Open_Ultra_SAST/benchmarks/measurements/2026-09-30-harnessx-removal-equality/candidate/scan/verification.json

{
 "verifications": [
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "No function-level attacker-reachable entry point currently reaches this line.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-flask-debug:app.py:81",
   "pro_case": "A static pattern matched the source line.",
   "required_next_step": "Add reachability evidence before prioritizing a fix.",
   "status": "rejected",
   "tie_breaker": "Provide call-graph, route, CLI, parser, or dynamic evidence linking attacker input to this function.",
   "verified": false
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-os-command:app.py:17",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-path-traversal:app.py:55",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-shell-true:app.py:23",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-sql-injection:app.py:44",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-sql-injection:app.py:50",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-ssrf:app.py:60",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-ssti:app.py:70",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-unsafe-deserialization:app.py:33",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-unsafe-deserialization:app.py:38",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-unsafe-eval:app.py:28",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  },
  {
   "context_sources": [
    "evidence_level",
    "finding_id",
    "function_name",
    "line",
    "path",
    "reachability_conditions",
    "reachability_evidence",
    "reachability_status",
    "severity",
    "tags",
    "title"
   ],
   "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.",
   "evidence_level": "static_corroboration",
   "finding_id": "python-weak-hash:app.py:65",
   "pro_case": "Static corroboration exists and function-level reachability evidence is attached.",
   "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.",
   "status": "accepted",
   "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.",
   "verified": true
  }
 ]
}