marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(pre-push-safety-net): pin labeled evaluation inputs

Browse Source
This commit is contained in:
Marius Ciepluch
2026-09-12 18:45:54 +02:00
parent 56cfc9da89
commit 8acada0d98
11 changed files with 1194 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/repos/nodegoat.toml
+17
View File
@@ -0,0 +1,17 @@
name = "nodegoat"
url = "https://github.com/OWASP/NodeGoat.git"
commit = "c5cb68a7084e4ae7dcc60e6a98768720a81841e8"
language = "javascript"
license = "Apache-2.0"
license_file = "LICENSE"
measures = ["detection"]
note = "Express teaching/development transfer input, selected from documented eval injection without scanner results. Not a production holdout. Authored repair and benign variants are in benchmarks/push/inputs.json."
[[known]]
id = "NodeGoat-contribution-eval"
family = "injection"
weakness = "Request contribution fields are evaluated as JavaScript before numeric validation."
file = "app/routes/contributions.js"
function = "handleContributionsUpdate"
line = 32
reference = "The pinned source documents SSJS injection and an alternate numeric parsing repair immediately below the eval calls."
in_scope = true