mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 20:49:28 +00:00
feat(propose-adjudicate-prove): overlay adjudicates inventory before prove
Regex inventory stays the proposer. MAP attaches promote/demote/unadjudicated/coverage from intra-file taint (tree-sitter when a grammar parses, Python ast as last resort). Deep sandboxes promotions only, ordered by the existing heuristic ranker plus optional OpenRouter mechanism recall. The SAST pair slice scores overlay outcomes; the stage-1 detection gate and local pair gate stay inventory-only.
This commit is contained in:
Marius Ciepluch
+99
@@ -0,0 +1,99 @@
|
||||
/* TEMPLATE GENERATED TESTCASE FILE
|
||||
Filename: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
|
||||
Label Definition File: CWE121_Stack_Based_Buffer_Overflow__CWE193.label.xml
|
||||
Template File: sources-sink-01.tmpl.c
|
||||
*/
|
||||
/*
|
||||
* @description
|
||||
* CWE: 121 Stack Based Buffer Overflow
|
||||
* BadSource: Point data to a buffer that does not have space for a NULL terminator
|
||||
* GoodSource: Point data to a buffer that includes space for a NULL terminator
|
||||
* Sink: cpy
|
||||
* BadSink : Copy string to data using strcpy()
|
||||
* Flow Variant: 01 Baseline
|
||||
*
|
||||
* */
|
||||
|
||||
#include "std_testcase.h"
|
||||
|
||||
#ifndef _WIN32
|
||||
#include <wchar.h>
|
||||
#endif
|
||||
|
||||
/* MAINTENANCE NOTE: The length of this string should equal the 10 */
|
||||
#define SRC_STRING "AAAAAAAAAA"
|
||||
|
||||
#ifndef OMITBAD
|
||||
|
||||
void CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01_bad()
|
||||
{
|
||||
char * data;
|
||||
char dataBadBuffer[10];
|
||||
char dataGoodBuffer[10+1];
|
||||
/* FLAW: Set a pointer to a buffer that does not leave room for a NULL terminator when performing
|
||||
* string copies in the sinks */
|
||||
data = dataBadBuffer;
|
||||
data[0] = '\0'; /* null terminate */
|
||||
{
|
||||
char source[10+1] = SRC_STRING;
|
||||
/* POTENTIAL FLAW: data may not have enough space to hold source */
|
||||
strcpy(data, source);
|
||||
printLine(data);
|
||||
}
|
||||
}
|
||||
|
||||
#endif /* OMITBAD */
|
||||
|
||||
#ifndef OMITGOOD
|
||||
|
||||
/* goodG2B uses the GoodSource with the BadSink */
|
||||
static void goodG2B()
|
||||
{
|
||||
char * data;
|
||||
char dataBadBuffer[10];
|
||||
char dataGoodBuffer[10+1];
|
||||
/* FIX: Set a pointer to a buffer that leaves room for a NULL terminator when performing
|
||||
* string copies in the sinks */
|
||||
data = dataGoodBuffer;
|
||||
data[0] = '\0'; /* null terminate */
|
||||
{
|
||||
char source[10+1] = SRC_STRING;
|
||||
/* POTENTIAL FLAW: data may not have enough space to hold source */
|
||||
strcpy(data, source);
|
||||
printLine(data);
|
||||
}
|
||||
}
|
||||
|
||||
void CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01_good()
|
||||
{
|
||||
goodG2B();
|
||||
}
|
||||
|
||||
#endif /* OMITGOOD */
|
||||
|
||||
/* Below is the main(). It is only used when building this testcase on
|
||||
* its own for testing or for building a binary to use in testing binary
|
||||
* analysis tools. It is not used when compiling all the testcases as one
|
||||
* application, which is how source code analysis tools are tested.
|
||||
*/
|
||||
|
||||
#ifdef INCLUDEMAIN
|
||||
|
||||
int main(int argc, char * argv[])
|
||||
{
|
||||
/* seed randomness */
|
||||
srand( (unsigned)time(NULL) );
|
||||
#ifndef OMITGOOD
|
||||
printLine("Calling good()...");
|
||||
CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01_good();
|
||||
printLine("Finished good()");
|
||||
#endif /* OMITGOOD */
|
||||
#ifndef OMITBAD
|
||||
printLine("Calling bad()...");
|
||||
CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01_bad();
|
||||
printLine("Finished bad()");
|
||||
#endif /* OMITBAD */
|
||||
return 0;
|
||||
}
|
||||
|
||||
#endif
|
||||
+143
@@ -0,0 +1,143 @@
|
||||
/* TEMPLATE GENERATED TESTCASE FILE
|
||||
Filename: CWE134_Uncontrolled_Format_String__char_console_printf_01.c
|
||||
Label Definition File: CWE134_Uncontrolled_Format_String.label.xml
|
||||
Template File: sources-sinks-01.tmpl.c
|
||||
*/
|
||||
/*
|
||||
* @description
|
||||
* CWE: 134 Uncontrolled Format String
|
||||
* BadSource: console Read input from the console
|
||||
* GoodSource: Copy a fixed string into data
|
||||
* Sinks: printf
|
||||
* GoodSink: printf with "%s" as the first argument and data as the second
|
||||
* BadSink : printf with only data as an argument
|
||||
* Flow Variant: 01 Baseline
|
||||
*
|
||||
* */
|
||||
|
||||
#include "std_testcase.h"
|
||||
|
||||
#ifndef _WIN32
|
||||
#include <wchar.h>
|
||||
#endif
|
||||
|
||||
#ifndef OMITBAD
|
||||
|
||||
void CWE134_Uncontrolled_Format_String__char_console_printf_01_bad()
|
||||
{
|
||||
char * data;
|
||||
char dataBuffer[100] = "";
|
||||
data = dataBuffer;
|
||||
{
|
||||
/* Read input from the console */
|
||||
size_t dataLen = strlen(data);
|
||||
/* if there is room in data, read into it from the console */
|
||||
if (100-dataLen > 1)
|
||||
{
|
||||
/* POTENTIAL FLAW: Read data from the console */
|
||||
if (fgets(data+dataLen, (int)(100-dataLen), stdin) != NULL)
|
||||
{
|
||||
/* The next few lines remove the carriage return from the string that is
|
||||
* inserted by fgets() */
|
||||
dataLen = strlen(data);
|
||||
if (dataLen > 0 && data[dataLen-1] == '\n')
|
||||
{
|
||||
data[dataLen-1] = '\0';
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
printLine("fgets() failed");
|
||||
/* Restore NUL terminator if fgets fails */
|
||||
data[dataLen] = '\0';
|
||||
}
|
||||
}
|
||||
}
|
||||
/* POTENTIAL FLAW: Do not specify the format allowing a possible format string vulnerability */
|
||||
printf(data);
|
||||
}
|
||||
|
||||
#endif /* OMITBAD */
|
||||
|
||||
#ifndef OMITGOOD
|
||||
|
||||
/* goodG2B uses the GoodSource with the BadSink */
|
||||
static void goodG2B()
|
||||
{
|
||||
char * data;
|
||||
char dataBuffer[100] = "";
|
||||
data = dataBuffer;
|
||||
/* FIX: Use a fixed string that does not contain a format specifier */
|
||||
strcpy(data, "fixedstringtest");
|
||||
/* POTENTIAL FLAW: Do not specify the format allowing a possible format string vulnerability */
|
||||
printf(data);
|
||||
}
|
||||
|
||||
/* goodB2G uses the BadSource with the GoodSink */
|
||||
static void goodB2G()
|
||||
{
|
||||
char * data;
|
||||
char dataBuffer[100] = "";
|
||||
data = dataBuffer;
|
||||
{
|
||||
/* Read input from the console */
|
||||
size_t dataLen = strlen(data);
|
||||
/* if there is room in data, read into it from the console */
|
||||
if (100-dataLen > 1)
|
||||
{
|
||||
/* POTENTIAL FLAW: Read data from the console */
|
||||
if (fgets(data+dataLen, (int)(100-dataLen), stdin) != NULL)
|
||||
{
|
||||
/* The next few lines remove the carriage return from the string that is
|
||||
* inserted by fgets() */
|
||||
dataLen = strlen(data);
|
||||
if (dataLen > 0 && data[dataLen-1] == '\n')
|
||||
{
|
||||
data[dataLen-1] = '\0';
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
printLine("fgets() failed");
|
||||
/* Restore NUL terminator if fgets fails */
|
||||
data[dataLen] = '\0';
|
||||
}
|
||||
}
|
||||
}
|
||||
/* FIX: Specify the format disallowing a format string vulnerability */
|
||||
printf("%s\n", data);
|
||||
}
|
||||
|
||||
void CWE134_Uncontrolled_Format_String__char_console_printf_01_good()
|
||||
{
|
||||
goodG2B();
|
||||
goodB2G();
|
||||
}
|
||||
|
||||
#endif /* OMITGOOD */
|
||||
|
||||
/* Below is the main(). It is only used when building this testcase on
|
||||
its own for testing or for building a binary to use in testing binary
|
||||
analysis tools. It is not used when compiling all the testcases as one
|
||||
application, which is how source code analysis tools are tested. */
|
||||
|
||||
#ifdef INCLUDEMAIN
|
||||
|
||||
int main(int argc, char * argv[])
|
||||
{
|
||||
/* seed randomness */
|
||||
srand( (unsigned)time(NULL) );
|
||||
#ifndef OMITGOOD
|
||||
printLine("Calling good()...");
|
||||
CWE134_Uncontrolled_Format_String__char_console_printf_01_good();
|
||||
printLine("Finished good()");
|
||||
#endif /* OMITGOOD */
|
||||
#ifndef OMITBAD
|
||||
printLine("Calling bad()...");
|
||||
CWE134_Uncontrolled_Format_String__char_console_printf_01_bad();
|
||||
printLine("Finished bad()");
|
||||
#endif /* OMITBAD */
|
||||
return 0;
|
||||
}
|
||||
|
||||
#endif
|
||||
@@ -0,0 +1,10 @@
|
||||
/* Juliet CWE-121 goodG2B still copies with strcpy (larger buffer, same sink).
|
||||
* Regex SAST is expected to keep firing — that is the Juliet goodG2B trap.
|
||||
* Upstream: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
|
||||
*/
|
||||
#include <string.h>
|
||||
|
||||
void CWE121_char_declare_cpy_01_goodG2B(char *data, char *source)
|
||||
{
|
||||
strcpy(data, source);
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
/* Juliet CWE-121 flow variant 01 — bad sink only.
|
||||
* Upstream: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_cpy_01.c
|
||||
* https://github.com/arichardson/juliet-test-suite-c (NIST Juliet 1.3, CC0)
|
||||
*/
|
||||
#include <string.h>
|
||||
|
||||
void CWE121_char_declare_cpy_01_bad(char *data, char *source)
|
||||
{
|
||||
/* POTENTIAL FLAW: data may not have enough space to hold source */
|
||||
strcpy(data, source);
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
/* Juliet CWE-134 flow variant 01 — goodB2G sink only.
|
||||
* Upstream: CWE134_Uncontrolled_Format_String__char_console_printf_01.c
|
||||
* https://github.com/arichardson/juliet-test-suite-c (NIST Juliet 1.3, CC0)
|
||||
*/
|
||||
#include <stdio.h>
|
||||
|
||||
void CWE134_char_console_printf_01_goodB2G(char *data)
|
||||
{
|
||||
/* FIX: Specify the format disallowing a format string vulnerability */
|
||||
printf("%s\n", data);
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
/* Juliet CWE-134 flow variant 01 — bad sink only.
|
||||
* Upstream: testcases/CWE134_Uncontrolled_Format_String/s01/
|
||||
* CWE134_Uncontrolled_Format_String__char_console_printf_01.c
|
||||
* https://github.com/arichardson/juliet-test-suite-c (NIST Juliet 1.3, CC0)
|
||||
*/
|
||||
#include <stdio.h>
|
||||
|
||||
void CWE134_char_console_printf_01_bad(char *data)
|
||||
{
|
||||
/* POTENTIAL FLAW: Do not specify the format allowing a format string vulnerability */
|
||||
printf(data);
|
||||
}
|
||||
Reference in New Issue
Block a user