feat(detection): language-scoped rules + multi-language benchmark corpora

Rebuild the quick-scan detection engine and ground-truth benchmarks to hit >=90% recall / <10% false positives for C/C++, Python, JavaScript, and Java. Engine (findings.py, preprocess.py): - Scope each PatternRule by language (fixes cross-language false positives such as the Python eval/exec rule firing on JS .exec()). - Add JavaScript/TypeScript rules (command exec, eval/Function, reflected XSS, SQLi, path traversal, SSRF, weak hash, deserialization); execFile/spawn-argv excluded as safe alternatives. - Add Java rules (Runtime exec, SQL string concatenation, weak hash, readObject) and a Groovy server-side template rule (yieldUnescaped of a bound variable). - Broaden C/C++ and Python coverage; precision guards for format strings and parameterised vs concatenated SQL; #-comment skipping; CWE in rationale. - Register .java/.groovy/.tpl source extensions. Benchmarks: - Add realistic corpora modeled on Damn Vulnerable C/C++, PyGoat/DVPWA, and NodeGoat, plus the real kiview/damn-vulnerable-spring-boot-app vendored verbatim (MIT, attribution in LICENSE/NOTICE.md). Each manifest carries complete, independently-labeled ground truth including genuinely hard-to-detect vulns (integer overflow, second-order SQLi, prototype pollution) so recall is measured honestly, plus safe-API files for precision. - Fix pre-existing smoke-manifest ground-truth errors (Python/JS line offsets, missing C/C++ strcpy entry, Java SQLi line). benchmark.py: - Fix sink matching to normalise the expected sink consistently so sinks with underscores (e.g. render_template_string) can match. Tests: - Add tests/test_detection_benchmarks.py enforcing the >=90% recall / <10% FP goal per language and overall. Measured: C/C++ 93.3%, Python 93.3%, JavaScript 92.3%, Java 100%; overall 93.6% recall, 0.0% false-positive rate. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-10-16 11:49:28 +00:00 · 2026-06-21 11:49:31 +02:00
parent be65aed96e
commit cf9f945992
38 changed files with 2420 additions and 15 deletions
@@ -0,0 +1,25 @@
+yieldUnescaped '<!DOCTYPE html>'
+html {
+    head {
+        title('Spring Boot - Groovy templates example')
+        link(rel: 'stylesheet', href: '/css/bootstrap.min.css')
+    }
+    body {
+        form(action: "/comments/", method: "POST") {
+            input(name: "input") {
+
+            }
+        }
+
+        comments.each { comment ->
+            div {
+                h3(style: "border-bottom: 1px solid black;") {
+                    yield "Comment by Anonymous"
+                }
+                div(style: "border-bottom: 1px solid black;") {
+                    yieldUnescaped comment
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,13 @@
+yieldUnescaped '<!DOCTYPE html>'
+html {
+    head {
+        title('Damn Vulnerable Spring Boot App - Home')
+    }
+    body {
+        h1 {
+            yield 'Hello and Welcome to the DVSBA!'
+        }
+        p ("Take a look around! We have a ${$a(href:'/books/', "catalouge")} of our favourite books which you can browse. If you like it, leave a comment in the ${ $a(href: '/comments/', "comment section")}!")
+
+    }
+}
@@ -0,0 +1,16 @@
+yieldUnescaped '<!DOCTYPE html>'
+html {
+    head {
+        title('Damn Vulnerable Spring Boot App')
+    }
+    body {
+        div(class: 'container') {
+            a(class: 'brand',
+                href: '/books/',
+                'List')
+            br()
+            br()
+            p "ID: ${book.id}, Name: ${book.name}, Author: ${book.author}"
+        }
+    }
+}
@@ -0,0 +1,38 @@
+yieldUnescaped '<!DOCTYPE html>'
+html {
+    head {
+        title('Damn Vulnerable Spring Boot App')
+    }
+    body {
+        div(class: 'container') {
+            form(method: "GET", action: "/books/detail") {
+                input(name: "id", placeholder: "Search for a book id!")
+            }
+            br
+            table(border:1) {
+                thead {
+                    tr {
+                        td 'ID'
+                        td 'Name'
+                        td 'Author'
+                      }
+                    }
+                tbody {
+                    books.each { book ->
+                        tr {
+                            td {
+                                a(href: "/books/detail?id=${book.id}", "${book.id}")
+                            }
+                            td {
+                                a(href: "/books/detail?id=${book.id}", "${book.name}")
+                            }
+                            td {
+                                a(href: "/books/detail?id=${book.id}", "${book.author}")
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}