Skip to content

Add 3 test cases: Go XSS (CWE-79), Python open redirect (CWE-601), Python hardcoded credentials (CWE-798) #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sebasgm80 wants to merge 3 commits into from
Closed

Add 3 test cases: Go XSS (CWE-79), Python open redirect (CWE-601), Python hardcoded credentials (CWE-798) #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dd0cbc8
Add 3 test cases: Java XXE (CWE-611), JS CSRF (CWE-352), Python ReDoS…
Aug 3, 2026
e3101e2
Add 3 Python test cases: CWE-377, CWE-209, CWE-918
Aug 3, 2026
38240bc
Add 3 test cases: Go XSS (CWE-79), Python open redirect (CWE-601), Py…
Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions docs/VULNERABILITY_CATALOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,12 @@ from each file's header comment, so this page cannot drift from the source.

## Totals

- **Test cases:** 32
- **Expected detections:** 32
- **`VULNERABLE:` markers:** 77 (individual lines a scanner should flag)
- **`SAFE:` markers:** 40 (lines a scanner must not flag — the false-positive control group)
- **Test cases:** 41
- **Expected detections:** 41
- **`VULNERABLE:` markers:** 100 (individual lines a scanner should flag)
- **`SAFE:` markers:** 49 (lines a scanner must not flag — the false-positive control group)
- **Languages:** 8 — dotenv, go, java, javascript, json, python, ruby, text
- **CWE categories:** 19 — CWE-22, CWE-78, CWE-79, CWE-89, CWE-95, CWE-190, CWE-347, CWE-362, CWE-377, CWE-502, CWE-506, CWE-532, CWE-601, CWE-681, CWE-798, CWE-918, CWE-1321, CWE-1336, CWE-1357
- **CWE categories:** 23 — CWE-22, CWE-78, CWE-79, CWE-89, CWE-95, CWE-190, CWE-209, CWE-347, CWE-352, CWE-362, CWE-377, CWE-502, CWE-506, CWE-532, CWE-601, CWE-611, CWE-681, CWE-798, CWE-918, CWE-1321, CWE-1333, CWE-1336, CWE-1357

## How coverage is scored

Expand All @@ -30,6 +30,7 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.
| Integer overflow and unchecked narrowing conversion | [`integer-overflow.go`](../vulns/go/integer-overflow.go) | CWE-190 | medium | yes | 2 vuln / 3 safe |
| SQL injection via fmt.Sprintf | [`sqli-fmt-sprintf.go`](../vulns/go/sqli-fmt-sprintf.go) | CWE-89 | critical | yes | 2 vuln / 1 safe |
| Server-side request forgery via http.Get on a user-supplied URL | [`ssrf-http-get.go`](../vulns/go/ssrf-http-get.go) | CWE-918 | high | yes | 2 vuln / 2 safe |
| Reflected XSS via fmt.Fprintf into HTTP response | [`xss-http-serve.go`](../vulns/go/xss-http-serve.go) | CWE-79 | high | yes | 3 vuln / 1 safe |

## Java

Expand All @@ -38,11 +39,13 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.
| Insecure deserialisation via ObjectInputStream | [`deserialization-object-input-stream.java`](../vulns/java/deserialization-object-input-stream.java) | CWE-502 | critical | yes | 2 vuln / 2 safe |
| SQL injection via Statement string concatenation | [`sqli-statement-concat.java`](../vulns/java/sqli-statement-concat.java) | CWE-89 | critical | yes | 2 vuln / 1 safe |
| Reflected XSS via HttpServletResponse writer | [`xss-response-writer.java`](../vulns/java/xss-response-writer.java) | CWE-79 | high | yes | 2 vuln / 2 safe |
| XXE via unconfigured DocumentBuilderFactory | [`xxe-document-builder.java`](../vulns/java/xxe-document-builder.java) | CWE-611 | high | yes | 2 vuln / 1 safe |

## JavaScript

| Test case | File | CWE | Severity | Expected | Markers |
|---|---|---|---|---|---|
| CSRF via missing anti-CSRF token on state-changing POST | [`csrf-missing-token.js`](../vulns/javascript/csrf-missing-token.js) | CWE-352 | high | yes | 3 vuln / 1 safe |
| JWT signature validation bypass via decode-only parsing | [`jwt-decode-without-verify.js`](../vulns/javascript/jwt-decode-without-verify.js) | CWE-347 | high | yes | 1 vuln / 1 safe |
| Open redirect via unvalidated next parameter | [`open-redirect.js`](../vulns/javascript/open-redirect.js) | CWE-601 | medium | yes | 3 vuln / 1 safe |
| Prototype pollution via recursive merge | [`prototype-pollution.js`](../vulns/javascript/prototype-pollution.js) | CWE-1321 | high | yes | 2 vuln / 1 safe |
Expand All @@ -56,10 +59,16 @@ counts as a detection. See `docs/SCANNER_INTEGRATION.md`.

| Test case | File | CWE | Severity | Expected | Markers |
|---|---|---|---|---|---|
| Hard-coded database credentials in source | [`hardcoded-credentials.py`](../vulns/python/hardcoded-credentials.py) | CWE-798 | critical | yes | 3 vuln / 1 safe |
| Insecure temp file creation with predictable path | [`insecure-temp-file.py`](../vulns/python/insecure-temp-file.py) | CWE-377 | medium | yes | 3 vuln / 1 safe |
| Open redirect via unvalidated next parameter | [`open-redirect.py`](../vulns/python/open-redirect.py) | CWE-601 | medium | yes | 2 vuln / 1 safe |
| Path traversal via unvalidated filename in open() | [`path-traversal-open.py`](../vulns/python/path-traversal-open.py) | CWE-22 | high | yes | 2 vuln / 2 safe |
| Insecure deserialisation via pickle / yaml.load | [`pickle-deserialization.py`](../vulns/python/pickle-deserialization.py) | CWE-502 | critical | yes | 2 vuln / 2 safe |
| OS command injection via os.system / subprocess shell=True | [`rce-os-system.py`](../vulns/python/rce-os-system.py) | CWE-78 | critical | yes | 3 vuln / 1 safe |
| ReDoS via catastrophic backtracking regex on user input | [`redos-catastrophic-regex.py`](../vulns/python/redos-catastrophic-regex.py) | CWE-1333 | high | yes | 3 vuln / 1 safe |
| SQL injection via string formatting | [`sqli-string-format.py`](../vulns/python/sqli-string-format.py) | CWE-89 | critical | yes | 3 vuln / 1 safe |
| Server-side request forgery via requests.get on user-supplied URL | [`ssrf-requests-user-url.py`](../vulns/python/ssrf-requests-user-url.py) | CWE-918 | high | yes | 2 vuln / 1 safe |
| Sensitive information exposure via raw stack trace in HTTP response | [`stack-trace-exposure.py`](../vulns/python/stack-trace-exposure.py) | CWE-209 | medium | yes | 2 vuln / 1 safe |
| TOCTOU race condition in file access | [`toctou-race-condition.py`](../vulns/python/toctou-race-condition.py) | CWE-362 | medium | yes | 3 vuln / 2 safe |
| XSS via Jinja2 autoescape disabled and server-side template injection | [`xss-jinja2-autoescape-off.py`](../vulns/python/xss-jinja2-autoescape-off.py) | CWE-79 | high | yes | 3 vuln / 1 safe |

Expand Down
233 changes: 229 additions & 4 deletions vulns/VULNERABILITY_CATALOG.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@
"schema": "threatcrush-testbed-catalog/1",
"note": "Generated by scripts/generate-catalog.py \u2014 do not edit by hand.",
"totals": {
"test_cases": 32,
"expected_detections": 32,
"vulnerable_markers": 77,
"safe_markers": 40,
"test_cases": 41,
"expected_detections": 41,
"vulnerable_markers": 100,
"safe_markers": 49,
"languages": [
"dotenv",
"go",
Expand All @@ -32,17 +32,21 @@
"CWE-89",
"CWE-95",
"CWE-190",
"CWE-209",
"CWE-347",
"CWE-352",
"CWE-362",
"CWE-377",
"CWE-502",
"CWE-506",
"CWE-532",
"CWE-601",
"CWE-611",
"CWE-681",
"CWE-798",
"CWE-918",
"CWE-1321",
"CWE-1333",
"CWE-1336",
"CWE-1357"
]
Expand Down Expand Up @@ -148,6 +152,31 @@
56
]
},
{
"id": "go-xss-http-serve",
"file": "vulns/go/xss-http-serve.go",
"title": "Reflected XSS via fmt.Fprintf into HTTP response",
"category": "go",
"language": "go",
"cwe": "CWE-79",
"cwes": [
"CWE-79"
],
"severity": "high",
"expected_detection": true,
"description": "A query parameter is written directly into the response with",
"detection_target": "Taint flow from r.URL.Query() into w.Write/fmt.Fprintf",
"safe_guard": "Wrapped in if (false) \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
29,
31,
39
],
"safe_lines": [
51
]
},
{
"id": "java-deserialization-object-input-stream",
"file": "vulns/java/deserialization-object-input-stream.java",
Expand Down Expand Up @@ -222,6 +251,55 @@
56
]
},
{
"id": "java-xxe-document-builder",
"file": "vulns/java/xxe-document-builder.java",
"title": "XXE via unconfigured DocumentBuilderFactory",
"category": "java",
"language": "java",
"cwe": "CWE-611",
"cwes": [
"CWE-611"
],
"severity": "high",
"expected_detection": true,
"description": "An XML parser is built from DocumentBuilderFactory with default",
"detection_target": "Taint flow from user XML input into DocumentBuilder.parse",
"safe_guard": "Wrapped in if (false) \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
30,
34
],
"safe_lines": [
46
]
},
{
"id": "js-csrf-missing-token",
"file": "vulns/javascript/csrf-missing-token.js",
"title": "CSRF via missing anti-CSRF token on state-changing POST",
"category": "javascript",
"language": "javascript",
"cwe": "CWE-352",
"cwes": [
"CWE-352"
],
"severity": "high",
"expected_detection": true,
"description": "A state-changing Express endpoint (transfer, delete, password",
"detection_target": "State-changing handler that reads session cookies but never",
"safe_guard": "Wrapped in if (false) \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
25,
33,
42
],
"safe_lines": [
55
]
},
{
"id": "js-jwt-decode-without-verify",
"file": "vulns/javascript/jwt-decode-without-verify.js",
Expand Down Expand Up @@ -416,6 +494,80 @@
47
]
},
{
"id": "py-hardcoded-credentials",
"file": "vulns/python/hardcoded-credentials.py",
"title": "Hard-coded database credentials in source",
"category": "python",
"language": "python",
"cwe": "CWE-798",
"cwes": [
"CWE-798"
],
"severity": "critical",
"expected_detection": true,
"description": "A production database connection string and API secret are",
"detection_target": "Literal credential values assigned to connection/secret",
"safe_guard": "Wrapped in if False \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
23,
27,
33
],
"safe_lines": [
43
]
},
{
"id": "py-insecure-temp-file",
"file": "vulns/python/insecure-temp-file.py",
"title": "Insecure temp file creation with predictable path",
"category": "python",
"language": "python",
"cwe": "CWE-377",
"cwes": [
"CWE-377"
],
"severity": "medium",
"expected_detection": true,
"description": "A temporary file is created in the shared /tmp directory using a",
"detection_target": "open()/write() to a path built from tempfile or /tmp with a",
"safe_guard": "Wrapped in if False \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
24,
33,
35
],
"safe_lines": [
48
]
},
{
"id": "py-open-redirect",
"file": "vulns/python/open-redirect.py",
"title": "Open redirect via unvalidated next parameter",
"category": "python",
"language": "python",
"cwe": "CWE-601",
"cwes": [
"CWE-601"
],
"severity": "medium",
"expected_detection": true,
"description": "A post-login redirect target is taken from the query string with",
"detection_target": "Taint flow from request input into redirect()/Location",
"safe_guard": "Wrapped in if False \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
24,
30
],
"safe_lines": [
41
]
},
{
"id": "py-path-traversal-open",
"file": "vulns/python/path-traversal-open.py",
Expand Down Expand Up @@ -491,6 +643,31 @@
47
]
},
{
"id": "py-redos-catastrophic-regex",
"file": "vulns/python/redos-catastrophic-regex.py",
"title": "ReDoS via catastrophic backtracking regex on user input",
"category": "python",
"language": "python",
"cwe": "CWE-1333",
"cwes": [
"CWE-1333"
],
"severity": "high",
"expected_detection": true,
"description": "A user-supplied string is matched against a regex with nested",
"detection_target": "Regex pattern with nested quantifiers applied to",
"safe_guard": "Wrapped in if False \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
22,
29,
35
],
"safe_lines": [
45
]
},
{
"id": "py-sqli-string-format",
"file": "vulns/python/sqli-string-format.py",
Expand All @@ -516,6 +693,54 @@
45
]
},
{
"id": "py-ssrf-requests-user-url",
"file": "vulns/python/ssrf-requests-user-url.py",
"title": "Server-side request forgery via requests.get on user-supplied URL",
"category": "python",
"language": "python",
"cwe": "CWE-918",
"cwes": [
"CWE-918"
],
"severity": "high",
"expected_detection": true,
"description": "A URL supplied by the request body is passed directly to",
"detection_target": "Taint flow from request input into requests.get/urlopen",
"safe_guard": "Wrapped in if False \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
25,
33
],
"safe_lines": [
44
]
},
{
"id": "py-stack-trace-exposure",
"file": "vulns/python/stack-trace-exposure.py",
"title": "Sensitive information exposure via raw stack trace in HTTP response",
"category": "python",
"language": "python",
"cwe": "CWE-209",
"cwes": [
"CWE-209"
],
"severity": "medium",
"expected_detection": true,
"description": "An unhandled exception inside a request handler is returned to the",
"detection_target": "Exception handler or framework debug mode that echoes the",
"safe_guard": "Wrapped in if False \u2014 the body is unreachable dead code. All",
"attribution": "line",
"vulnerable_lines": [
28,
36
],
"safe_lines": [
48
]
},
{
"id": "py-toctou-race-condition",
"file": "vulns/python/toctou-race-condition.py",
Expand Down
Loading
Loading