Testable WhiteBox Python Sample Repository

Purpose: A single Python repository designed to trigger all 103 Testable white-box metrics for Python, as defined in Testable_Metrics_Tools_Versions_v2.xlsx and derived from Testable_Strategy_Metrics_Mapping_v0.2.xlsx. #Test

---

Testing

Quick Start

# 1. Clone and enter
git clone <repo-url>
cd testable-whitebox-python

# 2. Install all tools
pip install -r requirements.txt
npm install -g jscpd        # for code-duplication metric

# 3. Run ALL metrics in one command
# Linux/macOS
bash scripts/run_all_metrics.sh

# Windows PowerShell
.\scripts\run_all_metrics.ps1

# 4. View reports
ls reports/

testing

---

Repository Structure

testable-whitebox-python/
├── src/
│   ├── calculator.py        # CC + MC-DC + data-flow + path coverage
│   ├── complex_logic.py     # CC > 20, Cognitive Complexity, state machine
│   ├── auth.py              # SAST (Bandit + Semgrep) – SQL injection, weak crypto
│   ├── data_processor.py    # Data-flow (Beniget) – def-use chains, dead data
│   ├── duplicated_code.py   # Code duplication (jscpd / copydetect)
│   ├── file_handler.py      # Branch/Path coverage, exception paths, dead code
│   ├── api_client.py        # SCA / dependency risk (pip-audit / safety)
│   └── utils.py             # Lint violations (pylint + flake8)
├── tests/
│   ├── test_calculator.py
│   ├── test_complex_logic.py
│   ├── test_data_processor.py
│   ├── test_file_handler.py
│   ├── test_duplicated_code.py
│   ├── test_auth.py
│   └── test_utils.py
├── scripts/
│   ├── run_all_metrics.sh   # Bash (Linux/macOS/CI)
│   ├── run_all_metrics.ps1  # PowerShell (Windows)
│   ├── run_beniget.py       # Def-use chain helper
│   └── run_churn.py         # Code churn helper
├── .github/workflows/
│   └── whitebox-metrics.yml # GitHub Actions CI – runs all tools
├── reports/                 # Generated by scripts (git-ignored)
├── .coveragerc
├── .flake8
├── .pylintrc
├── .bandit
├── .semgrep.yml
├── pyproject.toml
└── requirements.txt

---

Metric → Code → Tool Mapping

All 103 metrics from Testable_Metrics_Tools_Versions_v2.xlsx (Python column).

L2: Structural Analysis — Cyclomatic Complexity

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
1	Static Analysis Metric	Execution Path Integrity	calculator.py, complex_logic.py	compute_insurance_premium() (CC=12), schedule_task() (CC=22)	Crosshair / McCabe
2	Decision Coverage	Decision Outcome Verification	calculator.py	grade_student() – 8 branches, all exercised in tests	Coverage.py / McCabe
3	Condition Coverage	Logical Sub-expression Validation	calculator.py, complex_logic.py	classify_score(score, is_bonus, is_premium) – compound and/or	pymcdc / McCabe
4	Logic Coverage Metric	Total Logical Combinatorial Coverage	complex_logic.py	access_control(a,b,c,d) – 4 independent booleans	Crosshair / McCabe
5	Maintainability Analysis	Technical Debt Impact	complex_logic.py	schedule_task() CC > 20, documented refactoring comments	Radon/Lizard / McCabe
6	Test Prioritization	QA Resource Allocation	All src/	pytest-testmon traces changed files → selective re-run	pytest-testmon / McCabe

L2: Readability / Maintainability — Cognitive Complexity

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
7	Maintainability Evaluation	Technical Debt Impact	complex_logic.py	4 levels of nesting in schedule_task()	radon
8	Testability Analysis	Unit Test Complexity	complex_logic.py	schedule_task() – 19 test cases required	radon
9	Risk Detection	Defect Probability	complex_logic.py	Hotspot: schedule_task() CogCC > 20	radon
10	Refactoring Guidance	Modularization Opportunity	complex_logic.py	schedule_task() annotated with # could be split into 5 helpers	radon
11	Code Review Support	Reviewer Fatigue Factor	complex_logic.py	Long function with 8+ decision paths	radon
12	Testing Effort Prioritization	QA Resource Allocation	complex_logic.py	All CogCC > 15 functions have dedicated test cases	radon
13	Code Understandability Analysis	Human Cognitive Load	complex_logic.py	schedule_task() – 4-level nesting with recursive context	radon

L2: Code Quality Auditing — Code Duplication

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
14	Defect Propagation Risk Detection	Multi-Point Failure Probability	duplicated_code.py	3 clones of order processing (Clone Group A)	jscpd / copydetect
15	Refactoring Identification	Redundancy Localization	duplicated_code.py	Clone Groups A, B, C — each group flagged with location	jscpd / copydetect
16	Code Quality Assessment	Structural Cleanliness Score	duplicated_code.py	>15% duplication in file — triggers cleanliness threshold	jscpd / copydetect
17	Test Maintenance Reduction	Test Suite Streamlining	tests/test_duplicated_code.py	3 near-identical test blocks for cloned functions	jscpd / copydetect
18	Refactoring Opportunity Detection	Abstraction Potential	duplicated_code.py	Order processing logic extractable to process_order()	jscpd / copydetect
19	Risk-Based Testing Prioritization	Regression Focus Mapping	duplicated_code.py	High-churn duplicated blocks	jscpd / copydetect
20	Maintainability Testing	Synchronization Verification	duplicated_code.py	process_retail_order vs process_wholesale_order (identical)	jscpd / copydetect

L2: Static Code Analysis — Lint / Rule Violations

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
21	Rule Detection Test	Violation Density per KLOC	utils.py	Multiple violations: C0103, E501, F841, W0612 in < 100 LOC	pylint / flake8
22	Unused Variable Detection	Resource Waste Identification	utils.py	temp = "throwaway" – never used (F841/W0612)	pylint / flake8
23	Naming Convention Validation	Semantic Consistency Score	utils.py	getUserName() camelCase vs get_user_age() snake_case (C0103)	pylint / flake8
24	Code Style Rule Validation	Syntactic Uniformity Score	utils.py	Mixed quote styles CONFIG_A/CONFIG_B, long lines (E501)	pylint / flake8
25	Complexity Rule Detection	Structural Threshold Monitoring	utils.py	high_branch_count() – 12+ branches, triggers R0912	pylint / flake8
26	Rule Severity Classification	Impact Prioritization	utils.py	Mix of Error (E), Warning (W), Convention (C) severity violations	pylint / flake8
27	Multiple Violations Detection	Aggregated Risk Assessment	utils.py	bad_style_aggregated() – C0103 × 4, F841 × 1	pylint / flake8
28	False Positive Prevention	Accuracy Tuning	.pylintrc, .flake8	Per-file # noqa and disable= comments configured	pylint / flake8
29	Custom Rule Validation	Project-Specific Enforcement	utils.py	compute_tax() missing type hints — custom rule would fire	pylint / flake8
30	Configuration File Handling	Environment Standardization	.pylintrc, .flake8, pyproject.toml	All tools configured from project-level config files	pylint / flake8
31	CI/CD Integration Validation	Automated Gatekeeping	.github/workflows/whitebox-metrics.yml	flake8 + pylint run as CI steps; non-zero exit = gate fail	pylint / flake8
32	Violation Reporting Validation	Quality Audit Trail	reports/pylint_report.json	JSON output captured for audit trail	pylint / flake8

L2: Security White-box Testing — SAST (Static Vulnerabilities)

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
33	Secure Coding Validation	Best Practice Compliance	auth.py	Hardcoded DEFAULT_ADMIN_PASSWORD (B105), eval (B307)	Semgrep OSS + Bandit
34	Input Validation Testing	Entry Point Sanitization	auth.py	login() — no length check, no sanitization	Semgrep + Bandit
35	Data Flow Security Analysis	Sensitive Information Tracking	auth.py	audit_login() prints raw password to stdout (CWE-532)	Semgrep + Bandit
36	Auth & Authorization Weakness	Access Control Verification	auth.py	delete_user() — any non-empty role passes (missing == "ADMIN")	Semgrep + Bandit
37	Dependency & Library Vuln Detection	Supply Chain Security	requirements.txt, api_client.py	Old requests==2.25.1, urllib3==1.26.4 with known CVEs	Semgrep + Bandit
38	Compliance & Security Standard	Regulatory Alignment	auth.py	MD5 (B303), pickle (B301), subprocess shell=True (B602)	Semgrep + Bandit
39	Security Vulnerability Detection	Exploit Surface Identification	auth.py	SQL injection (B608), eval (B307), path traversal	Semgrep + Bandit

L2: Security White-box Testing — Dependency Risk (SCA)

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
40	Transitive Dependency Analysis	Hidden Relationship Mapping	requirements.txt	urllib3 pulled by requests — both pinned old	pip-audit / safety
41	License Compliance Testing	Legal Risk Validation	requirements.txt	pip-licenses scans all installed packages	pip-audit / safety
42	Supply Chain Security Analysis	Trust Integrity Verification	requirements.txt	pip-audit checks against OSV database	pip-audit / safety
43	Dependency Health Monitoring	Community Vitality Tracking	requirements.txt	Old Pillow==8.2.0, cryptography==3.4.7	pip-audit / safety
44	Risk Prioritization	Mitigation Effort Ranking	requirements.txt	pip-audit JSON output ranks CVEs by severity	pip-audit / safety
45	Continuous Dependency Monitoring	Real-Time Alerting	.github/workflows/whitebox-metrics.yml	pip-audit runs on every push	pip-audit / safety
46	Vulnerability Dependency Detection	Known CVE Count	requirements.txt	requests==2.25.1, PyYAML==5.3.1, Pillow==8.2.0	pip-audit / safety
47	Outdated Dependency Detection	Version Lag Assessment	requirements.txt, api_client.py	PINNED_DEPS dict with documented old versions	pip-audit / safety

L2: Control Flow Testing — Statement Coverage

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
48	Unit Testing Support	Test Case Granularity	All tests/	Each function has dedicated test class	Coverage.py / pytest-cov
49	Dead Code Detection	Unreachable Logic Identification	calculator.py, file_handler.py	result = result + 1 after return (dead code lines)	Coverage.py / pytest-cov
50	Test Completeness Evaluation	Coverage Gap Analysis	file_handler.py	size > 1_000_000 branch not tested → gap in report	Coverage.py / pytest-cov
51	Basic Logic Validation	Surface-Level Correctness	calculator.py	add(), subtract(), multiply() fully covered	Coverage.py / pytest-cov
52	Code Execution Verification	Statement Coverage %	All src/	--cov-report=term-missing shows per-line coverage	Coverage.py / pytest-cov

L2: Control Flow Testing — Branch Coverage

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
53	Conditional Logic Testing	Boolean Accuracy Check	calculator.py	classify_score() – 9 branch tests cover T/F per condition	Coverage.py / pytest-cov --cov-branch
54	Control Flow Validation	Sequence Integrity Mapping	complex_logic.py	transition_state() – all 6 valid transitions tested	Coverage.py
55	Loop Condition Testing	Iteration Boundary Verification	calculator.py, file_handler.py	factorial(0), factorial(1), factorial(5) – loop 0/1/N	Coverage.py
56	Edge Case Detection	Boundary Failure Identification	complex_logic.py	categorise_temperature(-273.15), (0), (50)	Coverage.py
57	Logic Error Detection	Branch Misdirection Discovery	calculator.py	All grade boundaries tested (90/80/70/60/50)	Coverage.py
58	Test Case Completeness	Decision Coverage Gap Analysis	file_handler.py	size > 1_000_000 branch intentionally untested = gap	Coverage.py
59	Decision Outcome Verification	Branch Coverage %	All src/	--cov-branch with XML report	Coverage.py

L2: Control Flow Testing — Path Coverage

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
60	Path Execution Tracking	Path Execution Tracking	calculator.py, complex_logic.py	Each distinct path through compute_insurance_premium()	Coverage.py + AST
61	Complete Coverage Path Verification	Full Logic Validation	complex_logic.py	19 test cases cover all 22 paths of schedule_task()	Coverage.py
62	Partial Path Coverage Detection	Gap Identification	file_handler.py	Large-file branch path not exercised	Coverage.py
63	Nested Condition Path Testing	Deep Logic Probing	complex_logic.py	4-level nested if in schedule_task()	Coverage.py
64	Loop Path Detection	Iterative Route Analysis	complex_logic.py	flatten() recursive paths: empty, flat, nested, deep	Coverage.py
65	Unreachable Path Detection	Ghost Code Discovery	calculator.py, file_handler.py	Statements after return — never executed	Coverage.py
66	Exception Path Handling	Error Flow Verification	file_handler.py	safe_read_lines() – FileNotFoundError, PermissionError, UnicodeDecodeError	Coverage.py
67	Multi-Function Path Tracking	Cross-Component Mapping	file_handler.py	get_config_value → _load_config → read_json_file chain	Coverage.py
68	CI/CD Integration Test	Automated Quality Enforcement	.github/workflows/	Coverage step with --cov-fail-under=70 gate	Coverage.py
69	Path Detection Testing	Path Coverage %	All src/	coverage.py + ast paths analysis in scripts	Coverage.py

L2: Mutation Testing — Mutation Score

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
70	Fault Detection Capability	Logic Error Sensitivity	tests/test_calculator.py	Tight assertions kill + → -, >= → > mutations	cosmic-ray / mutmut
71	Test Coverage Quality	Test Rigor Assessment	tests/test_complex_logic.py	Status assertions kill state-machine mutations	cosmic-ray / mutmut
72	Test Case Improvement	Weak Spot Localization	tests/test_data_processor.py	compute_average checked for empty list (kills boundary mutations)	cosmic-ray / mutmut
73	Edge Case Detection	Boundary Mutant Analysis	tests/test_calculator.py	classify_score(75, ...) vs classify_score(74, ...)	cosmic-ray / mutmut
74	Fault Detection Capability	Logic Error Sensitivity	tests/test_complex_logic.py	flatten depth boundary test kills > max_depth → >= max_depth	cosmic-ray / mutmut
75	Test Coverage Quality	Test Rigor Assessment	tests/test_file_handler.py	overwrite flag tested True/False	cosmic-ray / mutmut
76	Fault Detection Capability	Logic Error Sensitivity	tests/test_calculator.py	factorial(-1) raises — kills n < 0 → n <= 0 mutation	cosmic-ray / mutmut

L2: Test Regression / Coverage Analysis — Coverage Delta

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
77	Regression Testing Monitoring	Coverage Delta %	All src/	diff-cover compares coverage.xml against origin/main	Coverage.py / coveragepy
78	Test Suite Effectiveness	Discovery Power Assessment	tests/	Mutation score tracks test quality over commits	Coverage.py
79	CI/CD Quality Gate	Deployment Readiness Guard	.github/workflows/	--cov-fail-under=70 blocks merge if coverage drops	Coverage.py
80	Change Impact Analysis	Ripple Effect Mapping	data_processor.py	run_pipeline() multi-step; changes ripple through all steps	Coverage.py
81	New Code Testing Validation	Fresh Logic Proofing	All src/	New files get tests; diff-cover checks new lines covered	Coverage.py
82	Quality Improvement Measurement	Structural Health Benchmarking	reports/coverage.xml	Baseline stored in CI artifacts; compared per PR	Coverage.py

L2: Data Flow Testing — All Definition Coverage

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
83	Variable Definition Detection	All-Defs Coverage %	data_processor.py	total, count, normed, label — all defined and exercised	Beniget / pyflakes
84	Definition-Use Mapping	Data Path Correlation	data_processor.py	rank_items() uses normed from _normalize()	coverage.py / pyflakes
85	Coverage Measurement	DU-Path Validation	data_processor.py	Beniget chains for total def → arithmetic use	Beniget / pyflakes
86	Uncovered Definition Detection	Dead Data Identification	data_processor.py	unused_temp in process_with_dead_var() — F841	pylint / pyflakes
87	Edge Case Handling	Null and Boundary Flow Analysis	data_processor.py	parse_csv("") → empty list (boundary def)	CrossHair / pyflakes
88	Reporting Validation	Audit Trail Verification	scripts/run_beniget.py	JSON output of all def-use chains per file	pydriller / pyflakes

L2: Data Flow Testing — All Uses Coverage

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
89	Computational Use Detection	Data Processing Validation	data_processor.py	total += v (C-Use), result * 2 (C-Use)	coverage.py + beniget
90	Predicate Use Detection	Logic Influence Assessment	data_processor.py	if v > 0 in filter_positives() (P-Use of v)	coverage.py + beniget
91	Definition-Use Pair Identification	Path Correlation Mapping	data_processor.py	_normalize() defines normed; rank_items() uses it	coverage.py + beniget
92	All-Uses Coverage Verification	Comprehensive Data Proofing	tests/test_data_processor.py	All functions tested → all use sites reachable	coverage.py + beniget
93	Partial Uses Coverage Detection	Data Flow Gap Analysis	data_processor.py	ghost_use_example(True) – value defined but use unreachable	coverage.py + beniget
94	Multiple Definitions Handling	Ambiguity Resolution	data_processor.py	label defined in 4 branches — all 4 tested	coverage.py + beniget
95	Cross-Function Use Detection	Inter-procedural Tracking	data_processor.py, calculator.py	_validate_number() → process_number() cross-function	coverage.py + beniget
96	Unreachable Use Detection	Ghost Use Identification	data_processor.py	value def in ghost_use_example — only used when flag=False	coverage.py + beniget
97	Coverage Reporting Validation	Data Integrity Audit	reports/beniget_defuse.json	Chains count per file written to JSON	coverage.py + beniget
98	Variable Use Detection	All-Uses Coverage %	All src/	coverage.py line+branch data cross-referenced with Beniget	coverage.py + beniget

L2: Development Process Analysis — Code Churn

#	L4 Classification	L5 Metric	Source File	Key Code Pattern	Tool
99	Risk-Based Testing Prioritization	Code Churn Score	scripts/run_churn.py	Added + deleted lines per commit per file	pydriller
100	Regression Testing Focus	Impact-Driven Verification	Git history	High-churn files identified → regression focus targets	pydriller
101	Defect Prediction	Fault Probability Modeling	Git history	churn × complexity product from pydriller + radon	pydriller
102	Test Case Maintenance	Validation Suite Updates	Git history	Files changed > 2× in last 10 commits flagged for test review	pydriller
103	Change Impact Analysis	Side Effect Mapping	data_processor.py	run_pipeline() – changes to step1/2/3 affect downstream results	pydriller

---

How Each Tool Is Invoked

Tool	Version	Invocation	Metrics Covered
radon	6.0.1	radon cc src -s -a --json	CC, MI, HAL, Cognitive
lizard	1.17.10	lizard src -l python --csv	CC, function complexity
crosshair-tool	0.0.107	crosshair check src/	Execution Path Integrity, Total Logical Combinatorial
pymcdc	0.2.5	python -m pymcdc src/	MC/DC condition coverage
coverage	7.14.1	pytest --cov=src --cov-branch	Statement %, Branch %, Path %
pytest-cov	6.1.0	--cov-report=xml,html	All coverage reports
pytest-testmon	2.2.0	pytest --testmon	QA resource allocation
pylint	4.0.6	pylint src --output-format=json	All lint violation metrics (21–32)
flake8	7.2.0	flake8 src --config=.flake8	PEP8, style, complexity
bandit	1.8.3	bandit -r src -f json	SAST: B105, B301, B303, B307, B501, B602, B608
semgrep	1.112.0	semgrep --config auto src/	SAST: OWASP, CWE-89, CWE-78, CWE-502
pip-audit	2.10.1	pip-audit -r requirements.txt	CVE count, dependency risk
safety	3.5.1	safety check -r requirements.txt	Known vulnerability database
pip-licenses	5.0.0	pip-licenses --format=json	License compliance
mutmut	3.3.0	mutmut run --paths-to-mutate src/	Mutation score
cosmic-ray	8.4.6	cosmic-ray init / exec	Mutation score (alternative)
beniget	0.5.0	scripts/run_beniget.py	Def-use chains (All-Defs, All-Uses)
pyflakes	3.3.2	python -m pyflakes src/	Dead data, undefined names
diff-cover	9.2.4	diff-cover reports/coverage.xml	Coverage delta %
pydriller	2.9	scripts/run_churn.py	Code churn, defect prediction
jscpd	5.0.9	npx jscpd src --languages python	Duplication: all 7 metrics
copydetect	0.4.2	copydetect -t src	Duplication (Python-native)

---

Running Individual Tool Groups

# Only coverage
pytest tests/ --cov=src --cov-branch --cov-report=term-missing

# Only SAST
bandit -r src -f json -o reports/bandit_report.json
semgrep --config auto src/ --json > reports/semgrep_report.json

# Only dependency scan
pip-audit -r requirements.txt --format json
safety check -r requirements.txt --json

# Only lint
pylint src --output-format=json
flake8 src --statistics

# Only duplication
copydetect -t src
npx jscpd src --languages python --reporters json

# Only mutation
mutmut run --paths-to-mutate src/
mutmut results

# Only code churn
python scripts/run_churn.py

# Only data flow
python -m pyflakes src/
python scripts/run_beniget.py

---

Notes on Intentional Code Patterns

File	Intentional Issue	Metric Triggered
auth.py	SQL injection, eval(), pickle, MD5, shell=True	SAST metrics 33–39
duplicated_code.py	3 near-identical order processing functions	Duplication metrics 14–20
utils.py	camelCase naming, unused vars, long lines	Lint metrics 21–32
requirements.txt	Old package versions with known CVEs	SCA metrics 40–47
calculator.py / file_handler.py	Statements after return	Dead code metrics 49, 65
data_processor.py	unused_temp (F841)	Dead data metric 86
complex_logic.py	CC > 20, CogCC > 25	Complexity metrics 1, 7–13

WARNING: The security issues in auth.py and api_client.py are intentional for SAST demonstration. Do not use this code in production.