mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
a438886217
* refactor: Update comments for clarity and add expectations.json files for performance metrics * feat: Implement FP guard for JS/TS local-collection receivers to suppress missing ownership checks * feat: Enhance Rust parameter handling to classify local collections and prevent false ownership checks * refactor: Simplify code formatting for better readability in multiple files * refactor: Improve UTF-8 sequence length handling and enhance clarity in loop iteration * feat: Update Java and Python patterns to include new security rules * refactor: Improve comment clarity and consistency across multiple Rust files * refactor: Simplify code formatting for improved readability in integration tests and module files * refactor: Improve comment formatting and enhance clarity in assertions across multiple files
59 lines
1.3 KiB
Python
59 lines
1.3 KiB
Python
# Positive fixture: each snippet should trigger the named pattern.
|
|
|
|
import os
|
|
import subprocess
|
|
import pickle
|
|
import yaml
|
|
import hashlib
|
|
|
|
# py.code_exec.eval
|
|
def trigger_eval(data):
|
|
result = eval(data)
|
|
|
|
# py.code_exec.exec
|
|
def trigger_exec(code):
|
|
exec(code)
|
|
|
|
# py.code_exec.compile
|
|
def trigger_compile(code):
|
|
co = compile(code, "<string>", "exec")
|
|
|
|
# py.cmdi.os_system
|
|
def trigger_os_system(cmd):
|
|
os.system(cmd)
|
|
|
|
# py.cmdi.os_popen
|
|
def trigger_os_popen(cmd):
|
|
os.popen(cmd)
|
|
|
|
# py.cmdi.subprocess_shell
|
|
def trigger_subprocess_shell(cmd):
|
|
subprocess.run(cmd, shell=True)
|
|
|
|
# py.deser.pickle_loads
|
|
def trigger_pickle(data):
|
|
obj = pickle.loads(data)
|
|
|
|
# py.deser.yaml_load
|
|
def trigger_yaml(data):
|
|
obj = yaml.load(data)
|
|
|
|
# py.sqli.execute_format
|
|
def trigger_sql_concat(cursor, user):
|
|
cursor.execute("SELECT * FROM users WHERE name = '" + user + "'")
|
|
|
|
# py.sqli.execute_format (f-string variant)
|
|
def trigger_sql_fstring(cursor, user):
|
|
cursor.execute(f"SELECT * FROM users WHERE name = '{user}'")
|
|
|
|
# py.sqli.text_format
|
|
def trigger_sqlalchemy_text_fstring(connection, user):
|
|
connection.execute(text(f"SELECT * FROM users WHERE name = '{user}'"))
|
|
|
|
# py.crypto.md5
|
|
def trigger_md5(data):
|
|
hashlib.md5(data)
|
|
|
|
# py.crypto.sha1
|
|
def trigger_sha1(data):
|
|
hashlib.sha1(data)
|