Skip to content

test-cases: add CWE-287 (go) #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
CSTRSK wants to merge 3 commits into from
Closed

test-cases: add CWE-287 (go) #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d518890
test-cases: add CWE-77 (JS shelljs), CWE-912 (Java backdoor), CWE-23 …
CSTRSK Aug 8, 2026
b411304
test-cases: add CWE-307, CWE-285, CWE-200, CWE-400
CSTRSK Aug 8, 2026
02a54c3
test-cases: add CWE-287 (go)
CSTRSK Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions docs/VULNERABILITY_CATALOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@ from each file's header comment, so this page cannot drift from the source.

## Totals

- **Test cases:** 62
- **Expected detections:** 62
- **`VULNERABLE:` markers:** 123 (individual lines a scanner should flag)
- **`SAFE:` markers:** 73 (lines a scanner must not flag — the false-positive control group)
- **Test cases:** 70
- **Expected detections:** 70
- **`VULNERABLE:` markers:** 132 (individual lines a scanner should flag)
- **`SAFE:` markers:** 77 (lines a scanner must not flag — the false-positive control group)
- **Languages:** 8 — dotenv, go, java, javascript, json, python, ruby, text
- **CWE categories:** 46 — CWE-20, CWE-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-95, CWE-113, CWE-117, CWE-190, CWE-201, CWE-209, CWE-256, CWE-295, CWE-321, CWE-327, CWE-330, CWE-338, CWE-346, CWE-347, CWE-352, CWE-362, CWE-377, CWE-384, CWE-489, CWE-502, CWE-506, CWE-532, CWE-601, CWE-611, CWE-614, CWE-639, CWE-643, CWE-681, CWE-759, CWE-798, CWE-862, CWE-915, CWE-918, CWE-942, CWE-943, CWE-1236, CWE-1321, CWE-1333, CWE-1336, CWE-1357
- **CWE categories:** 54 — CWE-20, CWE-22, CWE-23, CWE-77, CWE-78, CWE-79, CWE-89, CWE-90, CWE-95, CWE-113, CWE-117, CWE-190, CWE-200, CWE-201, CWE-209, CWE-256, CWE-285, CWE-287, CWE-295, CWE-307, CWE-321, CWE-327, CWE-330, CWE-338, CWE-346, CWE-347, CWE-352, CWE-362, CWE-377, CWE-384, CWE-400, CWE-489, CWE-502, CWE-506, CWE-532, CWE-601, CWE-611, CWE-614, CWE-639, CWE-643, CWE-681, CWE-759, CWE-798, CWE-862, CWE-912, CWE-915, CWE-918, CWE-942, CWE-943, CWE-1236, CWE-1321, CWE-1333, CWE-1336, CWE-1357

## How coverage is scored

Expand All @@ -26,24 +26,30 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.

| Test case | File | CWE | Severity | Expected | Markers |
|---|---|---|---|---|---|
| Authentication bypass via JWT algorithm confusion (none algorithm) | [`cwe-287-go.go`](../vulns/go/cwe-287-go.go) | CWE-287 | critical | yes | 1 vuln / 1 safe |
| OS command injection via exec.Command with a shell | [`cmd-injection-exec.go`](../vulns/go/cmd-injection-exec.go) | CWE-78 | critical | yes | 2 vuln / 1 safe |
| Integer overflow and unchecked narrowing conversion | [`integer-overflow.go`](../vulns/go/integer-overflow.go) | CWE-190 | medium | yes | 2 vuln / 3 safe |
| SQL injection via fmt.Sprintf | [`sqli-fmt-sprintf.go`](../vulns/go/sqli-fmt-sprintf.go) | CWE-89 | critical | yes | 2 vuln / 1 safe |
| Server-side request forgery via http.Get on a user-supplied URL | [`ssrf-http-get.go`](../vulns/go/ssrf-http-get.go) | CWE-918 | high | yes | 2 vuln / 2 safe |
| Full stack trace leaked to client on unhandled error | [`stack-trace-exposed.go`](../vulns/go/stack-trace-exposed.go) | CWE-200 | medium | yes | 1 vuln / 0 safe |

## Java

| Test case | File | CWE | Severity | Expected | Markers |
|---|---|---|---|---|---|
| Insecure deserialisation via ObjectInputStream | [`deserialization-object-input-stream.java`](../vulns/java/deserialization-object-input-stream.java) | CWE-502 | critical | yes | 2 vuln / 2 safe |
| Hidden administrative backdoor endpoint behind an innocuous path | [`hidden-backdoor-endpoint.java`](../vulns/java/hidden-backdoor-endpoint.java) | CWE-912 | critical | yes | 1 vuln / 0 safe |
| SQL injection via Statement string concatenation | [`sqli-statement-concat.java`](../vulns/java/sqli-statement-concat.java) | CWE-89 | critical | yes | 2 vuln / 1 safe |
| Unbounded accumulation of request bodies into memory | [`unbounded-request-collection.java`](../vulns/java/unbounded-request-collection.java) | CWE-400 | medium | yes | 1 vuln / 0 safe |
| Reflected XSS via HttpServletResponse writer | [`xss-response-writer.java`](../vulns/java/xss-response-writer.java) | CWE-79 | high | yes | 2 vuln / 2 safe |
| XXE via unconfigured DocumentBuilderFactory | [`xxe-document-builder.java`](../vulns/java/xxe-document-builder.java) | CWE-611 | high | yes | 2 vuln / 1 safe |

## JavaScript

| Test case | File | CWE | Severity | Expected | Markers |
|---|---|---|---|---|---|
| Login endpoint without rate limiting or lockout | [`bruteforce-no-rate-limit.js`](../vulns/javascript/bruteforce-no-rate-limit.js) | CWE-307 | medium | yes | 2 vuln / 0 safe |
| Command injection via shelljs exec with unsanitized input | [`command-injection-shelljs.js`](../vulns/javascript/command-injection-shelljs.js) | CWE-77 | high | yes | 1 vuln / 1 safe |
| Sensitive session cookie without the Secure attribute | [`cookie-security-flags.js`](../vulns/javascript/cookie-security-flags.js) | CWE-614 | medium | yes | 1 vuln / 1 safe |
| Credentialed CORS configured with a wildcard origin | [`cors-wildcard-credentials.js`](../vulns/javascript/cors-wildcard-credentials.js) | CWE-942 | high | yes | 1 vuln / 1 safe |
| CSRF via missing anti-CSRF token on state-changing POST | [`csrf-missing-token.js`](../vulns/javascript/csrf-missing-token.js) | CWE-352 | high | yes | 3 vuln / 1 safe |
Expand Down Expand Up @@ -92,6 +98,7 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.
| Password hashing without a salt | [`weak-password-hash.py`](../vulns/python/weak-password-hash.py) | CWE-759 | high | yes | 1 vuln / 1 safe |
| XPath injection via string interpolation | [`xpath-injection.py`](../vulns/python/xpath-injection.py) | CWE-643 | high | yes | 1 vuln / 1 safe |
| XSS via Jinja2 autoescape disabled and server-side template injection | [`xss-jinja2-autoescape-off.py`](../vulns/python/xss-jinja2-autoescape-off.py) | CWE-79 | high | yes | 3 vuln / 1 safe |
| Object-level authorization missing on document fetch | [`missing-object-level-authz.py`](../vulns/python/missing-object-level-authz.py) | CWE-285 | high | yes | 1 vuln / 1 safe |

## Ruby

Expand All @@ -100,6 +107,7 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.
| Code and command injection via eval / send / backticks | [`rce-eval.rb`](../vulns/ruby/rce-eval.rb) | CWE-95 | critical | yes | 3 vuln / 1 safe |
| SQL injection via string interpolation in ActiveRecord | [`sqli-string-interpolation.rb`](../vulns/ruby/sqli-string-interpolation.rb) | CWE-89 | critical | yes | 3 vuln / 1 safe |
| XSS via html_safe / raw on untrusted input | [`xss-erb-html-safe.rb`](../vulns/ruby/xss-erb-html-safe.rb) | CWE-79 | high | yes | 3 vuln / 1 safe |
| Relative path traversal in File.open via unsanitized user input | [`relative-path-traversal.rb`](../vulns/ruby/relative-path-traversal.rb) | CWE-23 | high | yes | 1 vuln / 1 safe |

## Secrets & Credentials

Expand Down
193 changes: 189 additions & 4 deletions vulns/VULNERABILITY_CATALOG.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@
"schema": "threatcrush-testbed-catalog/1",
"note": "Generated by scripts/generate-catalog.py \u2014 do not edit by hand.",
"totals": {
"test_cases": 62,
"expected_detections": 62,
"vulnerable_markers": 123,
"safe_markers": 73,
"test_cases": 70,
"expected_detections": 70,
"vulnerable_markers": 132,
"safe_markers": 77,
"languages": [
"dotenv",
"go",
Expand All @@ -28,6 +28,8 @@
"cwes": [
"CWE-20",
"CWE-22",
"CWE-23",
"CWE-77",
"CWE-78",
"CWE-79",
"CWE-89",
Expand All @@ -36,10 +38,14 @@
"CWE-113",
"CWE-117",
"CWE-190",
"CWE-200",
"CWE-201",
"CWE-209",
"CWE-256",
"CWE-285",
"CWE-287",
"CWE-295",
"CWE-307",
"CWE-321",
"CWE-327",
"CWE-330",
Expand All @@ -50,6 +56,7 @@
"CWE-362",
"CWE-377",
"CWE-384",
"CWE-400",
"CWE-489",
"CWE-502",
"CWE-506",
Expand All @@ -63,6 +70,7 @@
"CWE-759",
"CWE-798",
"CWE-862",
"CWE-912",
"CWE-915",
"CWE-918",
"CWE-942",
Expand Down Expand Up @@ -99,6 +107,29 @@
46
]
},
{
"id": "go-auth-bypass-jwt-none-alg",
"file": "vulns/go/cwe-287-go.go",
"title": "Authentication bypass via JWT algorithm confusion (none algorithm)",
"category": "go",
"language": "go",
"cwe": "CWE-287",
"cwes": [
"CWE-287"
],
"severity": "critical",
"expected_detection": true,
"description": "The application accepts JWT tokens signed with the \"none\" algorithm,",
"detection_target": "Taint flow from request header into JWT parsing with the",
"safe_guard": "Guarded by the always-false `neverRun` constant plus an `ignore`",
"attribution": "line",
"vulnerable_lines": [
54
],
"safe_lines": [
73
]
},
{
"id": "go-integer-overflow",
"file": "vulns/go/integer-overflow.go",
Expand Down Expand Up @@ -175,6 +206,27 @@
56
]
},
{
"id": "go-stack-trace-exposed",
"file": "vulns/go/stack-trace-exposed.go",
"title": "Full stack trace leaked to client on unhandled error",
"category": "go",
"language": "go",
"cwe": "CWE-200",
"cwes": [
"CWE-200"
],
"severity": "medium",
"expected_detection": true,
"description": "An HTTP handler writes err.Error() and runtime stack traces",
"detection_target": "err.Error() / debug.Stack() written to the response body;",
"safe_guard": "Both handlers are unreachable: the file is guarded by a",
"attribution": "line",
"vulnerable_lines": [
31
],
"safe_lines": []
},
{
"id": "java-deserialization-object-input-stream",
"file": "vulns/java/deserialization-object-input-stream.java",
Expand All @@ -200,6 +252,27 @@
62
]
},
{
"id": "java-hidden-backdoor-endpoint",
"file": "vulns/java/hidden-backdoor-endpoint.java",
"title": "Hidden administrative backdoor endpoint behind an innocuous path",
"category": "java",
"language": "java",
"cwe": "CWE-912",
"cwes": [
"CWE-912"
],
"severity": "critical",
"expected_detection": true,
"description": "A servlet-style handler maps a harmless-looking path",
"detection_target": "Hardcoded magic tokens compared against request input;",
"safe_guard": "The doGet method is unreachable: the class is only referenced",
"attribution": "line",
"vulnerable_lines": [
23
],
"safe_lines": []
},
{
"id": "java-sqli-statement-concat",
"file": "vulns/java/sqli-statement-concat.java",
Expand All @@ -224,6 +297,27 @@
56
]
},
{
"id": "java-unbounded-request-collection",
"file": "vulns/java/unbounded-request-collection.java",
"title": "Unbounded accumulation of request bodies into memory",
"category": "java",
"language": "java",
"cwe": "CWE-400",
"cwes": [
"CWE-400"
],
"severity": "medium",
"expected_detection": true,
"description": "A servlet reads the entire request body into a byte array via",
"detection_target": "readAllBytes() / readNBytes(MAX_VALUE) on request input;",
"safe_guard": "The servlet class is only referenced inside if (NEVER_RUN)",
"attribution": "line",
"vulnerable_lines": [
24
],
"safe_lines": []
},
{
"id": "java-xss-response-writer",
"file": "vulns/java/xss-response-writer.java",
Expand Down Expand Up @@ -273,6 +367,51 @@
46
]
},
{
"id": "js-bruteforce-no-rate-limit",
"file": "vulns/javascript/bruteforce-no-rate-limit.js",
"title": "Login endpoint without rate limiting or lockout",
"category": "javascript",
"language": "javascript",
"cwe": "CWE-307",
"cwes": [
"CWE-307"
],
"severity": "medium",
"expected_detection": true,
"description": "A login handler validates credentials without any rate limit,",
"detection_target": "Missing rate limiting / lockout on credential validation;",
"safe_guard": "Both handlers are unreachable behind if (false); no request",
"attribution": "line",
"vulnerable_lines": [
27,
29
],
"safe_lines": []
},
{
"id": "js-command-injection-shelljs",
"file": "vulns/javascript/command-injection-shelljs.js",
"title": "Command injection via shelljs exec with unsanitized input",
"category": "javascript",
"language": "javascript",
"cwe": "CWE-77",
"cwes": [
"CWE-77"
],
"severity": "high",
"expected_detection": true,
"description": "A user-supplied filename is concatenated directly into a",
"detection_target": "exec() called with a string built by concatenation of",
"safe_guard": "Both functions are unreachable behind if (false); the child",
"attribution": "line",
"vulnerable_lines": [
29
],
"safe_lines": [
37
]
},
{
"id": "js-cookie-security-flags",
"file": "vulns/javascript/cookie-security-flags.js",
Expand Down Expand Up @@ -959,6 +1098,29 @@
27
]
},
{
"id": "python-missing-object-level-authz",
"file": "vulns/python/missing-object-level-authz.py",
"title": "Object-level authorization missing on document fetch",
"category": "python",
"language": "python",
"cwe": "CWE-285",
"cwes": [
"CWE-285"
],
"severity": "high",
"expected_detection": true,
"description": "An API endpoint returns a document by ID without verifying that",
"detection_target": "Fetching a resource by ID without an ownership/ACL check;",
"safe_guard": "Both handlers are unreachable behind `if False:`; no database",
"attribution": "line",
"vulnerable_lines": [
23
],
"safe_lines": [
30
]
},
{
"id": "py-negative-price-validation",
"file": "vulns/python/negative-price-validation.py",
Expand Down Expand Up @@ -1331,6 +1493,29 @@
47
]
},
{
"id": "ruby-relative-path-traversal",
"file": "vulns/ruby/relative-path-traversal.rb",
"title": "Relative path traversal in File.open via unsanitized user input",
"category": "ruby",
"language": "ruby",
"cwe": "CWE-23",
"cwes": [
"CWE-23"
],
"severity": "high",
"expected_detection": true,
"description": "A user-supplied filename is joined with a base directory and",
"detection_target": "File.open/File.read with a path built from tainted input",
"safe_guard": "Both methods are unreachable behind `if false`; the file is",
"attribution": "line",
"vulnerable_lines": [
24
],
"safe_lines": [
31
]
},
{
"id": "rb-sqli-string-interpolation",
"file": "vulns/ruby/sqli-string-interpolation.rb",
Expand Down
Loading
Loading