hashmap",
|
|
"static-lookup"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tainted key indexes static HashMap \u2014 value is hardcoded, not tainted"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-011",
|
|
"file": "rust/safe/safe_parsed_port.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"type-parse",
|
|
"u16"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Input parsed to u16 before use as Command arg \u2014 type-narrowed"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-012",
|
|
"file": "rust/safe/safe_path_contains_dotdot.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-regression",
|
|
"path-sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Intraprocedural .contains(\"..\") + .starts_with('/') rejection \u2014 PathFact narrows dotdot and absolute axes on the sanitised branch"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-015",
|
|
"file": "rust/safe/safe_path_is_absolute.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-regression",
|
|
"path-sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Path::new(x).is_absolute() rejection + .contains(\"..\") \u2014 PathFact narrows both axes via typed check and substring rejection"
|
|
},
|
|
{
|
|
"case_id": "rs-path-006",
|
|
"file": "rust/traversal/traversal_no_sanitizer.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"tags": [
|
|
"pathfact-regression",
|
|
"negative-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "No sanitiser applied \u2014 PathFact stays Top, FILE_IO sink must fire (guards against over-suppression)"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-cross-001",
|
|
"file": "rust/cmdi/cross_sanitizer/",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"cross-file",
|
|
"sanitizer"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-file: sanitize_shell in sanitizer.rs clears SHELL_ESCAPE cap before Command"
|
|
},
|
|
{
|
|
"case_id": "js-interproc-safe-001",
|
|
"file": "javascript/interprocedural/interproc_sanitizer_wrap.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"interprocedural",
|
|
"sanitizer-wrapper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS safe: input sanitized through encodeURIComponent wrapper function"
|
|
},
|
|
{
|
|
"case_id": "py-interproc-safe-001",
|
|
"file": "python/interprocedural/interproc_sanitizer_wrap.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"interprocedural",
|
|
"sanitizer-wrapper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS safe: input sanitized through html.escape wrapper function"
|
|
},
|
|
{
|
|
"case_id": "java-interproc-safe-001",
|
|
"file": "java/interprocedural/InterprocSanitizerWrap.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"interprocedural",
|
|
"sanitizer-wrapper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS safe: input sanitized through HtmlUtils.htmlEscape wrapper"
|
|
},
|
|
{
|
|
"case_id": "go-interproc-safe-001",
|
|
"file": "go/interprocedural/interproc_sanitizer_wrap.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"interprocedural",
|
|
"sanitizer-wrapper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS safe: input sanitized through html.EscapeString wrapper function"
|
|
},
|
|
{
|
|
"case_id": "php-interproc-safe-001",
|
|
"file": "php/interprocedural/interproc_sanitizer_wrap.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"interprocedural",
|
|
"sanitizer-wrapper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS safe: input sanitized through htmlspecialchars wrapper function"
|
|
},
|
|
{
|
|
"case_id": "rb-interproc-safe-001",
|
|
"file": "ruby/interprocedural/interproc_sanitizer_wrap.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"interprocedural",
|
|
"sanitizer-wrapper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "XSS safe: input sanitized through CGI.escapeHTML wrapper function"
|
|
},
|
|
{
|
|
"case_id": "js-interproc-001",
|
|
"file": "javascript/interprocedural/interproc_taint_propagation.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"js.cmdi.exec"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"tags": [
|
|
"interprocedural",
|
|
"taint-propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Taint flows through buildCommand() helper to exec()"
|
|
},
|
|
{
|
|
"case_id": "py-interproc-001",
|
|
"file": "python/interprocedural/interproc_taint_propagation.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"py.cmdi.system"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"interprocedural",
|
|
"taint-propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Taint flows through build_command() helper to os.system()"
|
|
},
|
|
{
|
|
"case_id": "java-interproc-001",
|
|
"file": "java/interprocedural/InterprocTaintPropagation.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"java.sqli.executeQuery"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"tags": [
|
|
"interprocedural",
|
|
"taint-propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Taint flows through buildQuery() helper to executeQuery()"
|
|
},
|
|
{
|
|
"case_id": "go-interproc-001",
|
|
"file": "go/interprocedural/interproc_taint_propagation.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"go.sqli.query"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
16,
|
|
16
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
14,
|
|
14
|
|
]
|
|
],
|
|
"tags": [
|
|
"interprocedural",
|
|
"taint-propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Taint flows through buildQuery() helper to db.Query()"
|
|
},
|
|
{
|
|
"case_id": "php-interproc-001",
|
|
"file": "php/interprocedural/interproc_taint_propagation.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"php.sqli.mysqli_query"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"interprocedural",
|
|
"taint-propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Taint flows through build_query() helper to mysqli_query()"
|
|
},
|
|
{
|
|
"case_id": "rb-interproc-001",
|
|
"file": "ruby/interprocedural/interproc_taint_propagation.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"ruby.sqli.select_all"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"interprocedural",
|
|
"taint-propagation"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Taint flows through build_query() helper to select_all()"
|
|
},
|
|
{
|
|
"case_id": "js-pathprune-safe-001",
|
|
"file": "javascript/path_pruning/safe_early_return.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"path-pruning",
|
|
"early-return",
|
|
"allowlist"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Command execution gated by allowlist check with early return"
|
|
},
|
|
{
|
|
"case_id": "py-pathprune-safe-001",
|
|
"file": "python/path_pruning/safe_early_return.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"path-pruning",
|
|
"early-return",
|
|
"allowlist"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Command execution gated by allowlist check with early return"
|
|
},
|
|
{
|
|
"case_id": "go-pathprune-safe-001",
|
|
"file": "go/path_pruning/safe_early_return.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"path-pruning",
|
|
"early-return",
|
|
"allowlist"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Command execution gated by allowlist check with early return"
|
|
},
|
|
{
|
|
"case_id": "ts-xss-001",
|
|
"file": "typescript/xss/xss_typed_innerhtml.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"innerHTML",
|
|
"typed-express",
|
|
"reflected"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Baseline TS XSS: typed Express handler flows req.query into innerHTML"
|
|
},
|
|
{
|
|
"case_id": "ts-xss-002",
|
|
"file": "typescript/xss/xss_as_any_cast.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"ts.quality.as_any"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"as-any",
|
|
"type-assertion",
|
|
"innerHTML"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TS-specific: taint must flow through `as any` and chained assertions (as_expression\u2192Kind::Seq)"
|
|
},
|
|
{
|
|
"case_id": "ts-xss-003",
|
|
"file": "typescript/xss/xss_generic_identity.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"generics",
|
|
"interprocedural",
|
|
"innerHTML"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Tests Phase 11 inline context-sensitivity through generic identity<T> function"
|
|
},
|
|
{
|
|
"case_id": "ts-xss-004",
|
|
"file": "typescript/xss/xss_optional_chain_source.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"optional-chain",
|
|
"adversarial-source",
|
|
"innerHTML"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Adversarial: optional-chained source `req?.query?.name`. Tests whether the source matcher survives optional_chain_expression nodes. Expected FN until optional chaining is lowered to member access in labeling"
|
|
},
|
|
{
|
|
"case_id": "ts-xss-005",
|
|
"file": "typescript/xss/xss_dangerously_set_inner_html.tsx",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"tsx",
|
|
"jsx",
|
|
"dangerouslySetInnerHTML"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TSX fixture: user bio flows into `dangerouslySetInnerHTML` and is sent via res.send. Exercises TSX grammar wiring (LANGUAGE_TSX) and confirms taint propagation through JSX expressions"
|
|
},
|
|
{
|
|
"case_id": "ts-sqli-001",
|
|
"file": "typescript/sqli/sqli_template_literal.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"sqli",
|
|
"pg",
|
|
"template-literal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Template-literal SQL via pg Pool.query; exact SQL_QUERY sink match"
|
|
},
|
|
{
|
|
"case_id": "ts-sqli-002",
|
|
"file": "typescript/sqli/sqli_prisma_raw.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"sqli",
|
|
"prisma",
|
|
"queryRawUnsafe"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Prisma $queryRawUnsafe \u2014 TS-specific ORM sink"
|
|
},
|
|
{
|
|
"case_id": "ts-sqli-003",
|
|
"file": "typescript/sqli/sqli_db_query_concat.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"sqli",
|
|
"real-repo-precision-2026-04-29",
|
|
"regression-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart for ts-safe-017 \u2014 bare `connection.query(`SELECT...`)` and chained `db.query(SQL).then(...)` (Promise method, not ORM accessor) must still fire as SQL_QUERY sinks even after the ORM-chain recogniser landed."
|
|
},
|
|
{
|
|
"case_id": "ts-cmdi-001",
|
|
"file": "typescript/cmdi/cmdi_exec_template.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"cmdi",
|
|
"child_process",
|
|
"template-literal"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Destructured exec with template literal command from req.body"
|
|
},
|
|
{
|
|
"case_id": "ts-cmdi-002",
|
|
"file": "typescript/cmdi/cmdi_async_wrapper.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"tags": [
|
|
"cmdi",
|
|
"async",
|
|
"promisify",
|
|
"execAsync"
|
|
],
|
|
"disabled": false,
|
|
"notes": "promisify-wrapped exec (execAsync) \u2014 TS rules enumerate execAsync as a command sink"
|
|
},
|
|
{
|
|
"case_id": "ts-ssrf-001",
|
|
"file": "typescript/ssrf/ssrf_axios_user_url.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"ssrf",
|
|
"axios"
|
|
],
|
|
"disabled": false,
|
|
"notes": "axios.get with req.query.url \u2014 baseline TS SSRF"
|
|
},
|
|
{
|
|
"case_id": "ts-ssrf-002",
|
|
"file": "typescript/ssrf/ssrf_fastify_fetch.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"ssrf",
|
|
"fastify",
|
|
"framework-rules",
|
|
"adversarial-framework"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Fastify framework route \u2014 exercises framework_rules(ctx) source detection for request.query. Expected FN when framework context is not detected from a single file (no package.json)"
|
|
},
|
|
{
|
|
"case_id": "ts-ssrf-003",
|
|
"file": "typescript/ssrf/ssrf_encoded_host.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"ssrf",
|
|
"axios",
|
|
"url-encode",
|
|
"adversarial-fn-guard"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Regression guard for prefix-locked SSRF suppression: encodeURIComponent is applied to the HOST (not path), so the template prefix 'https://' does not lock the destination. Must still fire as SSRF \u2014 proves the StringFact host check does not over-suppress when the attacker controls the authority component"
|
|
},
|
|
{
|
|
"case_id": "ts-code_injection-001",
|
|
"file": "typescript/code_injection/code_exec_eval.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"ts.code_exec.eval"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"eval",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Classic eval + user input; AST pattern ts.code_exec.eval applies"
|
|
},
|
|
{
|
|
"case_id": "ts-code_injection-002",
|
|
"file": "typescript/code_injection/code_exec_new_function.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_injection",
|
|
"cwe": "CWE-94",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"ts.code_exec.new_function"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"new-function",
|
|
"code-injection"
|
|
],
|
|
"disabled": false,
|
|
"notes": "new Function(body) \u2014 AST pattern ts.code_exec.new_function"
|
|
},
|
|
{
|
|
"case_id": "ts-open_redirect-001",
|
|
"file": "typescript/open_redirect/location_href.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-601",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"ts.xss.location_assign"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"open-redirect",
|
|
"location-href"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Open redirect via location.href = userUrl"
|
|
},
|
|
{
|
|
"case_id": "ts-path_traversal-001",
|
|
"file": "typescript/path_traversal/path_traversal_sendfile.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"path-traversal",
|
|
"sendFile"
|
|
],
|
|
"disabled": false,
|
|
"notes": "res.sendFile with unsanitized req.query.path"
|
|
},
|
|
{
|
|
"case_id": "ts-crypto-001",
|
|
"file": "typescript/crypto/weak_hash_md5.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "crypto",
|
|
"cwe": "CWE-327",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"ts.crypto.weak_hash_import"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"ts.crypto.weak_hash"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"crypto",
|
|
"weak-hash",
|
|
"md5"
|
|
],
|
|
"disabled": false,
|
|
"notes": "md5() imported from the md5 package \u2014 AST pattern ts.crypto.weak_hash_import"
|
|
},
|
|
{
|
|
"case_id": "ts-secrets-001",
|
|
"file": "typescript/secrets/fallback_secret.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "secrets",
|
|
"cwe": "CWE-798",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"ts.secrets.fallback_secret"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"ts.secrets.hardcoded_secret"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"secrets",
|
|
"fallback-env"
|
|
],
|
|
"disabled": false,
|
|
"notes": "process.env.KEY || 'hardcoded' \u2014 AST pattern ts.secrets.fallback_secret"
|
|
},
|
|
{
|
|
"case_id": "ts-insecure_config-001",
|
|
"file": "typescript/insecure_config/reject_unauthorized.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "insecure_config",
|
|
"cwe": "CWE-295",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"ts.config.reject_unauthorized"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"tls",
|
|
"reject-unauthorized"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TLS verification disabled \u2014 AST pattern"
|
|
},
|
|
{
|
|
"case_id": "ts-insecure_config-002",
|
|
"file": "typescript/insecure_config/cookie_httponly.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "insecure_config",
|
|
"cwe": "CWE-1004",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"ts.config.insecure_session_httponly"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"cookies",
|
|
"httpOnly"
|
|
],
|
|
"disabled": false,
|
|
"notes": "session cookie httpOnly: false \u2014 AST pattern"
|
|
},
|
|
{
|
|
"case_id": "ts-prototype-001",
|
|
"file": "typescript/prototype/proto_assignment.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "prototype",
|
|
"cwe": "CWE-1321",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"ts.prototype.proto_assignment"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
4,
|
|
4
|
|
]
|
|
],
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"prototype-pollution"
|
|
],
|
|
"disabled": false,
|
|
"notes": "__proto__ write \u2014 AST pattern"
|
|
},
|
|
{
|
|
"case_id": "ts-interproc-001",
|
|
"file": "typescript/interprocedural/interproc_class_method.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
17,
|
|
17
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
15,
|
|
15
|
|
]
|
|
],
|
|
"tags": [
|
|
"cmdi",
|
|
"class-method",
|
|
"interprocedural"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Class method builder: Runner.build concatenates tainted target, caller passes result to exec. Stresses intra-file class-method call resolution"
|
|
},
|
|
{
|
|
"case_id": "ts-type_system-001",
|
|
"file": "typescript/type_system/discriminated_union_narrow.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
13,
|
|
13
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"tags": [
|
|
"discriminated-union",
|
|
"narrowing",
|
|
"cmdi"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TS discriminated-union narrowing (kind === 'ping') does not sanitize \u2014 a.target is still user-controlled. Guards against the FP of treating `kind` guards as security sanitizers"
|
|
},
|
|
{
|
|
"case_id": "ts-type_system-002",
|
|
"file": "typescript/type_system/interface_dispatch.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
],
|
|
[
|
|
20,
|
|
20
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
19,
|
|
19
|
|
]
|
|
],
|
|
"tags": [
|
|
"interface",
|
|
"dispatch",
|
|
"adversarial-interprocedural",
|
|
"cmdi"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Interface-typed receiver `impl: Runner` \u2192 resolve to ShellRunner.run \u2192 exec. Tests intra-file method resolution through interface types; expected FN if only normalized callee-name matching is used"
|
|
},
|
|
{
|
|
"case_id": "ts-type_system-003",
|
|
"file": "typescript/type_system/decorator_passthrough.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "language_specific",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
15,
|
|
15
|
|
],
|
|
[
|
|
23,
|
|
23
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
23,
|
|
23
|
|
]
|
|
],
|
|
"tags": [
|
|
"decorator",
|
|
"adversarial-decorator",
|
|
"cmdi"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Method decorator wraps Service.run; the undecorated body still contains exec(cmd). Tests whether decorator syntax interferes with class-method extraction. Expected FN if decorator parsing derails summary extraction"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-001",
|
|
"file": "typescript/safe/safe_dompurify.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"dompurify"
|
|
],
|
|
"disabled": false,
|
|
"notes": "DOMPurify.sanitize inline before innerHTML"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-002",
|
|
"file": "typescript/safe/safe_number_coerce.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"type-coercion",
|
|
"Number"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Number() coercion sanitizes SQL integer interpolation; Number is in TS sanitizer rules with Cap::all()"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-003",
|
|
"file": "typescript/safe/safe_encode_uri.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"url-encode",
|
|
"ssrf",
|
|
"adversarial-fp"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Semantically safe: user term is URL-encoded into a fixed-host URL; no SSRF possible. Known Nyx weak spot \u2014 encodeURIComponent is Cap::URL_ENCODE while axios sink is Cap::SSRF, so cap mismatch may yield FP. Documents the cap-overlap limitation"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-004",
|
|
"file": "typescript/safe/safe_hardcoded_url.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"no-source",
|
|
"hardcoded"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Hardcoded URL, no user input; should be a clean TN"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-005",
|
|
"file": "typescript/safe/safe_validator_escape.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"validator"
|
|
],
|
|
"disabled": false,
|
|
"notes": "validator.escape sanitizes XSS payload before innerHTML"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-006",
|
|
"file": "typescript/safe/safe_typeof_guard.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"ts.code_exec.eval"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"type-check",
|
|
"typeof",
|
|
"eval"
|
|
],
|
|
"disabled": false,
|
|
"notes": "typeof === 'number' guards eval; only numbers reach sink. Forbidden ts.code_exec.eval here because the taint flow is gated \u2014 pattern-only detection would be an FP"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-007",
|
|
"file": "typescript/safe/safe_interproc_sanitizer.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"sanitizer",
|
|
"interprocedural",
|
|
"dompurify",
|
|
"adversarial-fp"
|
|
],
|
|
"disabled": false,
|
|
"notes": "DOMPurify wrapped in cleanHtml() helper. Known JS weak spot (js-interproc-safe-001 is an FP); documents whether TS handling matches"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-008",
|
|
"file": "typescript/safe/safe_constant_query.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"constant",
|
|
"no-source"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Compile-time constant SQL; no user input; should TN"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-009",
|
|
"file": "typescript/safe/safe_parameterized.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"parameterized",
|
|
"sqli",
|
|
"adversarial-fp"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Parameterized pg query: SQL string is constant, id flows as $1 placeholder value. Semantically safe but taint still reaches pool.query call; known Nyx limitation \u2014 positional args aren't distinguished for SQL_QUERY sink"
|
|
},
|
|
{
|
|
"case_id": "ts-safe-010",
|
|
"file": "typescript/safe/safe_jsx_text.tsx",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"tsx",
|
|
"jsx",
|
|
"auto-escape"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TSX fixture: user bio rendered as JSX text child. React auto-escapes JSX text so this is semantically safe. Guards against over-flagging JSX expressions now that TSX grammar is wired"
|
|
},
|
|
{
|
|
"case_id": "cve-py-2023-48022-vulnerable",
|
|
"file": "cve_corpus/python/CVE-2023-48022/vulnerable.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.cmdi.os_system"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
31,
|
|
31
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
26,
|
|
27
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"ray",
|
|
"rce",
|
|
"flask"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2023-48022: Ray dashboard job-submission RCE via shell-interpreted entrypoint in os.system. Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-py-2023-48022-patched",
|
|
"file": "cve_corpus/python/CVE-2023-48022/patched.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.cmdi.os_system",
|
|
"py.cmdi.subprocess_shell",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"ray",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2023-48022 patched counterpart: shlex.split + subprocess.Popen(shell=False); regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-js-2019-14939-vulnerable",
|
|
"file": "cve_corpus/javascript/CVE-2019-14939/vulnerable.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_exec",
|
|
"cwe": "CWE-94",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.code_exec.eval"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
30,
|
|
30
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
23,
|
|
25
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"mongo-express",
|
|
"rce",
|
|
"express",
|
|
"eval"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2019-14939: mongo-express /checkValid evaluated req.body.document with eval(); RCE on the admin interface. MIT"
|
|
},
|
|
{
|
|
"case_id": "cve-js-2019-14939-patched",
|
|
"file": "cve_corpus/javascript/CVE-2019-14939/patched.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"js.code_exec.eval",
|
|
"js.code_exec.new_function",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"mongo-express",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2019-14939 patched counterpart: EJSON.parse replaces eval; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-js-2025-64430-vulnerable",
|
|
"file": "cve_corpus/javascript/CVE-2025-64430/vulnerable.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"parse-server",
|
|
"ssrf",
|
|
"express",
|
|
"http-get"
|
|
],
|
|
"notes": "CVE-2025-64430: Parse Server file router fetched user-supplied Parse.File _source.uri via http.get, allowing SSRF. Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-js-2025-64430-patched",
|
|
"file": "cve_corpus/javascript/CVE-2025-64430/patched.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"parse-server",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"notes": "CVE-2025-64430 patched counterpart: URI-backed file upload removed entirely; no http.get on user input"
|
|
},
|
|
{
|
|
"case_id": "cve-ts-2023-26159-vulnerable",
|
|
"file": "cve_corpus/typescript/CVE-2023-26159/vulnerable.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
32,
|
|
32
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
27,
|
|
28
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"follow-redirects",
|
|
"ssrf",
|
|
"express",
|
|
"axios"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2023-26159: follow-redirects leaked Authorization across cross-origin redirects; caller-side pattern is SSRF via unvalidated user URL into HTTP client. MIT"
|
|
},
|
|
{
|
|
"case_id": "cve-ts-2023-26159-patched",
|
|
"file": "cve_corpus/typescript/CVE-2023-26159/patched.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"follow-redirects",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2023-26159 patched counterpart: URL allowlist check guards axios.get; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-ts-ghsa-4x48-cgf9-q33f-vulnerable",
|
|
"file": "cve_corpus/typescript/GHSA-4x48-cgf9-q33f/vulnerable.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
51,
|
|
51
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
50,
|
|
50
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"novu",
|
|
"ssrf",
|
|
"vulnerable"
|
|
],
|
|
"disabled": false,
|
|
"notes": "GHSA-4x48-cgf9-q33f: Novu conditions-filter webhook bypassed validateUrlSsrf; raw axios.post(child.webhookUrl) is the cross-function SSRF sink. MIT-licensed libs/application-generic package."
|
|
},
|
|
{
|
|
"case_id": "cve-ts-ghsa-4x48-cgf9-q33f-patched",
|
|
"file": "cve_corpus/typescript/GHSA-4x48-cgf9-q33f/patched.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"novu",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "GHSA-4x48-cgf9-q33f patched: validateUrlSsrf(child.webhookUrl) followed by `if (ssrfError) throw` guards the axios.post call; regression guard for the indirect-validator branch narrowing + summary all_validated propagation."
|
|
},
|
|
{
|
|
"case_id": "cve-py-2017-18342-vulnerable",
|
|
"file": "cve_corpus/python/CVE-2017-18342/vulnerable.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deserialization",
|
|
"cwe": "CWE-502",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.deser.yaml_load"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
30,
|
|
30
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
26,
|
|
26
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"pyyaml",
|
|
"deserialization",
|
|
"flask"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2017-18342: PyYAML yaml.load default loader instantiated arbitrary Python objects from !!python/object tags; RCE on any app passing untrusted YAML. MIT"
|
|
},
|
|
{
|
|
"case_id": "cve-py-2017-18342-patched",
|
|
"file": "cve_corpus/python/CVE-2017-18342/patched.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.deser.yaml_load",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"pyyaml",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2017-18342 patched counterpart: yaml.safe_load replaces yaml.load; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-py-2025-69662-vulnerable",
|
|
"file": "cve_corpus/python/CVE-2025-69662/vulnerable.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sql_injection",
|
|
"cwe": "CWE-89",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.sqli.text_format"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
43,
|
|
44
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
35,
|
|
35
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"geopandas",
|
|
"sql_injection",
|
|
"flask",
|
|
"sqlalchemy"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2025-69662: geopandas to_postgis() interpolated GeoDataFrame's geometry column name into Find_SRID probe via f-string; SQL injection on user-uploaded layer. BSD-3-Clause"
|
|
},
|
|
{
|
|
"case_id": "cve-py-2025-69662-patched",
|
|
"file": "cve_corpus/python/CVE-2025-69662/patched.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.sqli.text_format",
|
|
"py.sqli.execute_format",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"geopandas",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2025-69662 patched counterpart: text(...).bindparams() replaces f-string interpolation; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-py-2026-33626-vulnerable",
|
|
"file": "cve_corpus/python/CVE-2026-33626/vulnerable.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
49,
|
|
49
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
43,
|
|
43
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"lmdeploy",
|
|
"ssrf",
|
|
"flask",
|
|
"requests"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2026-33626: LMDeploy vision-language image loader fetched user-supplied URLs via requests.Session().get without private-IP guard; SSRF / cloud-metadata exfil. Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-py-2026-33626-patched",
|
|
"file": "cve_corpus/python/CVE-2026-33626/patched.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"lmdeploy",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2026-33626 patched counterpart: _is_safe_url private-IP allowlist gate replaces scheme-only check; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-php-2017-9841-vulnerable",
|
|
"file": "cve_corpus/php/CVE-2017-9841/vulnerable.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_exec",
|
|
"cwe": "CWE-94",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.code_exec.eval"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
22,
|
|
22
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
21,
|
|
21
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"phpunit",
|
|
"rce",
|
|
"eval",
|
|
"stdin"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2017-9841: PHPUnit Util/PHP/eval-stdin.php fed php://input to eval(); mass-scanned for webshell deployment. BSD-3-Clause"
|
|
},
|
|
{
|
|
"case_id": "cve-php-2017-9841-patched",
|
|
"file": "cve_corpus/php/CVE-2017-9841/patched.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"php.code_exec.eval",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"phpunit",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2017-9841 patched counterpart: stub rejects non-CLI SAPI and removes the eval sink entirely; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-php-2018-15133-vulnerable",
|
|
"file": "cve_corpus/php/CVE-2018-15133/vulnerable.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deserialization",
|
|
"cwe": "CWE-502",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.deser.unserialize"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
26,
|
|
26
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
24,
|
|
24
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"laravel",
|
|
"deserialization",
|
|
"cookie"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2018-15133: Laravel <= 5.6.29 unserialized a cookie-borne payload without HMAC verification; known gadget chains reached arbitrary code when APP_KEY leaked. MIT"
|
|
},
|
|
{
|
|
"case_id": "cve-php-2018-15133-patched",
|
|
"file": "cve_corpus/php/CVE-2018-15133/patched.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"php.deser.unserialize",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"laravel",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2018-15133 patched counterpart: HMAC-verified JSON cookie replaces PHP-serialized payload; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-rb-2013-0156-vulnerable",
|
|
"file": "cve_corpus/ruby/CVE-2013-0156/vulnerable.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deserialization",
|
|
"cwe": "CWE-502",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rb.deser.yaml_load"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
28,
|
|
28
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"rails",
|
|
"deserialization",
|
|
"params"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2013-0156: Rails XML params parser round-tripped tagged YAML through YAML.load, instantiating arbitrary Ruby objects; unauthenticated RCE on every affected Rails app. MIT"
|
|
},
|
|
{
|
|
"case_id": "cve-rb-2013-0156-patched",
|
|
"file": "cve_corpus/ruby/CVE-2013-0156/patched.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rb.deser.yaml_load",
|
|
"rb.deser.marshal_load",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"rails",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2013-0156 patched counterpart: params decoded as JSON, no YAML loader on untrusted input; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-rb-2020-8130-vulnerable",
|
|
"file": "cve_corpus/ruby/CVE-2020-8130/vulnerable.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
39,
|
|
39
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"rake",
|
|
"cmdi",
|
|
"kernel-open"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2020-8130: Rake::FileList#egrep opened each filename via Kernel#open, which interprets a leading | as a shell command. Attacker-supplied filenames (build-config / job-runner inputs) thereby achieved arbitrary command execution. Fixed in v12.3.3 by switching to File.open. MIT"
|
|
},
|
|
{
|
|
"case_id": "cve-rb-2020-8130-patched",
|
|
"file": "cve_corpus/ruby/CVE-2020-8130/patched.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"rake",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2020-8130 patched counterpart: open(fn, ...) replaced with File.open(fn, ...); File.open never pipes a leading |. Fixture additionally hardcodes the filename + pattern (patched-fix simplification) so the regression guard is class-clean \u2014 see vulnerable.rb header for rationale."
|
|
},
|
|
{
|
|
"case_id": "cve-rb-2021-21288-vulnerable",
|
|
"file": "cve_corpus/ruby/CVE-2021-21288/vulnerable.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
64,
|
|
64
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
64,
|
|
64
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"carrierwave",
|
|
"ssrf",
|
|
"open-uri"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2021-21288: CarrierWave Downloader::Base#download passed an attacker-controlled URL straight into OpenURI.open_uri (only host-normalised via process_uri). open-uri follows redirects without an allowlist, so any uploader exposing a remote_url field reached internal services / cloud metadata / file:// URIs. Fixed in 2.1.1 / 1.3.2 by routing through SsrfFilter.get. MIT"
|
|
},
|
|
{
|
|
"case_id": "cve-rb-2021-21288-patched",
|
|
"file": "cve_corpus/ruby/CVE-2021-21288/patched.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"carrierwave",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2021-21288 patched counterpart: OpenURI.open_uri replaced with SsrfFilter.get(uri, ...) which validates the resolved host against private IP ranges before issuing the request. The upstream skip_ssrf_protection? escape hatch (default returns false) is omitted as a patched-fix simplification."
|
|
},
|
|
{
|
|
"case_id": "cve-rb-2023-38337-vulnerable",
|
|
"file": "cve_corpus/ruby/CVE-2023-38337/vulnerable.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
58,
|
|
58
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
54,
|
|
54
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"rswag",
|
|
"path_traversal",
|
|
"rack-middleware"
|
|
],
|
|
"notes": "CVE-2023-38337: rswag-api Rack middleware concatenated env['PATH_INFO'] into the swagger root path with no validation; GET /../config/secrets.yml served arbitrary YAML/JSON files. Fixed in 2.10.1 by File.expand_path + start_with? rooted-path check. MIT"
|
|
},
|
|
{
|
|
"case_id": "cve-rb-2023-38337-patched",
|
|
"file": "cve_corpus/ruby/CVE-2023-38337/patched.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"rswag",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"notes": "CVE-2023-38337 patched counterpart: filename = File.expand_path(File.join(root, path)); unless filename.start_with?(root); return reject; end. Stays clean once Nyx recognises the canonicalize+rooted-path pattern."
|
|
},
|
|
{
|
|
"case_id": "cve-java-2015-7501-vulnerable",
|
|
"file": "cve_corpus/java/CVE-2015-7501/vulnerable.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deserialization",
|
|
"cwe": "CWE-502",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.deser.readobject"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
35,
|
|
35
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
34,
|
|
34
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"commons-collections",
|
|
"deserialization",
|
|
"servlet"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2015-7501: Apache Commons Collections InvokerTransformer chain drove RCE on any app reading attacker-controlled bytes through ObjectInputStream.readObject. Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-java-2015-7501-patched",
|
|
"file": "cve_corpus/java/CVE-2015-7501/patched.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"java.deser.readobject",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"commons-collections",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2015-7501 patched counterpart: Jackson JSON codec replaces native Java deserialization; no ObjectInputStream on the request path; regression guard"
|
|
},
|
|
{
|
|
"case_id": "cve-go-2022-30323-vulnerable",
|
|
"file": "cve_corpus/go/CVE-2022-30323/vulnerable.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.cmdi.exec_command"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
34,
|
|
34
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
30,
|
|
30
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"go-getter",
|
|
"cmdi",
|
|
"git"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-30323: hashicorp/go-getter forwarded user URLs into `git clone` argv, letting `ext::`/`upload-pack=` aliases reach a shell; affected Terraform, Packer, Nomad, Vault. MPL-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-go-2022-30323-patched",
|
|
"file": "cve_corpus/go/CVE-2022-30323/patched.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"go.cmdi.exec_command",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"go-getter",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-30323 patched counterpart: scheme allowlist + in-process go-git clone removes the exec.Command path; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-go-2023-3188-vulnerable",
|
|
"file": "cve_corpus/go/CVE-2023-3188/vulnerable.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
85,
|
|
85
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
84,
|
|
84
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"owncast",
|
|
"ssrf",
|
|
"fediverse"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2023-3188: Owncast 0.0.x webfinger SSRF \u2014 `account` parsed off the @-delimited handle reaches `http.DefaultClient.Get(requestURL.String())` with no host validation. Engine detects via cross-function taint flow (handler \u2192 GetWebfingerLinks param 0 \u2192 http.DefaultClient.Get SSRF sink). MIT."
|
|
},
|
|
{
|
|
"case_id": "cve-go-2023-3188-patched",
|
|
"file": "cve_corpus/go/CVE-2023-3188/patched.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"owncast",
|
|
"ssrf",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2023-3188 patched counterpart: `IsHostnameInternal` early-return + redirect-blocked `*http.Client`. Regression guard that Nyx does not refire on the fix; the local-client sink (`client.Get`) is intentionally not on the SSRF matcher list."
|
|
},
|
|
{
|
|
"case_id": "cve-go-2024-31450-vulnerable",
|
|
"file": "cve_corpus/go/CVE-2024-31450/vulnerable.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
72,
|
|
72
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
64,
|
|
64
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"owncast",
|
|
"path_traversal",
|
|
"emoji"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2024-31450: Owncast 0.1.2 emoji-delete API joined a body-supplied filename to the emoji directory and called `os.Remove` without `filepath.Base`. Fixed in 0.1.3 with `filepath.IsLocal(targetPath)` early return."
|
|
},
|
|
{
|
|
"case_id": "cve-go-2024-31450-patched",
|
|
"file": "cve_corpus/go/CVE-2024-31450/patched.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"owncast",
|
|
"path_traversal",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2024-31450 patched counterpart: `filepath.IsLocal(targetPath)` early-return. Regression guard."
|
|
},
|
|
{
|
|
"case_id": "go-ssrf-004",
|
|
"file": "go/ssrf/ssrf_default_client_get.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "ssrf",
|
|
"cwe": "CWE-918",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
13,
|
|
13
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"tags": [
|
|
"ssrf",
|
|
"default-client",
|
|
"regression"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-Hunt session 2 regression: `http.DefaultClient.Get` was not on the Go SSRF matcher list; pin so a future revert can't quietly drop the matcher."
|
|
},
|
|
{
|
|
"case_id": "go-ssrf-safe-002",
|
|
"file": "go/ssrf/safe_ssrf_default_client_get.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"ssrf",
|
|
"default-client",
|
|
"safe",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-Hunt session 2 negative pair: hard-coded URL handed to `http.DefaultClient.Get`; new matcher must not over-fire on constant-URL calls."
|
|
},
|
|
{
|
|
"case_id": "go-path-002",
|
|
"file": "go/path_traversal/path_traversal_remove.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
19,
|
|
19
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
17,
|
|
17
|
|
]
|
|
],
|
|
"tags": [
|
|
"path-traversal",
|
|
"os-remove",
|
|
"regression"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-Hunt session 2 regression: `os.Remove` and the rest of the mutating-fs family (`os.WriteFile`, `os.RemoveAll`) were missing from the Go FILE_IO matcher list; pin against a future revert."
|
|
},
|
|
{
|
|
"case_id": "go-path-safe-002",
|
|
"file": "go/path_traversal/safe_path_traversal_remove.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"path-traversal",
|
|
"os-remove",
|
|
"safe",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-Hunt session 2 negative pair: `filepath.Base` cleanses traversal segments before the join; new os.Remove matcher must not over-fire on cleansed flows."
|
|
},
|
|
{
|
|
"case_id": "go-path-003",
|
|
"file": "go/path_traversal/path_traversal_ifinit.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
29,
|
|
29
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
27,
|
|
27
|
|
]
|
|
],
|
|
"tags": [
|
|
"path-traversal",
|
|
"if-init",
|
|
"regression"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-Hunt session 4 regression: tree-sitter `if_statement.initializer` was skipped by the Kind::If CFG arm; side-effecting calls inside `if x := f(); x != 0 { }` were invisible to taint. Pins the lowering fix that maps Owncast CVE-2024-31450's exact init shape."
|
|
},
|
|
{
|
|
"case_id": "go-path-safe-003",
|
|
"file": "go/path_traversal/safe_path_traversal_ifinit.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"path-traversal",
|
|
"if-init",
|
|
"safe",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-Hunt session 4 negative pair: same if-init shape as go-path-003, but `filepath.Base` sanitizes the user-controlled name before the os.Remove sink. Verifies the new init lowering doesn't over-fire when the sanitizer dominates."
|
|
},
|
|
{
|
|
"case_id": "cve-c-2016-3714-vulnerable",
|
|
"file": "cve_corpus/c/CVE-2016-3714/vulnerable.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"c.cmdi.system"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
34,
|
|
34
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"imagemagick",
|
|
"imagetragick",
|
|
"cmdi"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2016-3714 (ImageTragick): ImageMagick delegate policies substituted user-controlled filenames into shell templates passed to system(), enabling unauthenticated RCE via crafted MVG/MSL uploads. ImageMagick License"
|
|
},
|
|
{
|
|
"case_id": "cve-c-2016-3714-patched",
|
|
"file": "cve_corpus/c/CVE-2016-3714/patched.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"c.cmdi.system",
|
|
"c.cmdi.popen",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"imagemagick",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2016-3714 patched counterpart: in-process coder + basename check removes the system() path; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-c-2019-18634-vulnerable",
|
|
"file": "cve_corpus/c/CVE-2019-18634/vulnerable.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "memory_safety",
|
|
"cwe": "CWE-120",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"c.memory.strcpy"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
39,
|
|
39
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"sudo",
|
|
"pwfeedback",
|
|
"stack-overflow"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2019-18634: sudo pwfeedback stack buffer overflow in getln() when a long stdin token spilled past the feedback buffer; local root on Linux/macOS sudoers with pwfeedback enabled. ISC"
|
|
},
|
|
{
|
|
"case_id": "cve-c-2019-18634-patched",
|
|
"file": "cve_corpus/c/CVE-2019-18634/patched.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"c.memory.strcpy",
|
|
"c.memory.strcat",
|
|
"c.memory.sprintf",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"sudo",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2019-18634 patched counterpart: bounded copy routine replaces the strcpy sink; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-cpp-2019-13132-vulnerable",
|
|
"file": "cve_corpus/cpp/CVE-2019-13132/vulnerable.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "memory_safety",
|
|
"cwe": "CWE-120",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"cpp.memory.strcpy"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
32,
|
|
32
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"libzmq",
|
|
"zmtp",
|
|
"stack-overflow"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2019-13132: ZeroMQ libzmq v2 decoder trusted attacker-supplied metadata length and copied peer bytes into a fixed on-stack buffer, enabling unauthenticated RCE on curve-disabled sockets. MPL-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-cpp-2019-13132-patched",
|
|
"file": "cve_corpus/cpp/CVE-2019-13132/patched.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cpp.memory.strcpy",
|
|
"cpp.memory.strcat",
|
|
"cpp.memory.sprintf",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"libzmq",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2019-13132 patched counterpart: bounded std::string assign + hard cap removes the strcpy sink; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-cpp-2022-1941-vulnerable",
|
|
"file": "cve_corpus/cpp/CVE-2022-1941/vulnerable.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "memory_safety",
|
|
"cwe": "CWE-120",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"cpp.memory.strcpy"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
37,
|
|
37
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"protobuf",
|
|
"parse-context",
|
|
"heap-overflow"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-1941: Protocol Buffers C++ ParseContext copied unknown-field bytes into a backing buffer without clamping the declared length, causing OOB read/write in any binary decoding untrusted protobufs. BSD-3-Clause"
|
|
},
|
|
{
|
|
"case_id": "cve-cpp-2022-1941-patched",
|
|
"file": "cve_corpus/cpp/CVE-2022-1941/patched.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cpp.memory.strcpy",
|
|
"cpp.memory.strcat",
|
|
"cpp.memory.sprintf",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"protobuf",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-1941 patched counterpart: bounded std::string assign + MAX_LABEL cap removes the strcpy sink; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-java-2017-12629-vulnerable",
|
|
"file": "cve_corpus/java/CVE-2017-12629/vulnerable.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.cmdi.runtime_exec"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
33,
|
|
33
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
29,
|
|
29
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"solr",
|
|
"xslt",
|
|
"rce"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2017-12629: Apache Solr XSLT response writer evaluated attacker-supplied stylesheets that reached Runtime.exec via XPath Java-binding extensions; unauthenticated RCE on any exposed Solr node. Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-java-2017-12629-patched",
|
|
"file": "cve_corpus/java/CVE-2017-12629/patched.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"java.cmdi.runtime_exec",
|
|
"java.reflection.class_forname",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"solr",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2017-12629 patched counterpart: transformer name allowlist + in-process secure TransformerFactory removes the Runtime.exec path; regression guard that Nyx does not refire on the fix"
|
|
},
|
|
{
|
|
"case_id": "cve-java-2022-1471-vulnerable",
|
|
"file": "cve_corpus/java/CVE-2022-1471/vulnerable.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "deserialization",
|
|
"cwe": "CWE-502",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.deser.snakeyaml_unsafe_constructor"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
38,
|
|
38
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
34,
|
|
34
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"snakeyaml",
|
|
"deserialization",
|
|
"servlet"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-1471: SnakeYAML <2.0 default Constructor accepts arbitrary class tags (`!!javax.script.ScriptEngineManager`, `!!java.net.URLClassLoader`, ...) reaching RCE on apps that load attacker-controlled YAML. Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-java-2022-1471-patched",
|
|
"file": "cve_corpus/java/CVE-2022-1471/patched.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"java.deser.snakeyaml_unsafe_constructor",
|
|
"java.deser.readobject",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"snakeyaml",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-1471 patched counterpart: explicit SafeConstructor argument restricts the YAML tag handler set to primitives + standard collections; regression guard that Nyx does not refire on the safe form"
|
|
},
|
|
{
|
|
"case_id": "cve-java-2022-42889-vulnerable",
|
|
"file": "cve_corpus/java/CVE-2022-42889/vulnerable.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "code_exec",
|
|
"cwe": "CWE-94",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"java.code_exec.text4shell_interpolator"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
40,
|
|
40
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
35,
|
|
35
|
|
]
|
|
],
|
|
"tags": [
|
|
"cve",
|
|
"commons-text",
|
|
"text4shell",
|
|
"code-exec",
|
|
"servlet"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-42889 (Text4Shell): Apache Commons Text 1.5..1.9 StringSubstitutor.createInterpolator() enables script:/dns:/url: lookups; ${script:js:...} reaches the JSR-223 ScriptEngineManager. Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-java-2022-42889-patched",
|
|
"file": "cve_corpus/java/CVE-2022-42889/patched.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"java.code_exec.text4shell_interpolator",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"commons-text",
|
|
"text4shell",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-42889 patched counterpart: substitutor built directly with `new StringSubstitutor()` so the lookup map is empty; ${...} pass-through. No script/dns/url evaluation."
|
|
},
|
|
{
|
|
"case_id": "rs-auth-001",
|
|
"file": "rust/auth/actix_scoped_write_missing.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-862",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
17,
|
|
17
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
16,
|
|
16
|
|
]
|
|
],
|
|
"tags": [
|
|
"auth",
|
|
"actix",
|
|
"scoped-id",
|
|
"positive"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Actix handler mutates `project_service::update(project_id, \u2026)` with a path-bound scoped id, no ownership check"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-002",
|
|
"file": "rust/auth/true_positive_missing_check.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-862",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
13,
|
|
13
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"realtime",
|
|
"scoped-id",
|
|
"positive",
|
|
"phase-a-control"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Authenticated handler that publishes against a group_id with no membership check \u2014 the positive control for the auth-rule FP-remediation work"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-003",
|
|
"file": "rust/auth/row_ownership_no_early_exit.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-862",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
28,
|
|
28
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"row-ownership",
|
|
"regression-guard",
|
|
"positive"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Equality compared but no early exit \u2014 the check is ineffective so the downstream read on doc_id must still flag (A2 regression guard)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-101",
|
|
"file": "rust/auth/hashmap_local_noise.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-a1",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "P0: HashMap/HashSet method calls on locally-constructed bindings \u2014 never an authorization decision (Phase A1 fix)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-102",
|
|
"file": "rust/auth/helper_scoped_params.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-a1",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "P4 (partial): library helper whose internal work is `result.insert(..)` on a locally-constructed HashSet \u2014 never a sink (Phase A1 fix)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-103",
|
|
"file": "rust/auth/row_ownership_equality.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-a2",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "P3: row-level ownership equality (`if owner_id != user.id { return ... }`) covers downstream column reads on the same row (Phase A2 fix)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-104",
|
|
"file": "rust/auth/self_scoped_user.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-a3",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "P5: `let user = require_auth(..).await?` binds the actor \u2014 `user.id` is self, not a scoped foreign id (Phase A3 fix)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-105",
|
|
"file": "rust/auth/db_connection_type_inferred.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-b2",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase B2: `rusqlite::Connection::open` infers `DatabaseConnection` type via SSA constructor_type; the handler logs only the caller's own id"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-106",
|
|
"file": "rust/auth/sql_join_acl.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-b3",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase B3: SELECT through `group_members` ACL JOIN with `WHERE gm.user_id = ?1` makes every returned row membership-gated"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-107",
|
|
"file": "rust/auth/transitive_helper.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-b4",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase B4: `validate_target` helper internally calls `require_membership(group_id, user.id)` \u2014 handler-level call lifts the auth check transparently"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-108",
|
|
"file": "rust/auth/row_fetch_then_authorize.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-a4",
|
|
"real-repo-precision-2026-04-27",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase A4: row-level fetch-then-authorize idiom. `let community = Community::read(pool, req.community_id)?;` followed by `check_community_user_action(&user, &community, ...)?;` \u2014 the structural recogniser admits the `check_<resource>_<role>_action` shape and the row-fetch exemption back-dates coverage of the read"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-109",
|
|
"file": "rust/auth/predicate_role_check.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"phase-a4",
|
|
"real-repo-precision-2026-04-27",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase A4: `is_<role>_or_<role>` predicate auth shape (lemmy `is_mod_or_admin`). Structural recogniser admits boolean predicate forms when every conjunct is a known auth role"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-110",
|
|
"file": "rust/auth/unsafe_row_fetch_no_authz.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-285",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "Medium",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
24,
|
|
25
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"positive",
|
|
"phase-a4",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase A4 regression guard: row fetched by user-supplied id without any authorization function naming the resulting row \u2014 the row-fetch exemption must NOT fire"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-006",
|
|
"file": "rust/auth/safe_row_population_reverse_walk.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Row-population reverse-walk: lemmy `community/transfer.rs` shape \u2014 `let community = Community::read(pool, data.community_id); check_community_user_action(&user, &community, ..); CommunityActions::delete_mods_for_community(pool, data.community_id);` \u2014 the auth check on the fetched row must materially cover downstream re-uses of the request id"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-007",
|
|
"file": "rust/auth/safe_row_fetch_multiline_let.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Multi-line `let X =\\n CALL(..)?;` \u2014 `row_population_data` records the call's start line so `op.line` matches and the row-fetch exemption fires (lemmy `comment/lock.rs:31`)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-008",
|
|
"file": "rust/auth/unsafe_row_population_no_check.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-285",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "High",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
37,
|
|
43
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"positive",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Negative counterpart for the row-population reverse-walk: same fetch-then-mutate shape but no auth check on the fetched row \u2014 the reverse-walk has nothing to anchor to and the mutation by id must still flag"
|
|
},
|
|
{
|
|
"case_id": "rs-safe-014",
|
|
"file": "rust/safe/safe_option_sanitizer.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-regression",
|
|
"path-sanitizer",
|
|
"variant-wrapper"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Option-returning sanitizer: `sanitize_path(s) -> Option<String>` with match-arm Some-binding extraction. Per-return-path PathFact decomposition + structural variant unwrapping closes the FP."
|
|
},
|
|
{
|
|
"case_id": "rs-safe-016",
|
|
"file": "rust/safe/safe_cross_function_dotdot.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-regression",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-function bool-returning validator with `if !validate(&raw) { return; }` rejection. Per-return-path summary lifts the helper's `dotdot/absolute` narrowing across the call boundary."
|
|
},
|
|
{
|
|
"case_id": "cve-rs-2018-20997-vulnerable",
|
|
"file": "cve_corpus/rust/CVE-2018-20997/vulnerable.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"cve",
|
|
"tar-rs",
|
|
"zip-slip"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2018-20997 / RUSTSEC-2018-0003: tar-rs zip-slip vulnerability \u2014 entry path interpolated into File::create without `..` rejection. MIT OR Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-rs-2018-20997-patched",
|
|
"file": "cve_corpus/rust/CVE-2018-20997/patched.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"tar-rs",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2018-20997 patched counterpart: `sanitize_path` rejects `..` traversal and absolute paths. Regression guard that Nyx does not refire on the fix."
|
|
},
|
|
{
|
|
"case_id": "cve-rs-2022-36113-vulnerable",
|
|
"file": "cve_corpus/rust/CVE-2022-36113/vulnerable.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "path_traversal",
|
|
"cwe": "CWE-22",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"cve",
|
|
"cargo",
|
|
"symlink"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-36113: cargo `.cargo-ok` symlink follow \u2014 crate name interpolated into File::create without separator/dotdot rejection. MIT OR Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-rs-2022-36113-patched",
|
|
"file": "cve_corpus/rust/CVE-2022-36113/patched.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"cargo",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2022-36113 patched counterpart: `sanitize_crate_name` + `OpenOptions::create_new`. Regression guard that Nyx does not refire on the fix."
|
|
},
|
|
{
|
|
"case_id": "cve-rs-2024-24576-vulnerable",
|
|
"file": "cve_corpus/rust/CVE-2024-24576/vulnerable.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"cve",
|
|
"rust-stdlib",
|
|
"batbadbut"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2024-24576 / RUSTSEC-2024-0003: BatBadBut \u2014 argument injection into Windows .bat via `Command::new(...).arg`. MIT OR Apache-2.0"
|
|
},
|
|
{
|
|
"case_id": "cve-rs-2024-24576-patched",
|
|
"file": "cve_corpus/rust/CVE-2024-24576/patched.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real_cve",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cve",
|
|
"rust-stdlib",
|
|
"patched",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "CVE-2024-24576 patched counterpart: cmd.exe-aware allowlist filters argv before reaching update.bat. Regression guard that Nyx does not refire on the fix."
|
|
},
|
|
{
|
|
"case_id": "py-safe-014",
|
|
"file": "python/safe/safe_direct_path_sanitizer.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Python equivalent of rs-safe-014: direct-return sanitiser with `\"..\" in s` / `s.startswith(...)` rejection chain returning empty string."
|
|
},
|
|
{
|
|
"case_id": "py-safe-022",
|
|
"file": "python/safe/safe_canonicalise_rooted_startswith.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"canonicalise-and-rooted",
|
|
"opaque-prefix-lock",
|
|
"negated-form"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Pins `os.path.realpath` + `if not target.startswith(<non-literal>)` shape (rswag CVE-2023-38337 sibling). Combined dotdot=No (from realpath) + opaque PrefixLock (from non-literal startswith guard) suppresses FILE_IO under is_path_traversal_safe with the negated-form polarity flip."
|
|
},
|
|
{
|
|
"case_id": "py-safe-016",
|
|
"file": "python/safe/safe_cross_function_dotdot.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Python equivalent of rs-safe-016: cross-function bool-returning validator with `if not validate(raw): return` rejection."
|
|
},
|
|
{
|
|
"case_id": "js-safe-014",
|
|
"file": "javascript/safe/safe_direct_path_sanitizer.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "JS direct-return sanitiser. Standalone `nyx scan --index off` is clean, but the benchmark harness (single-thread + state/auth analysis enabled) reproduces a FP \u2014 diverges from production scan path. Disabled until benchmark/binary parity is re-established."
|
|
},
|
|
{
|
|
"case_id": "js-safe-021",
|
|
"file": "javascript/safe/safe_canonicalise_rooted_startsWith.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"canonicalise-and-rooted",
|
|
"opaque-prefix-lock",
|
|
"negated-form"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Pins `path.resolve` + `if (!target.startsWith(<non-literal>))` shape (rswag CVE-2023-38337 sibling). Combined dotdot=No (from path.resolve) + opaque PrefixLock (from non-literal startsWith guard) suppresses FILE_IO under is_path_traversal_safe with the negated-form polarity flip."
|
|
},
|
|
{
|
|
"case_id": "js-safe-022",
|
|
"file": "javascript/safe/safe_env_empty_fallback.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"js.secrets.fallback_secret"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"secrets",
|
|
"empty-fallback",
|
|
"real-repo-precision-2026-05-01"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Empty-string fallback (`process.env.X || \"\"`) is not a hardcoded secret. JS counterpart of ts-safe-020. Engine fix: pattern-level regex (#match? @fallback \"[^\\\"']\") in src/patterns/javascript.rs."
|
|
},
|
|
{
|
|
"case_id": "ts-safe-014",
|
|
"file": "typescript/safe/safe_direct_path_sanitizer.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TypeScript equivalent of rs-safe-014: direct-return sanitiser with `s.includes('..')` / `s.startsWith(...)` rejection."
|
|
},
|
|
{
|
|
"case_id": "go-safe-015",
|
|
"file": "go/safe/safe_tuple_path_sanitizer.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"tuple-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Go tuple-returning sanitiser. Standalone scan is clean; benchmark harness (single-thread, state/auth) reports FP. Disabled pending parity investigation."
|
|
},
|
|
{
|
|
"case_id": "go-safe-016",
|
|
"file": "go/safe/safe_cross_function_dotdot.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Go cross-function validator. Standalone scan clean; benchmark harness reports FP. Disabled pending parity investigation."
|
|
},
|
|
{
|
|
"case_id": "java-safe-014",
|
|
"file": "java/safe/SafeDirectPathSanitizer.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Java equivalent of rs-safe-014: direct-return sanitiser with `.contains` / `.startsWith` rejection."
|
|
},
|
|
{
|
|
"case_id": "java-safe-015",
|
|
"file": "java/safe/SafeOptionalPathSanitizer.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"optional-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Java equivalent of rs-safe-014: `Optional<String>`-returning sanitiser with `Optional.empty()` failure sentinel."
|
|
},
|
|
{
|
|
"case_id": "java-safe-016",
|
|
"file": "java/safe/SafeCrossFunctionDotdot.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Java equivalent of rs-safe-016: cross-function bool-returning validator with `if (!validate(...)) return` rejection."
|
|
},
|
|
{
|
|
"case_id": "rb-safe-014",
|
|
"file": "ruby/safe/safe_direct_path_sanitizer.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Ruby equivalent of rs-safe-014: direct-return sanitiser with `include?` / `start_with?` rejection."
|
|
},
|
|
{
|
|
"case_id": "rb-safe-021",
|
|
"file": "ruby/safe/safe_canonicalise_rooted_unless.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"canonicalise-and-rooted",
|
|
"opaque-prefix-lock"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Pins `File.expand_path` + `unless filename.start_with? <non-literal>` shape (rswag CVE-2023-38337 patched). Combined dotdot=No (from expand_path) + opaque PrefixLock (from non-literal start_with? guard) suppresses FILE_IO under is_path_traversal_safe."
|
|
},
|
|
{
|
|
"case_id": "rb-safe-015",
|
|
"file": "ruby/safe/safe_nil_path_sanitizer.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"nil-sentinel"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Ruby equivalent of rs-safe-014 with explicit nil failure sentinel."
|
|
},
|
|
{
|
|
"case_id": "rb-safe-016",
|
|
"file": "ruby/safe/safe_cross_function_dotdot.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Ruby equivalent of rs-safe-016: cross-function bool-returning validator with `return unless validate(...)` rejection."
|
|
},
|
|
{
|
|
"case_id": "php-safe-014",
|
|
"file": "php/safe/safe_direct_path_sanitizer.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "PHP equivalent of rs-safe-014: direct-return sanitiser with `strpos !== false` / leading-char rejection."
|
|
},
|
|
{
|
|
"case_id": "php-safe-015",
|
|
"file": "php/safe/safe_nullable_path_sanitizer.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"nullable-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "PHP equivalent of rs-safe-014: `?string` nullable-returning sanitiser with explicit null failure sentinel."
|
|
},
|
|
{
|
|
"case_id": "php-safe-016",
|
|
"file": "php/safe/safe_cross_function_dotdot.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "PHP equivalent of rs-safe-016: cross-function bool-returning validator."
|
|
},
|
|
{
|
|
"case_id": "php-safe-017",
|
|
"file": "php/safe/safe_unserialize_allowed_classes.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-502",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"php.deser.unserialize",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"real-repo-precision-2026-04-28",
|
|
"unserialize",
|
|
"allowed_classes"
|
|
],
|
|
"disabled": false,
|
|
"notes": "PHP 7+ structural mitigation against object injection \u2014 unserialize($x, ['allowed_classes' => ...]) with false / array literal / class constant must not fire php.deser.unserialize. Distilled from nextcloud lib/private/Profiler/FileProfilerStorage.php and apps/dav CustomPropertiesBackend."
|
|
},
|
|
{
|
|
"case_id": "php-safe-018",
|
|
"file": "php/safe/safe_include_param_passthrough.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-98",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"php.path.include_variable",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"real-repo-precision-2026-04-28",
|
|
"include",
|
|
"param-passthrough",
|
|
"autoloader"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Composer-style autoloader: closure / method takes a file path parameter and `include`s it. Pattern rule is heuristic without taint and over-fires; suppress when included variable is a formal parameter of the immediately enclosing function with no reassignment. Distilled from nextcloud composer/ClassLoader.php (32 copies), Router.php, Installer.php, Template/Base.php."
|
|
},
|
|
{
|
|
"case_id": "php-safe-019",
|
|
"file": "php/safe/safe_md5_sha1_non_crypto_use.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-327",
|
|
"provenance": "real-repo-precision-2026-05-01",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"php.crypto.md5",
|
|
"php.crypto.sha1"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"real-repo-precision-2026-05-01",
|
|
"weak-hash",
|
|
"non-crypto-use",
|
|
"etag",
|
|
"cache-key"
|
|
],
|
|
"disabled": false,
|
|
"notes": "md5() / sha1() pervasively used for non-cryptographic purposes — ETag generation, cache-key / array-index hashing, dedup fingerprints, content-addressed identifier derivation. Layer F suppression recognises the consuming context (variable LHS, member-access LHS, subscript LHS, array element key, lookup-verb argument, return-from-method, hash-as-index) and refuses to fire. Distilled from nextcloud apps/dav CalDavBackend, contactsinteraction Card, Files/Cache, theming Util / CommonThemeTrait, encryption KeyManager; phpmyadmin src/Controllers/Database/StructureController, Controllers/Table/{RelationController, SearchController, ZoomSearchController}, src/Display/Results, Database/MultiTableQuery, Favorites/RecentFavoriteTables."
|
|
},
|
|
{
|
|
"case_id": "php-crypto-001",
|
|
"file": "php/crypto/crypto_md5_password_hash.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "crypto",
|
|
"cwe": "CWE-327",
|
|
"provenance": "real-repo-precision-2026-05-01",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"php.crypto.md5",
|
|
"php.crypto.sha1"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"real-repo-precision-2026-05-01",
|
|
"weak-hash",
|
|
"credential-storage"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart to php-safe-019: md5 / sha1 used to store / sign / digest credentials, tokens, signatures. Consumer names contain crypto-keyword substrings (`password`, `token`, `signature`, `pw_hash`, `digest`) so Layer F suppression refuses to fire."
|
|
},
|
|
{
|
|
"case_id": "c-safe-014",
|
|
"file": "c/safe/safe_direct_path_sanitizer.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "C direct-return sanitiser. Standalone scan clean; benchmark harness reports FP. Disabled pending parity investigation (Preview-tier C scanning is best-effort already)."
|
|
},
|
|
{
|
|
"case_id": "c-safe-015",
|
|
"file": "c/safe/safe_status_code_sanitizer.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"status-code"
|
|
],
|
|
"disabled": false,
|
|
"notes": "C status-code idiom sanitiser. Standalone scan clean; benchmark harness reports FP. Disabled."
|
|
},
|
|
{
|
|
"case_id": "c-safe-016",
|
|
"file": "c/safe/safe_cross_function_dotdot.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "C cross-function validator. Standalone scan clean; benchmark harness reports FP. Disabled."
|
|
},
|
|
{
|
|
"case_id": "c-safe-017",
|
|
"file": "c/safe/safe_strcpy_literal_src.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-120",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"c.memory.strcpy",
|
|
"c.memory.strcat"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"literal-source",
|
|
"ternary-literal",
|
|
"real-repo-precision-2026-04-28"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Postgres `pg_prewarm/autoprewarm.c` + `formatting.c::DCH_a_m` shape \u2014 strcpy/strcat with string-literal or ternary-of-literals source. Layer D suppression (src/ast.rs::is_c_buffer_call_literal_safe)."
|
|
},
|
|
{
|
|
"case_id": "c-safe-018",
|
|
"file": "c/safe/safe_sprintf_bounded_format.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-120",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"c.memory.sprintf"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"bounded-format",
|
|
"real-repo-precision-2026-04-28"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Postgres `datetime.c::EncodeDateTime` shape \u2014 sprintf with literal format string containing only width/precision-bounded specifiers. Layer D suppression."
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-014",
|
|
"file": "cpp/safe/safe_direct_path_sanitizer.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "C++ equivalent of rs-safe-014: direct-return sanitiser using std::string::find."
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-015",
|
|
"file": "cpp/safe/safe_optional_path_sanitizer.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"optional-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "C++ equivalent of rs-safe-014: `std::optional<std::string>`-returning sanitiser."
|
|
},
|
|
{
|
|
"case_id": "cpp-safe-016",
|
|
"file": "cpp/safe/safe_cross_function_dotdot.cpp",
|
|
"language": "cpp",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "C++ equivalent of rs-safe-016: cross-function bool-returning validator."
|
|
},
|
|
{
|
|
"case_id": "py-safe-015",
|
|
"file": "python/safe/safe_optional_path_sanitizer.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"optional-sentinel"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Python `Optional[str]`-returning sanitiser with None failure sentinel. Disabled: per-language non-data-return propagation through Optional unwrap is incomplete; deferred follow-up."
|
|
},
|
|
{
|
|
"case_id": "go-safe-014",
|
|
"file": "go/safe/safe_direct_path_sanitizer.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"direct-return"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Go direct-return sanitiser; tuple-returning go-safe-015 is the language-natural form which fires clean. Direct form deferred (helper return-fact join not yet wired for Go)."
|
|
},
|
|
{
|
|
"case_id": "js-safe-015",
|
|
"file": "javascript/safe/safe_null_path_sanitizer.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"null-sentinel"
|
|
],
|
|
"disabled": false,
|
|
"notes": "JS null-returning sanitiser; deferred while the JS two-level solver per-return-path summary lifting is being completed."
|
|
},
|
|
{
|
|
"case_id": "js-safe-016",
|
|
"file": "javascript/safe/safe_cross_function_dotdot.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "JS cross-function bool validator; per-language helper-summary lifting for the bool-returning helper shape is deferred."
|
|
},
|
|
{
|
|
"case_id": "ts-safe-015",
|
|
"file": "typescript/safe/safe_null_path_sanitizer.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"null-sentinel"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TS nullable-returning sanitiser; deferred \u2014 same reason as js-safe-015."
|
|
},
|
|
{
|
|
"case_id": "ts-safe-016",
|
|
"file": "typescript/safe/safe_cross_function_dotdot.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": null,
|
|
"expected_source_lines": null,
|
|
"tags": [
|
|
"pathfact-cross-language",
|
|
"path-sanitizer",
|
|
"cross-function"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TS cross-function bool validator; deferred \u2014 same reason as js-safe-016."
|
|
},
|
|
{
|
|
"case_id": "ts-safe-017",
|
|
"file": "typescript/safe/safe_strapi_db_query_chain.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-89",
|
|
"provenance": "real-repo-distilled",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cfg-unguarded-sink",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"real-repo-precision-2026-04-29",
|
|
"strapi",
|
|
"orm-chain"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Strapi-style ORM accessor: `<obj>.db.query(MODEL_UID).<orm_method>(...)`; the `db.query` call's literal model UID + the ORM-method outer chain (findOne/findMany/create/update/delete/count) prove the chain is parameterised. Synthesised same-node Sanitizer(SQL_QUERY) suppresses cfg-unguarded-sink and taint-unsanitised-flow."
|
|
},
|
|
{
|
|
"case_id": "ts-safe-018",
|
|
"file": "typescript/safe/safe_indirect_validator.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"indirect-validator",
|
|
"ssrf",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Indirect-validator branch narrowing \u2014 `const err = validateUrlSsrf(target); if (err) throw \u2026;` should suppress the downstream axios.get sink. Pinned by tests/lib::indirect_validator_narrowing_marks_arg_validated."
|
|
},
|
|
{
|
|
"case_id": "ts-safe-019",
|
|
"file": "typescript/safe/safe_helper_with_validator.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"helper-summary",
|
|
"ssrf",
|
|
"negative"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Helper-summary all_validated propagation \u2014 when a helper's body validates the param via `validateXxx`, the per-param probe's all_validated event should be skipped during summary extraction so callers don't refire the cross-fn SSRF. Pinned by tests/lib::helper_with_validator_does_not_propagate_to_caller_via_summary."
|
|
},
|
|
{
|
|
"case_id": "ts-safe-020",
|
|
"file": "typescript/safe/safe_env_empty_fallback.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"ts.secrets.fallback_secret"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"secrets",
|
|
"empty-fallback",
|
|
"real-repo-precision-2026-05-01"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Empty-string fallback (`process.env.X || \"\"`) is not a hardcoded secret. Distilled from /Users/elipeter/oss/cal.com/apps/api/v2/src/modules/stripe/utils/newStripeInstance.ts and ~30 sibling cal.com calendar/stripe/sendgrid integration files. Engine fix: pattern-level regex (#match? @fallback \"[^\\\"']\") in src/patterns/typescript.rs."
|
|
},
|
|
{
|
|
"case_id": "py-auth-decorator-001",
|
|
"file": "python/safe/safe_login_required_decorator.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-862",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access",
|
|
"cfg-auth-gap",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Flask @login_required decorator must suppress auth findings"
|
|
},
|
|
{
|
|
"case_id": "py-auth-decorator-vuln-001",
|
|
"file": "python/auth/vuln_no_auth_decorator.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-862",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"cfg-auth-gap"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Same shape but missing decorator \u2014 auth-gap fires"
|
|
},
|
|
{
|
|
"case_id": "java-preauth-001",
|
|
"file": "java/auth/SafePreAuthorize.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-862",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access",
|
|
"cfg-auth-gap",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Spring @PreAuthorize annotation must suppress auth findings"
|
|
},
|
|
{
|
|
"case_id": "java-preauth-vuln-001",
|
|
"file": "java/auth/VulnNoPreAuthorize.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
13,
|
|
13
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Servlet doGet without auth \u2014 taint flow fires"
|
|
},
|
|
{
|
|
"case_id": "php-isgranted-001",
|
|
"file": "php/auth/safe_isgranted.php",
|
|
"language": "php",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-862",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access",
|
|
"cfg-auth-gap",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Symfony #[IsGranted] attribute must suppress auth findings"
|
|
},
|
|
{
|
|
"case_id": "php-isgranted-vuln-001",
|
|
"file": "php/auth/vuln_no_isgranted.php",
|
|
"language": "php",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
6,
|
|
6
|
|
]
|
|
],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Top-level handler without IsGranted \u2014 taint flow fires"
|
|
},
|
|
{
|
|
"case_id": "ruby-before-action-001",
|
|
"file": "ruby/auth/safe_before_action.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-862",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-unauthed-access",
|
|
"cfg-auth-gap",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Rails before_action :authenticate_user must suppress auth findings"
|
|
},
|
|
{
|
|
"case_id": "js-allowlist-dispatch-001",
|
|
"file": "javascript/safe/safe_switch_dispatch.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-unauthed-access"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Allowlist-then-exec pattern \u2014 engine must recognise membership check"
|
|
},
|
|
{
|
|
"case_id": "ts-iife-closure-001",
|
|
"file": "typescript/safe/safe_iife_closure_sanitizer.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "IIFE wrapper around handler with encodeURIComponent \u2014 must be cleared"
|
|
},
|
|
{
|
|
"case_id": "ts-iife-closure-vuln-001",
|
|
"file": "typescript/xss/vuln_iife_closure_no_sanitizer.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
16,
|
|
16
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
14,
|
|
14
|
|
]
|
|
],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "IIFE wrapper without sanitizer \u2014 taint must propagate through closure"
|
|
},
|
|
{
|
|
"case_id": "py-validator-sentinel-001",
|
|
"file": "python/safe/safe_validator_sentinel.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-unauthed-access",
|
|
"cfg-auth-gap"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cross-fn validator with empty-string sentinel + decorator"
|
|
},
|
|
{
|
|
"case_id": "py-validator-sentinel-vuln-001",
|
|
"file": "python/sqli/vuln_validator_sentinel_bypass.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
22,
|
|
22
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
17,
|
|
17
|
|
]
|
|
],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Same shape with inverted sentinel check \u2014 SQLi fires"
|
|
},
|
|
{
|
|
"case_id": "py-context-sanitize-001",
|
|
"file": "python/safe/safe_with_context_sanitize.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-22",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow",
|
|
"state-unauthed-access",
|
|
"cfg-auth-gap"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "with-block resource around sanitised path read + decorator auth"
|
|
},
|
|
{
|
|
"case_id": "js-destructure-sanitize-001",
|
|
"file": "javascript/safe/safe_object_destructure_sanitize.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": "NONE",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Destructured field flows through encodeURIComponent before HTML sink"
|
|
},
|
|
{
|
|
"case_id": "js-destructure-vuln-001",
|
|
"file": "javascript/xss/vuln_object_destructure_no_sanitize.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "xss",
|
|
"cwe": "CWE-79",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "analogue",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
10,
|
|
10
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Destructured field straight into template-literal HTML sink"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-001",
|
|
"file": "rust/auth/self_actor_uid_copy.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`let user = match require_auth() { Ok(u) => u, ... }; let uid = user.id; query(.., &[uid])` \u2014 transitive copy of self-actor id (website/handlers/accounts.rs)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-002",
|
|
"file": "rust/auth/require_resource_role_helper.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`require_trip_member(..)` recognised structurally as `require_<resource>_<role>` (website/handlers/activities.rs)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-003",
|
|
"file": "rust/auth/self_publish_email.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`realtime::publish_to_user(&user.email, ..)` \u2014 self-channel publish with email as self-identity field (website/handlers/social.rs)"
|
|
},
|
|
{
|
|
"case_id": "rs-auth-typed-extractors-001",
|
|
"file": "rust/auth/safe_typed_path_int_extractor.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"typed-extractors-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase 5: Axum `Path<i64>` is a framework-validated numeric extractor; the parameter cannot carry an injection payload nor bypass ownership, so the rule must not flag."
|
|
},
|
|
{
|
|
"case_id": "rs-auth-dto-int-field-001",
|
|
"file": "rust/auth/safe_dto_int_field_axum.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"typed-extractors-phase6-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase 6: Axum `Json<UpdateDoc>` whose `doc_id` field is `i64`. DTO field-level taint exempts `dto.doc_id` member-access subject; numeric DTO fields cannot bypass ownership."
|
|
},
|
|
{
|
|
"case_id": "rs-auth-dto-string-field-001",
|
|
"file": "rust/auth/unsafe_dto_string_field_axum.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-639",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"positive",
|
|
"typed-extractors-phase6-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase 6 negative-control: DTO whose `doc_id` field is `String` must NOT be exempted \u2014 String DTO fields can carry injection payloads, so the auth rule must continue to fire."
|
|
},
|
|
{
|
|
"case_id": "js-safe-realrepo-001",
|
|
"file": "javascript/safe/safe_dom_globals_and_methods.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Browser DOM globals (`document`, `window`, `localStorage`) and DOM-API methods (`addEventListener`, `appendChild`, `getElementById`) are non-data-layer (website/public/app/core/app.js)"
|
|
},
|
|
{
|
|
"case_id": "js-safe-realrepo-002",
|
|
"file": "javascript/safe/safe_happy_path_error_check.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cfg-error-fallthrough"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cfg",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Happy-path `if (!data.error && Array.isArray(...))` and body-mentioning-err do not fire `cfg-error-fallthrough` (website/public/app/core/app.js)"
|
|
},
|
|
{
|
|
"case_id": "js-safe-realrepo-006",
|
|
"file": "javascript/safe/safe_localised_gherkin_regex.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"panic-guard",
|
|
"negative",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Panic guard: CodeMirror Gherkin tokenizer ships a long localised regex inside a boolean sub-condition. Naive byte-slice truncation in CFG condition-text (`t[..MAX_CONDITION_TEXT_LEN]`) panicked when byte 256 landed inside a multi-byte UTF-8 character (Gurmukhi `\u0a16`). Engine fix: src/utils/snippet.rs::truncate_at_char_boundary applied at three CFG sites + two symex display sites (gogs public/plugins/codemirror-5.17.0/mode/gherkin/gherkin.js:107)."
|
|
},
|
|
{
|
|
"case_id": "go-safe-realrepo-001",
|
|
"file": "go/safe/safe_error_log_only_function.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cfg-error-fallthrough"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cfg",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`if err != nil { log() }` whose if is the LAST statement in the function \u2014 no fallthrough sink possible (gin/debug.go:debugPrintError)"
|
|
},
|
|
{
|
|
"case_id": "go-cmdi-realrepo-001",
|
|
"file": "go/cmdi/vuln_error_log_then_sink.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "cmdi",
|
|
"cwe": "CWE-78",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"cfg-error-fallthrough"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"cfg-unguarded-sink",
|
|
"go.sqli.query_concat",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
14,
|
|
14
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cfg",
|
|
"positive",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart: `if err { log() } sink()` \u2014 error logged then fallthrough to sink. Pins that the False-edge-only walk does NOT silence the rule for real fallthrough."
|
|
},
|
|
{
|
|
"case_id": "java-safe-realrepo-001",
|
|
"file": "java/safe/SafeLoggerIsEnabled.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cfg-error-fallthrough"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cfg",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`if (logger.isErrorEnabled()) { print() } more_code()` \u2014 `isErrorEnabled` is a logging-state method, not an error variable; rule must reject camelCase names containing `err` (spring-boot/SpringApplication.java:854)"
|
|
},
|
|
{
|
|
"case_id": "go-safe-realrepo-002",
|
|
"file": "go/safe/safe_method_receiver_mutex.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-resource-leak",
|
|
"state-resource-leak-possible",
|
|
"cfg-resource-leak"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"state",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Go method receiver `c *Context` with internal `c.mu.Lock`/`defer c.mu.Unlock` is NOT a leakable resource \u2014 the proxy-receiver extractor previously took the root identifier of multi-segment callees (`c.writer.header().set` \u2192 `c`) and section 2b's exception-path heuristic ran on Go (gin/context.go:Set/Get/MustGet)"
|
|
},
|
|
{
|
|
"case_id": "go-safe-fieldproj-phase3",
|
|
"file": "go/safe/safe_chained_receiver_field_proj.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"state-resource-leak",
|
|
"state-resource-leak-possible",
|
|
"cfg-resource-leak"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"state",
|
|
"negative",
|
|
"field-projections-phase3-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Phase 3 of the field-projections rollout: chained-receiver method calls (`c.writer.header.set(...)`) must NOT mark the chain root `c` as proxy-acquired. The single-dot band-aid in state/transfer.rs is replaced by chain_proxies tracking that records each receiver chain as its own entity."
|
|
},
|
|
{
|
|
"case_id": "go-safe-realrepo-003",
|
|
"file": "go/safe/safe_const_bound_id.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"go.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-25"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`id := \"id\"; c.AddParam(id, value)` \u2014 const-bound local must not count as a scoped-identifier subject (gin/context_test.go:TestContextAddParam)"
|
|
},
|
|
{
|
|
"case_id": "go-safe-realrepo-004",
|
|
"file": "go/safe/safe_chained_call_response_header.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"go.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`w.Header().Get(constName)` and `r.URL.Query().Get(name)` \u2014 chained-call receiver returns an opaque value (http.Header / url.Values map); the verb-name fallback (Get matches the read indicator) must not auto-classify these as DbCrossTenantRead. Closes the minio cmd/api-response.go cluster (~70 hits)."
|
|
},
|
|
{
|
|
"case_id": "go-safe-realrepo-005",
|
|
"file": "go/safe/safe_self_method_receiver.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"go.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`func (c *Cache) ...` with `c.foo()` / `c.Fs.Create(...)` intra-struct dispatches \u2014 Go method receivers must seed `non_sink_vars` so the verb-name fallback doesn't fire on bare-receiver internal calls. Closes the hugo cache/filecache.go cluster (~48 hits)."
|
|
},
|
|
{
|
|
"case_id": "go-safe-realrepo-006",
|
|
"file": "go/safe/safe_test_helper_fatal.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cfg-error-fallthrough"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"cfg",
|
|
"negative",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "`if err != nil { c.Fatalf(...) }` / `os.Exit` / `log.Fatalf` / `panic(err)` are documented terminators (Goexit-class). cfg-error-fallthrough must walk through them as terminating paths. Closes the minio test-file cluster (49+34+12+11+9+7+7 hits across xl-storage_test.go, erasure-healing_test.go, format-erasure_test.go, \u2026). Engine fix: src/cfg_analysis/error_handling.rs::call_never_returns."
|
|
},
|
|
{
|
|
"case_id": "go-auth-realrepo-001",
|
|
"file": "go/auth/vuln_repo_findbyid_no_auth.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-639",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"go.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"positive",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart pinning the chained-call suppression: bare-identifier receivers (`repo.Find(id)` / `repo.Save(id, val)`) are still classified as canonical data-layer sinks and must continue firing the ownership check."
|
|
},
|
|
{
|
|
"case_id": "py-auth-realrepo-001",
|
|
"file": "python/safe/safe_django_migration_token.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.auth.token_override_without_validation"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Distilled from saleor/account/migrations/0021_unique_token.py: Django RunPython callback writes user-token field but has no user reach (params apps, schema_editor)."
|
|
},
|
|
{
|
|
"case_id": "py-auth-realrepo-002",
|
|
"file": "python/safe/safe_pytest_conftest_marker.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.auth.token_override_without_validation",
|
|
"py.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Distilled from saleor/conftest.py: pytest collection hook with item.add_marker; no user reach but legacy heuristics flagged it."
|
|
},
|
|
{
|
|
"case_id": "py-auth-realrepo-003",
|
|
"file": "python/safe/safe_celery_task_no_user_input.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Distilled from saleor/discount/tasks.py:handle_promotion_toggle: zero-arg Celery task; id-shaped subjects come from internal computation, not user input."
|
|
},
|
|
{
|
|
"case_id": "py-auth-realrepo-004",
|
|
"file": "python/auth/vuln_token_override_django_handler.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-863",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.auth.token_override_without_validation"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
18,
|
|
18
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
15,
|
|
15
|
|
]
|
|
],
|
|
"tags": [
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart to realrepo-001..003: Django view accepts attacker-supplied token + email, overrides token-bound user.email without validating expiry/recipient."
|
|
},
|
|
{
|
|
"case_id": "ts-auth-realrepo-001",
|
|
"file": "typescript/auth/safe_session_user_id_copy.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Distilled from cal.com Next.js handlers (apps/web/app/.../api-keys/page.tsx): `const userId = session.user.id` is a self-actor-id copy through a session-scoped chain. Closes a 10+ FP cluster (fix: src/auth_analysis/extract/common.rs::value_is_self_scoped_session_id_chain + JS variable_declarator dispatch)."
|
|
},
|
|
{
|
|
"case_id": "ts-auth-realrepo-002",
|
|
"file": "typescript/auth/vuln_target_user_id_no_check.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-639",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart to ts-auth-realrepo-001: `userId = req.params.targetUserId` is a foreign id (URL param), not a session copy \u2014 the rule must still fire."
|
|
},
|
|
{
|
|
"case_id": "js-auth-realrepo-001",
|
|
"file": "javascript/auth/safe_req_user_id_copy.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Express handler shape: `const userId = req.user.id` is a self-actor-id copy through the session-scoped `req.user` chain (passport / express-session)."
|
|
},
|
|
{
|
|
"case_id": "ts-auth-realrepo-003",
|
|
"file": "typescript/auth/safe_destructured_session_user.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Destructure shapes: `const { user } = ctx.session` / `const { user } = await getServerSession()` / `const { user: me } = ctx.session` / `const { id } = req.user`. cal.com NextAuth idiom \u2014 destructured local IS the actor (or actor's id), not a foreign tenant id."
|
|
},
|
|
{
|
|
"case_id": "ts-auth-realrepo-004",
|
|
"file": "typescript/auth/safe_trpc_ctx_user_options.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TRPC handler Options-typed parameter cluster (~105 cal.com findings). File-level pre-scan recognises `type GetOptions = { ctx: { user: NonNullable<TrpcSessionUser> } }` aliases; param annotations referencing those aliases populate `self_scoped_session_bases[ctx.user]` per-unit. Bare `ctx.user` is NOT added to the static session-base list (would over-suppress non-TRPC code)."
|
|
},
|
|
{
|
|
"case_id": "ts-auth-realrepo-005",
|
|
"file": "typescript/auth/vuln_trpc_ctx_input_id_no_check.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-639",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Regression guard: same TRPC handler shape as ts-auth-realrepo-004 but the SQL parameter is `input.targetUserId` (request body field), not `ctx.user.id`. The TRPC ctx self-actor exemption must apply ONLY to ctx.user.<id-like> subjects, never to other paths in the same param."
|
|
},
|
|
{
|
|
"case_id": "ts-auth-realrepo-006",
|
|
"file": "typescript/auth/safe_local_collection_receiver.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Excalidraw `Map<K, V>` / `Set<T>` / `WeakMap` / `WeakSet` / `Array<T>` / `T[]` / `readonly T[]` receivers \u2014 direct annotation, same-file `type X = Map<...>` aliasing, and inline `new Map()` constructor. SSA `constructor_type` JS/TS arm + `cfg::params::ts_type_to_local_collection` + `cfg::dto::collect_type_alias_local_collections` route every shape through `TypeKind::LocalCollection` \u2192 `SinkClass::InMemoryLocal`, suppressing missing-ownership."
|
|
},
|
|
{
|
|
"case_id": "ts-auth-realrepo-007",
|
|
"file": "typescript/auth/vuln_local_collection_does_not_blanket_suppress.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-639",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"js.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart to ts-auth-realrepo-006: `prisma.user.findUnique` / `prisma.user.update` with attacker-supplied id and no preceding auth check. Receiver is NOT a tracked Map / Set / Array, so the LocalCollection fix must NOT suppress this \u2014 proves the type-aware suppression doesn't blanket-cover real DB clients that share method names (`get`, `find`, `update`) with JS containers."
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-009",
|
|
"file": "rust/auth/safe_local_user_view_extractor.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-27",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Lemmy `LocalUserView` extractor: `is_self_actor_type_text`'s structural <PREFIX>User<SUFFIX?> recogniser accepts the type, so `local_user_view.person.id` reads of the actor's own id pass `is_actor_context_subject` and the missing-ownership rule does not fire."
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-010",
|
|
"file": "rust/auth/unsafe_local_user_view_extractor.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-285",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "High",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"positive",
|
|
"real-repo-precision-2026-04-27"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Negative counterpart for the LocalUserView recogniser: handler takes the typed extractor but mutates a row by `req.target_user_id` (foreign id) without any ownership check \u2014 must still flag. Guards against an over-broad recogniser that would treat any handler with a self-actor extractor as authorised by default."
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-011",
|
|
"file": "rust/auth/safe_param_type_segment_idents.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-29",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Rust `parameter` arm in `collect_param_names` keeps type-segment idents (`std`, `path`, `Path`) out of `unit.params` so `dst: &std::path::Path` doesn't gate `unit_has_user_input_evidence` open via the framework-name allow-list (`path`). Surfaced from meilisearch/index-scheduler/scheduler/process_snapshot_creation.rs::remove_tasks where `dst: &std::path::Path` made every `db.delete(task.uid)` fire missing-ownership-check."
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-012",
|
|
"file": "rust/auth/safe_local_collection_param_types.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"negative",
|
|
"real-repo-precision-2026-04-29",
|
|
"noise-budget-zero"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Rust function-parameter type annotations naming an in-memory container (`RoaringBitmap`, `HashMap<K,V>`, `HashSet<T>`, `BTreeSet<T>`) classify the receiver as `TypeKind::LocalCollection` \u2192 `SinkClass::InMemoryLocal`, suppressing the verb-name dispatch's DbMutation classification. Surfaced from meilisearch/index-scheduler/scheduler/enterprise_edition/network.rs::balance_shards (`unsharded: RoaringBitmap`). Mirrors the JS/TS `ts_type_to_local_collection` fix from 2026-04-29."
|
|
},
|
|
{
|
|
"case_id": "rs-auth-realrepo-013",
|
|
"file": "rust/auth/unsafe_handler_local_collection_does_not_blanket_suppress.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-285",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rs.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "High",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"positive",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Negative-counterpart guard for the LocalCollection / parameter-name fixes: handler takes a HashMap typed param (in-memory bookkeeping) but ALSO calls `db.update_owner(req.target_user_id, ...)` (real DbMutation). The cache mutation must not blanket-suppress the persistent-store mutation \u2014 the rule must still fire on `db.update_owner`."
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-ar-query-shapes-001",
|
|
"file": "ruby/safe/safe_active_record_query_shapes.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "",
|
|
"provenance": "real-repo-precision-2026-04-27",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cfg-unguarded-sink",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"active-record",
|
|
"rails",
|
|
"sqli",
|
|
"shape-safe",
|
|
"real-repo-precision"
|
|
],
|
|
"disabled": false,
|
|
"notes": "ActiveRecord query methods (where/order/group/having/joins/pluck) with parameter-safe arg-0 shapes (hash, symbol, array, parameterised string) \u2014 Rails escapes the values, no SQLi exposure."
|
|
},
|
|
{
|
|
"case_id": "ruby-sqli-where-string-interp-001",
|
|
"file": "ruby/sqli/sqli_where_string_interpolation.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "real-repo-precision-2026-04-27",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"active-record",
|
|
"rails",
|
|
"sqli",
|
|
"string-interpolation",
|
|
"real-repo-precision"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Counterpart to safe_active_record_query_shapes \u2014 same method becomes a real SQLi sink when arg 0 is a string with #{...} interpolation. Engine must keep flagging this even though the safe-shape fixtures suppress SQL_QUERY at the same callee."
|
|
},
|
|
{
|
|
"case_id": "ruby-sqli-where-chained-interp-001",
|
|
"file": "ruby/sqli/sqli_where_chained_interpolation.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "real-repo-precision-2026-04-27",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"tags": [
|
|
"active-record",
|
|
"rails",
|
|
"sqli",
|
|
"string-interpolation",
|
|
"chained",
|
|
"real-repo-precision"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Chained shape: Model.where(\"...#{x}...\").preload(...).to_a. CFG collapses chained calls into one node whose outermost callee is .to_a (no args). The shape suppressor walks the receiver chain to reach the inner where(...) \u2014 chain-walking only suppresses SAFE shapes, so this dangerous form must still fire."
|
|
},
|
|
{
|
|
"case_id": "ruby-safe-post-fetch-ownership-001",
|
|
"file": "ruby/safe/safe_post_fetch_ownership_check.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "",
|
|
"provenance": "real-repo-precision-2026-04-27",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"rb.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": null,
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"rails",
|
|
"auth",
|
|
"post-fetch-check",
|
|
"real-repo-precision"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Rails canonical \"load by id, then check ownership\" idiom \u2014 row-fetch exemption (row_population_data reverse-walk in auth_check_covers_subject) closes the gap when the per-record permission check appears textually after the fetch."
|
|
},
|
|
{
|
|
"case_id": "ruby-auth-missing-post-fetch-001",
|
|
"file": "ruby/auth/auth_missing_post_fetch_check.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-639",
|
|
"provenance": "real-repo-precision-2026-04-27",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"rb.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"rails",
|
|
"auth",
|
|
"missing-ownership",
|
|
"real-repo-precision"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Counterpart to safe_post_fetch_ownership_check \u2014 same controller shape but the per-record permission check is omitted, so the row-fetch exemption does not fire. Engine must keep flagging this even though the safe-shape fixtures train the exemption on the same Issue.find(params[:id]) pattern."
|
|
},
|
|
{
|
|
"case_id": "java-safe-realrepo-keycloak-001",
|
|
"file": "java/safe/SafeJpaParameterizedExecute.java",
|
|
"language": "java",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "file_presence",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"cfg-unguarded-sink",
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"jpa",
|
|
"parameterized-execute",
|
|
"real-repo-precision-2026-04-28"
|
|
],
|
|
"disabled": false,
|
|
"notes": "JPA executeUpdate()/executeQuery() with zero args after createQuery(LITERAL) is parameterised; engine synthesises same-node Sanitizer(SQL_QUERY) so reflexive dominance suppresses cfg-unguarded-sink. Distilled from keycloak/JpaEventStoreProvider.java."
|
|
},
|
|
{
|
|
"case_id": "java-sqli-realrepo-keycloak-001",
|
|
"file": "java/sqli/SqliJpaCreateQueryConcat.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "sqli",
|
|
"cwe": "CWE-89",
|
|
"provenance": "real-repo-precision-2026-04-28",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"cfg-unguarded-sink"
|
|
],
|
|
"allowed_alternative_rule_ids": [
|
|
"taint-unsanitised-flow"
|
|
],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
18,
|
|
18
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"jpa",
|
|
"concat",
|
|
"real-repo-precision-2026-04-28"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Concatenated SQL passed to em.createQuery(...) \u2014 receiver-chain walk sees binary_expression at arg 0, refuses to synthesise sanitizer, structural sink fires. Regression guard for the JPA parameterised-execute fix."
|
|
},
|
|
{
|
|
"case_id": "py-auth-realrepo-005",
|
|
"file": "python/safe/safe_fastapi_route_dependencies_auth.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"fastapi",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Distilled from airflow api_fastapi/core_api/routes/public/connections.py: FastAPI route decorator carries `dependencies=[Depends(requires_access_connection(method=\"DELETE\"))]`; the Flask extractor's new `dependencies=` kwarg walker plus inject_middleware_auth subject synthesis recognises the auth gate."
|
|
},
|
|
{
|
|
"case_id": "py-auth-realrepo-007",
|
|
"file": "python/safe/safe_fastapi_route_level_row_fetch.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.auth.missing_ownership_check"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"fastapi",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Distilled from airflow api_fastapi/core_api/routes/public/dag_run.py: FastAPI route decorator carries `dependencies=[Depends(requires_access_dag(method=\"GET\"))]`; the route-level guard must cover not only direct path-param subjects (filter_by(dag_id=dag_id)) but also row-variable receivers (`dag.cleanup_runs(...)` after `dag = session.scalar(select(DagModel)...)`). Pinned by the `is_route_level` short-circuit in `auth_check_covers_subject` plus the kind-aware `function_params_route_handler` that includes id-like Python typed params (`dag_id: str`) in `unit.params`."
|
|
},
|
|
{
|
|
"case_id": "py-auth-realrepo-006",
|
|
"file": "python/safe/safe_pytest_sqlalchemy_session.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "N/A",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"py.auth.missing_ownership_check",
|
|
"py.auth.token_override_without_validation"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"pytest",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Distilled from airflow tests/unit/models/test_backfill.py: pytest test methods with SQLAlchemy `session` fixture and `session.commit()` calls. Bare `session.<sqlalchemy_verb>` no longer counts as auth Session evidence; only `session.<identity_field>` (user/user_id/...) does."
|
|
},
|
|
{
|
|
"case_id": "py-auth-realrepo-007",
|
|
"file": "python/auth/vuln_fastapi_route_no_dependencies.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "auth",
|
|
"cwe": "CWE-862",
|
|
"provenance": "real-repo",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"py.auth.missing_ownership_check"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
15,
|
|
15
|
|
]
|
|
],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"auth",
|
|
"fastapi",
|
|
"real-repo-precision-2026-04-29"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Vulnerable counterpart to py-auth-realrepo-005: same FastAPI route shape but no `dependencies=[Depends(...)]` keyword arg. Regression guard: the dependency-injection recogniser must not blanket-suppress every FastAPI route."
|
|
},
|
|
{
|
|
"case_id": "js-data_exfil-001",
|
|
"file": "javascript/data_exfil/exfil_fetch_cookie_body.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"fetch",
|
|
"cookie"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cookie source flows into fetch body at hardcoded URL; DATA_EXFIL must fire and SSRF must not."
|
|
},
|
|
{
|
|
"case_id": "js-data_exfil-002",
|
|
"file": "javascript/data_exfil/exfil_fetch_external_destination.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"fetch",
|
|
"cookie",
|
|
"external-destination"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cookie source flows into fetch body at attacker-controlled host; DATA_EXFIL fires, SSRF does not."
|
|
},
|
|
{
|
|
"case_id": "js-data_exfil-003",
|
|
"file": "javascript/data_exfil/exfil_xhr_send_header.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
8,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"xhr",
|
|
"header"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Authorization header source flows into XMLHttpRequest.send body at hardcoded URL."
|
|
},
|
|
{
|
|
"case_id": "ts-data_exfil-001",
|
|
"file": "typescript/data_exfil/exfil_fetch_cookie_body.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"fetch",
|
|
"cookie"
|
|
],
|
|
"disabled": false,
|
|
"notes": "TypeScript variant of js-data_exfil-001."
|
|
},
|
|
{
|
|
"case_id": "ts-data_exfil-002",
|
|
"file": "typescript/data_exfil/exfil_fetch_header_body.ts",
|
|
"language": "typescript",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
6,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"fetch",
|
|
"header"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Authorization header flows into fetch body at hardcoded URL."
|
|
},
|
|
{
|
|
"case_id": "py-data_exfil-001",
|
|
"file": "python/data_exfil/exfil_requests_post_env_dict.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
14,
|
|
14
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
12,
|
|
13
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"requests",
|
|
"env",
|
|
"container"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Env-config secrets accumulate into a dict, then flow as the json kwarg of requests.post; container-taint round-trip."
|
|
},
|
|
{
|
|
"case_id": "py-data_exfil-002",
|
|
"file": "python/data_exfil/exfil_httpx_async_post_env.py",
|
|
"language": "python",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
15
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
11,
|
|
11
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"httpx",
|
|
"async",
|
|
"env"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Env-config secret flows into httpx.AsyncClient().post json kwarg via the type-qualified HttpClient.post matcher."
|
|
},
|
|
{
|
|
"case_id": "java-data_exfil-001",
|
|
"file": "java/data_exfil/DataExfilJdkHttpClient.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
16,
|
|
20
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
13,
|
|
14
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"jdk-httpclient",
|
|
"cookie"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Servlet cookie value flows through BodyPublishers.ofString into HttpClient.send body."
|
|
},
|
|
{
|
|
"case_id": "java-data_exfil-002",
|
|
"file": "java/data_exfil/DataExfilOkHttp.java",
|
|
"language": "java",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
15,
|
|
21
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
13,
|
|
13
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"okhttp",
|
|
"session"
|
|
],
|
|
"disabled": false,
|
|
"notes": "HttpSession attribute wraps via RequestBody.create and binds to OkHttp Request.Builder.post; chain-normalized newCall.execute fires DATA_EXFIL."
|
|
},
|
|
{
|
|
"case_id": "go-data_exfil-001",
|
|
"file": "go/data_exfil/exfil_http_post_cookie_body.go",
|
|
"language": "go",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
12,
|
|
12
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
10,
|
|
11
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"http-post",
|
|
"cookie"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cookie value flows via strings.NewReader into http.Post body at hardcoded URL."
|
|
},
|
|
{
|
|
"case_id": "rs-data_exfil-001",
|
|
"file": "rust/data_exfil/exfil_reqwest_form_env.rs",
|
|
"language": "rust",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
5,
|
|
8
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
5,
|
|
5
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"reqwest",
|
|
"form",
|
|
"env"
|
|
],
|
|
"disabled": false,
|
|
"notes": "env::var secret flows into reqwest .form() body chain via the form.send body-bind matcher."
|
|
},
|
|
{
|
|
"case_id": "rb-data_exfil-001",
|
|
"file": "ruby/data_exfil/exfil_net_http_post_cookie.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "HIGH",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
7,
|
|
7
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"net-http",
|
|
"cookie"
|
|
],
|
|
"disabled": false,
|
|
"notes": "request.cookies value flows into Net::HTTP.post body at hardcoded URL."
|
|
},
|
|
{
|
|
"case_id": "c-data_exfil-001",
|
|
"file": "c/data_exfil/exfil_curl_postfields_env.c",
|
|
"language": "c",
|
|
"is_vulnerable": true,
|
|
"vuln_class": "data_exfil",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [],
|
|
"expected_severity": "MEDIUM",
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [
|
|
[
|
|
14,
|
|
14
|
|
]
|
|
],
|
|
"expected_source_lines": [
|
|
[
|
|
9,
|
|
9
|
|
]
|
|
],
|
|
"tags": [
|
|
"data_exfil",
|
|
"curl",
|
|
"gated-sink",
|
|
"env"
|
|
],
|
|
"disabled": false,
|
|
"notes": "getenv secret flows into curl_easy_setopt CURLOPT_POSTFIELDS body; gated-sink fires only at the body-binding setopt."
|
|
},
|
|
{
|
|
"case_id": "js-safe-data_exfil-001",
|
|
"file": "javascript/safe/safe_data_exfil_sanitizer_wrap.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"data_exfil",
|
|
"safe",
|
|
"sanitizer-wrap"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Cookie source routed through default forwarding-wrapper sanitizer (logEvent); DATA_EXFIL must not fire."
|
|
},
|
|
{
|
|
"case_id": "js-safe-data_exfil-002",
|
|
"file": "javascript/safe/safe_data_exfil_user_input_echo.js",
|
|
"language": "javascript",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"data_exfil",
|
|
"safe",
|
|
"user-input-gate"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Plain user input echoed into fetch body at fixed URL; sensitivity-gate suppresses Plain-tier sources for Cap::DATA_EXFIL."
|
|
},
|
|
{
|
|
"case_id": "py-safe-data_exfil-001",
|
|
"file": "python/safe/safe_data_exfil_user_input_echo.py",
|
|
"language": "python",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"data_exfil",
|
|
"safe",
|
|
"user-input-gate"
|
|
],
|
|
"disabled": false,
|
|
"notes": "Flask form-field echoed into requests.post json at fixed URL; sensitivity-gate suppresses Plain-tier user input."
|
|
},
|
|
{
|
|
"case_id": "go-safe-data_exfil-001",
|
|
"file": "go/safe/safe_data_exfil_user_input_echo.go",
|
|
"language": "go",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"data_exfil",
|
|
"safe",
|
|
"user-input-gate"
|
|
],
|
|
"disabled": false,
|
|
"notes": "FormValue plain user input echoed into http.Post body at fixed URL; sensitivity-gate suppresses Plain-tier sources."
|
|
},
|
|
{
|
|
"case_id": "rb-safe-data_exfil-001",
|
|
"file": "ruby/safe/safe_data_exfil_user_input_echo.rb",
|
|
"language": "ruby",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"data_exfil",
|
|
"safe",
|
|
"user-input-gate"
|
|
],
|
|
"disabled": false,
|
|
"notes": "params plain user input echoed into RestClient.post body at fixed URL; sensitivity-gate suppresses Plain-tier sources."
|
|
},
|
|
{
|
|
"case_id": "c-safe-data_exfil-001",
|
|
"file": "c/safe/safe_data_exfil_user_input_echo.c",
|
|
"language": "c",
|
|
"is_vulnerable": false,
|
|
"vuln_class": "safe",
|
|
"cwe": "CWE-201",
|
|
"provenance": "synthetic",
|
|
"equivalence_tier": "exact",
|
|
"match_mode": "rule_match",
|
|
"expected_rule_ids": [],
|
|
"allowed_alternative_rule_ids": [],
|
|
"forbidden_rule_ids": [
|
|
"taint-data-exfiltration"
|
|
],
|
|
"expected_severity": null,
|
|
"expected_category": "Security",
|
|
"expected_sink_lines": [],
|
|
"expected_source_lines": [],
|
|
"tags": [
|
|
"data_exfil",
|
|
"safe",
|
|
"user-input-gate"
|
|
],
|
|
"disabled": false,
|
|
"notes": "fgets stdin user input echoed into curl_easy_setopt CURLOPT_POSTFIELDS at fixed URL; sensitivity-gate suppresses Plain-tier sources."
|
|
}
|
|
]
|
|
} |